semanage(8)
Manage SELinux policy components including users, roles, types, and file contexts.
Synopsis
semanage SUBCOMMAND [OPTIONS] [-h]Description
semanage is the primary tool for managing SELinux policy at the user level without requiring policy recompilation. It handles persistent modifications to SELinux configuration including user mappings, role definitions, port access, interface bindings, and file context rules.
Changes made with semanage are stored in the SELinux policy store and persist across reboots. The tool supports subcommands for managing users, roles, types, booleans, logins, ports, interfaces, modules, and file contexts.
Most subcommands require root privileges. Use -h with any subcommand for detailed help on that specific operation.
Common options
| Flag | What it does |
|---|---|
-a, --add | Add a new entry (used with subcommands like user, role, port, fcontext) |
-m, --modify | Modify an existing entry |
-d, --delete | Delete an existing entry |
-l, --list | List all entries of the specified type |
-C, --clear | Clear all customizations and restore defaults |
-S, --seuser | Specify the SELinux user for login mappings |
-t, --type | Specify the SELinux type context |
-r, --range | Specify the MLS/RBAC security range |
-p, --proto | Specify protocol type (tcp or udp) for port rules |
-s, --source | Source type for interface bindings |
Examples
List all file context rules currently in the policy
semanage fcontext -lAdd a file context rule so /var/www/myapp and its contents are labeled httpd_sys_rw_content_t
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/myapp(/.*)?' Allow SSH connections on custom port 2222
semanage port -a -t ssh_port_t -p tcp 2222List all Linux user to SELinux user mappings
semanage login -lList all SELinux users and their role assignments
semanage user -lList all SELinux booleans with their current states
semanage boolean -lRemove HTTP port 8080 from policy
semanage port -d -t http_port_t -p tcp 8080Modify existing file context rule for /home/admin
semanage fcontext -m -t admin_home_t '/home/admin(/.*)?'