MAN page from Fedora 21 libsemanage-2.3-6.fc21.x86_64.rpm

semanage.conf

Section: Linux System Administration (5)
Updated: September 2011
Index

NAME

semanage.conf - global configuration file for the SELinux Management library

DESCRIPTION

Thesemanage.conffile is usually located under the directory /etc/selinux and it is used for run-time configuration of thebehavior of the SELinux Management library.

Each line should contain a configuration parameter followed by the equal sign ("=") and then followed by the configuration value for thatparameter. Anything after the "#" symbol is ignored similarly to empty lines.

The following parameters are allowed:

module-store: Specify how the SELinux Management library should interact with the SELinux policy store. When set to "direct", the SELinuxManagement library writes to the SELinux policy module store directly (this is the default setting).Otherwise a socket path or a server name can be used for the argument.If the argument begins with "/" (as in "/foo/bar"), it represents the path to a named socket that should be used to connect the policy managementserver.If the argument does not begin with a "/" (as in "foo.com:4242"), it should be interpreted as the name of a remote policy management serverto be used through a TCP connection (default port is 4242 unless a different one is specified after the server name using the colon to separatethe two fields).
policy-version: When generating the policy, by defaultsemanagewill set the policy version to POLICYDB_VERSION_MAX, as defined in <sepol/policydb/policydb.h>. Change this setting if a differentversion needs to be set for the policy.
expand-check: Whether or not to check "neverallow" rules when executing allsemanagecommand. It can be set to either "0" (disabled) or "1" (enabled) and by default it is enabled. There might be a largepenalty in execution time if this option is enabled.
file-mode: By default the permission mode for the run-time policy files is set to 0644.
save-previous: It controls whether the previous module directory is saved after a successful commit to the policy store and it can be set toeither "true" or "false". By default it is set to "false" (the previous version is deleted).
save-linked: It controls whether the previously linked module is saved (with name "base.linked") after a successful commit to the policy store.It can be set to either "true" or "false" and by default it is set to "false" (the previous module is deleted).
ignoredirs: List, separated by ";", of directories to ignore when setting up users homedirs. Some distributions use this to stop labeling /root as a homedir.
usepasswd: Whether or not to enable the use getpwent() to obtain a list of home directories to label. It can be set to either "true" or "false".By default it is set to "true".
disable-genhomedircon: It controls whether or not the genhomedircon function is executed when using thesemanagecommand and it can be set to either "false" or "true". By default the genhomedircon functionality is enabled (equivalentto this option set to "false").
handle-unknown: This option controls the kernel behavior for handling permissions defined in the kernel but missing from the actual policy.It can be set to "deny", "reject" or "allow".
bzip-blocksize: It should be in the range 0-9. A value of 0 means no compression. By default the bzip block size is set to 9 (actual blocksize value is obtained after multiplication by 100000).
bzip-small: When set to "true", the bzip algorithm shall try to reduce its system memory usage. It can be set to either "true" or "false" andby default it is set to "false".

AUTHOR

This manual page was written by Guido Trentalancia <guidoAATTtrentalancia.com>.

The SELinux management library was written by Tresys Technology LLC and Red Hat Inc.

This document was created byman2html,using the manual pages.

semanage.conf

NAME

DESCRIPTION

SEE ALSO

AUTHOR

Index