Skip to content

Commit 97ec1f7

Browse files
vmojzisbachradsusi
vmojzis
authored and
bachradsusi
committed
python/semanage: Improve man pages
- Add missing options - Add more examples - Note special cases Signed-off-by: Vit Mojzis <[email protected]>
1 parent e563837 commit 97ec1f7

14 files changed

+101
-44
lines changed

‎python/semanage/semanage-boolean.8‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,14 @@ semanage\-boolean \- SELinux Policy Management boolean tool
77
.SH "DESCRIPTION"
88
semanage is used to configure certain elements of
99
SELinux policy without requiring modification to or recompilation
10-
from policy sources. semanage boolean command controls the settings of booleans in SELinux policy. booleans are if\-then\-else rules written in SELinux Policy. They can be used to customize the way that SELinux Policy rules effect a confined domain.
10+
from policy sources.
11+
.B semanage boolean
12+
command controls the settings of booleans in SELinux policy. Booleans are if\-then\-else rules written in SELinux Policy. They can be used to customize the way that SELinux Policy rules effect a confined domain.
13+
1114
.SH "OPTIONS"
1215
.TP
1316
.I \-h, \-\-help
14-
show this help message and exit
17+
Show this help message and exit
1518
.TP
1619
.I \-n, \-\-noheading
1720
Do not print heading when listing the specified object type
@@ -45,7 +48,7 @@ Disable the boolean
4548

4649
.SH EXAMPLE
4750
.nf
48-
Turn on the apache can send mail boolean
51+
Turn on the "apache can send mail" boolean (persistent version of #setsebool httpd_can_sendmail on)
4952
# semanage boolean \-m \-\-on httpd_can_sendmail
5053

5154
List customized booleans

‎python/semanage/semanage-dontaudit.8‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,15 @@
77
.SH "DESCRIPTION"
88
semanage is used to configure certain elements of
99
SELinux policy without requiring modification to or recompilation
10-
from policy sources. semanage dontaudit toggles whether or not dontaudit rules will be in the policy. Policy writers use dontaudit rules to cause
11-
confined applications to use alternative paths. Dontaudit rules are denied but not reported in the logs. Some times dontaudit rules can cause bugs in applications but policy writers will not realize it since the AVC is not audited. Turning off dontaudit rules with this command to see if the kernel is blocking an access.
10+
from policy sources.
11+
.B semanage dontaudit
12+
toggles whether or not dontaudit rules will be in the policy. Policy writers use dontaudit rules to cause
13+
confined applications to use alternative paths. Dontaudit rules are denied but not reported in the logs. Sometimes dontaudit rules can cause bugs in applications but policy writers will not realize it since the AVC is not audited. Turn off dontaudit rules with this command to see if the kernel is blocking an access.
1214

1315
.SH "OPTIONS"
1416
.TP
1517
.I \-h, \-\-help
16-
show this help message and exit
18+
Show this help message and exit
1719
.TP
1820
.I \-S STORE, \-\-store STORE
1921
Select an alternate SELinux Policy Store to manage

‎python/semanage/semanage-export.8‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,15 @@
77
.SH "DESCRIPTION"
88
semanage is used to configure certain elements of
99
SELinux policy without requiring modification to or recompilation
10-
from policy sources. semanage import and export can be used to extract the SELinux modifications from one machine and apply them to another. You can put a whole group of semanage commands within a file and apply them to a machine in a single transaction.
10+
from policy sources.
11+
.B semanage import
12+
and
13+
.B export
14+
can be used to extract the SELinux modifications from one machine and apply them to another. Please note that this will remove all current semanage customizations on the second machine as the command list generated using
15+
.B semanage export
16+
start with
17+
.I <command> -D
18+
for all semanage sub-commands. You can put a whole group of semanage commands within a file and apply them to a machine in a single transaction.
1119

1220
.SH "OPTIONS"
1321
.TP

‎python/semanage/semanage-fcontext.8‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,10 @@ semanage\-fcontext \- SELinux Policy Management file context tool
88
.SH "DESCRIPTION"
99
semanage is used to configure certain elements of
1010
SELinux policy without requiring modification to or recompilation
11-
from policy sources. semanage fcontext is used to manage the default
12-
file system labeling on an SELinux system. This command maps file paths using regular expressions to SELinux labels.
11+
from policy sources.
12+
.B semanage fcontext
13+
is used to manage the default file system labeling on an SELinux system.
14+
This command maps file paths using regular expressions to SELinux labels.
1315

1416
FILE_SPEC may contain either a fully qualified path,
1517
or a Perl compatible regular expression (PCRE),
@@ -32,7 +34,7 @@ to avoid unintentionally impacting other parts of the filesystem.
3234
.SH "OPTIONS"
3335
.TP
3436
.I \-h, \-\-help
35-
show this help message and exit
37+
Show this help message and exit
3638
.TP
3739
.I \-n, \-\-noheading
3840
Do not print heading when listing the specified object type
@@ -82,12 +84,13 @@ MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login ma
8284

8385
.SH EXAMPLE
8486
.nf
85-
.I remember to run restorecon after you set the file context
86-
Add file-context for everything under /web
87+
.I Remember to run restorecon after you set the file context
88+
Add file-context httpd_sys_content_t for everything under /web
8789
# semanage fcontext \-a \-t httpd_sys_content_t "/web(/.*)?"
8890
# restorecon \-R \-v /web
8991

9092
Substitute /home1 with /home when setting file context
93+
i.e. label everything under /home1 the same way /home is labeled
9194
# semanage fcontext \-a \-e /home /home1
9295
# restorecon \-R \-v /home1
9396

@@ -99,7 +102,9 @@ execute the following commands.
99102

100103
.SH "SEE ALSO"
101104
.BR selinux (8),
102-
.BR semanage (8)
105+
.BR semanage (8),
106+
.BR restorecon (8),
107+
.BR selabel_file (5)
103108

104109
.SH "AUTHOR"
105110
This man page was written by Daniel Walsh <[email protected]>

‎python/semanage/semanage-ibendport.8‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,14 @@
55
.B semanage ibendport [\-h] [\-n] [\-N] [\-S STORE] [ \-\-add \-t TYPE \-z IBDEV_NAME \-r RANGE port | \-\-delete \-z IBDEV_NAME port | \-\-deleteall | \-\-extract | \-\-list [\-C] | \-\-modify \-t TYPE \-z IBDEV_NAME \-r RANGE port ]
66

77
.SH "DESCRIPTION"
8-
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage ibendport controls the ibendport number to ibendport type definitions.
8+
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources.
9+
.B semanage ibendport
10+
controls the ibendport number to ibendport type definitions.
911

1012
.SH "OPTIONS"
1113
.TP
1214
.I \-h, \-\-help
13-
show this help message and exit
15+
Show this help message and exit
1416
.TP
1517
.I \-n, \-\-noheading
1618
Do not print heading when listing the specified object type

‎python/semanage/semanage-ibpkey.8‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,14 @@
55
.B semanage ibpkey [\-h] [\-n] [\-N] [\-S STORE] [ \-\-add \-t TYPE \-x SUBNET_PREFIX \-r RANGE ibpkey_name | ibpkey_range | \-\-delete \-x SUBNET_PREFIX ibpkey_name | ibpkey_range | \-\-deleteall | \-\-extract | \-\-list [\-C] | \-\-modify \-t TYPE \-x SUBNET_PREFIX \-r RANGE ibpkey_name | ibpkey_range ]
66

77
.SH "DESCRIPTION"
8-
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage ibpkey controls the ibpkey number to ibpkey type definitions.
8+
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources.
9+
.B semanage ibpkey
10+
controls the ibpkey number to ibpkey type definitions.
911

1012
.SH "OPTIONS"
1113
.TP
1214
.I \-h, \-\-help
13-
show this help message and exit
15+
Show this help message and exit
1416
.TP
1517
.I \-n, \-\-noheading
1618
Do not print heading when listing the specified object type

‎python/semanage/semanage-import.8‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,15 @@
77
.SH "DESCRIPTION"
88
semanage is used to configure certain elements of
99
SELinux policy without requiring modification to or recompilation
10-
from policy sources. semanage import and export can be used to extract the SELinux modifications from one machine and apply them to another. You can put a whole group of semanage commands within a file and apply them to a machine in a single transaction.
10+
from policy sources.
11+
.B semanage import
12+
and
13+
.B export
14+
can be used to extract the SELinux modifications from one machine and apply them to another. Please note that this will remove all current semanage customizations on the second machine as the command list generated using
15+
.B semanage export
16+
start with
17+
.I <command> -D
18+
for all semanage sub-commands. You can put a whole group of semanage commands within a file and apply them to a machine in a single transaction.
1119

1220
.SH "OPTIONS"
1321
.TP

‎python/semanage/semanage-interface.8‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,14 @@
77
.SH "DESCRIPTION"
88
semanage is used to configure certain elements of
99
SELinux policy without requiring modification to or recompilation
10-
from policy sources. semanage interface controls the labels assigned to network interfaces.
10+
from policy sources.
11+
.B semanage interface
12+
controls the labels assigned to network interfaces.
1113

1214
.SH "OPTIONS"
1315
.TP
1416
.I \-h, \-\-help
15-
show this help message and exit
17+
Show this help message and exit
1618
.TP
1719
.I \-n, \-\-noheading
1820
Do not print heading when listing the specified object type
@@ -54,6 +56,8 @@ MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login ma
5456
.nf
5557
list all interface definitions
5658
# semanage interface \-l
59+
Assign type netif_t and MLS/MCS range s0:c0.c1023 to interface eth0
60+
# semanage interface \-a \-t netif_t \-r s0:c0.c1023 eth0
5761

5862
.SH "SEE ALSO"
5963
.BR selinux (8),

‎python/semanage/semanage-login.8‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,14 @@
77
.SH "DESCRIPTION"
88
semanage is used to configure certain elements of
99
SELinux policy without requiring modification to or recompilation
10-
from policy sources. semanage login controls the mapping between a Linux User and the SELinux User. It can be used to turn on confined users. For example you could define that a particular user or group of users will login to a system as the user_u user. Prefix the group name with a '%' sign to indicate a group name.
10+
from policy sources.
11+
.B semanage login
12+
controls the mapping between a Linux User and the SELinux User. It can be used to turn on confined users. For example you could define that a particular user or group of users will login to a system as the user_u user. Prefix the group name with a '%' sign to indicate a group name.
1113

1214
.SH "OPTIONS"
1315
.TP
1416
.I \-h, \-\-help
15-
show this help message and exit
17+
Show this help message and exit
1618
.TP
1719
.I \-n, \-\-noheading
1820
Do not print heading when listing the specified object type
@@ -52,11 +54,11 @@ MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login ma
5254

5355
.SH EXAMPLE
5456
.nf
55-
Modify the default user on the system to the guest_u user
57+
Set the default SELinux user on the system to guest_u
5658
# semanage login \-m \-s guest_u __default__
57-
Assign gijoe user on an MLS machine a range and to the staff_u user
58-
# semanage login \-a \-s staff_u \-rSystemLow-Secret gijoe
59-
Assign all users in the engineering group to the staff_u user
59+
Map user gijoe to SELinux user staff_u and assign MLS range SystemLow\-Secret
60+
# semanage login \-a \-s staff_u \-rSystemLow\-Secret gijoe
61+
Map all users in the engineering group to SELinux user staff_u
6062
# semanage login \-a \-s staff_u %engineering
6163

6264
.SH "SEE ALSO"

‎python/semanage/semanage-module.8‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,14 @@
55
.B semanage module [\-h] [\-n] [\-N] [\-S STORE] (\-a | \-r | \-e | \-d | \-\-extract | \-\-list [\-C] | \-\-deleteall) [module_name]
66

77
.SH "DESCRIPTION"
8-
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage module installs, removes, disables SELinux Policy modules.
8+
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources.
9+
.B semanage module
10+
installs, removes, disables, or enables SELinux Policy modules.
911

1012
.SH "OPTIONS"
1113
.TP
1214
.I \-h, \-\-help
13-
show this help message and exit
15+
Show this help message and exit
1416
.TP
1517
.I \-n, \-\-noheading
1618
Do not print heading when listing the specified object type
@@ -22,11 +24,14 @@ Do not reload policy after commit
2224
Select an alternate SELinux Policy Store to manage
2325
.TP
2426
.I \-a, \-\-add
25-
Install specified module
27+
Install specified module. Accepts both binary policy files (.pp) and CIL source files
2628
.TP
2729
.I \-r, \-\-remove
2830
Remove specified module
2931
.TP
32+
.I \-D, \-\-deleteall
33+
Remove all local customizations related to modules
34+
.TP
3035
.I \-d \-\-disable
3136
Disable specified module
3237
.TP
@@ -48,8 +53,8 @@ List all modules
4853
# semanage module \-l
4954
Disable unconfined module
5055
# semanage module \-\-disable unconfined
51-
Install custom apache policy module
52-
# semanage module \-a myapache
56+
Install custom apache policy module (same as #semodule -i myapache.pp)
57+
# semanage module \-a myapache.pp
5358

5459
.SH "SEE ALSO"
5560
.BR selinux (8),

0 commit comments

Comments
 (0)