<root
semanage.conf(5)                   Linux System Administration                   semanage.conf(5)

NAME
       semanage.conf - global configuration file for the SELinux Management library

DESCRIPTION
       The  semanage.conf file is usually located under the directory /etc/selinux and it is used
       for run-time configuration of the behavior of the SELinux Management library.

       Each line should contain a configuration parameter followed by the equal  sign  ("=")  and
       then followed by the configuration value for that parameter. Anything after the "#" symbol
       is ignored similarly to empty lines.

       The following parameters are allowed:

              module-store
                     Specify how the SELinux Management library should interact with the  SELinux
                     policy store. When set to "direct", the SELinux Management library writes to
                     the SELinux policy module store directly  (this  is  the  default  setting).
                     Otherwise  a  socket path or a server name can be used for the argument.  If
                     the argument begins with "/" (as in "/foo/bar"), it represents the path to a
                     named  socket  that  should be used to connect the policy management server.
                     If the argument does not begin with a "/" (as in "foo.com:4242"), it  should
                     be  interpreted  as the name of a remote policy management server to be used
                     through a TCP connection (default port is 4242 unless  a  different  one  is
                     specified after the server name using the colon to separate the two fields).

              policy-version
                     When  generating the policy, by default semanage will set the policy version
                     to POLICYDB_VERSION_MAX, as defined in  .  Change
                     this setting if a different version needs to be set for the policy.

              expand-check
                     Whether  or not to check "neverallow" rules when executing all semanage com‐
                     mand. It can be set to either "0" (disabled) or "1" (enabled) and by default
                     it  is  enabled.  There  might  be a large penalty in execution time if this
                     option is enabled.

              file-mode
                     By default the permission mode for the run-time policy files is set to 0644.

              save-previous
                     It controls whether the previous module directory is saved after a  success‐
                     ful  commit  to  the  policy  store  and  it  can be set to either "true" or
                     "false". By default it is set to "false" (the previous version is deleted).

              save-linked
                     It controls whether  the  previously  linked  module  is  saved  (with  name
                     "base.linked") after a successful commit to the policy store.  It can be set
                     to either "true" or "false" and by default it is set to "false" (the  previ‐
                     ous module is deleted).

              ignoredirs
                     List,  separated  by  ";",   of  directories to ignore when setting up users
                     homedirs.  Some distributions use this to stop labeling /root as a homedir.

              usepasswd
                     Whether or not to enable the use getpwent() to obtain a list of home  direc‐
                     tories  to  label. It can be set to either "true" or "false".  By default it
                     is set to "true".

              disable-genhomedircon
                     It controls whether or not the genhomedircon function is executed when using
                     the  semanage  command  and  it  can  be set to either "false" or "true". By
                     default the genhomedircon  functionality  is  enabled  (equivalent  to  this
                     option set to "false").

              handle-unknown
                     This option controls the kernel behavior for handling permissions defined in
                     the kernel but missing from the actual policy.  It can  be  set  to  "deny",
                     "reject" or "allow".

              bzip-blocksize
                     It should be in the range 0-9. A value of 0 means no compression. By default
                     the bzip block size is set to 9 (actual block size value is  obtained  after
                     multiplication by 100000).

              bzip-small
                     When set to "true", the bzip algorithm shall try to reduce its system memory
                     usage. It can be set to either "true" or "false" and by default it is set to
                     "false".

SEE ALSO
       semanage(8)

AUTHOR
       This manual page was written by Guido Trentalancia .

       The SELinux management library was written by Tresys Technology LLC and Red Hat Inc.

semanage.conf                             September 2011                         semanage.conf(5)

Go-to-top  




Designed by SanjuD(@ngineerbabu)