sepolicy generate [-h ] [-p PATH]
sepolicy generate --application [-n NAME] [-u USER ]command [-w WRITE_PATH ]
sepolicy generate --cgi [-n NAME] command [-w WRITE_PATH ]
sepolicy generate --dbus [-n NAME] command [-w WRITE_PATH ]
sepolicy generate --inetd [-n NAME] command [-w WRITE_PATH ]
sepolicy generate --init [-n NAME] command [-w WRITE_PATH ]
sepolicy generate --admin_user [-r TRANSITION_ROLE] -n NAME
sepolicy generate --confined_admin -n NAME [-a ADMIN_DOMAIN] [-u USER] [-n NAME] [-w WRITE_PATH]
sepolicy generate --desktop_user -n NAME [-w WRITE_PATH]
sepolicy generate --term_user -n NAME [-w WRITE_PATH]
sepolicy generate --x_user -n NAME [-w WRITE_PATH]
sepolicy generate --customize -d DOMAIN -n NAME [-a ADMIN_DOMAIN]
sepolicy generate --newtype -t type -n NAME
sepolicy generate --sandbox -n NAME
sepolicy generate will create 5 files.
When specifying a confined application you must specify a path. sepolicy generate will use the rpm payload of the application along with nm -D APPLICATION to help it generate types and policy rules for your policy files.
Type Enforcing File NAME.te
This file can be used to define all the types rules for a particular domain.
Note: Policy generated by sepolicy generate will automatically add a permissive DOMAIN to your te file. When you are satisfied that your policy works, you need to remove the permissive line from the te file to run your domain in enforcing mode.
Interface File NAME.if
This file defines the interfaces for the types generated in the te file, which can be used by other policy domains.
File Context NAME.fc
This file defines the default file context for the system, it takes the file types created in the te file and associates file paths to the types. Tools like restorecon and RPM will use these paths to put down labels.
RPM Spec File NAME_selinux.spec
This file is an RPM SPEC file that can be used to install the SELinux policy on to machines and setup the labeling. The spec file also installs the interface file and a man page describing the policy. You can use sepolicy manpage -d NAME to generate the man page.
Shell File NAME.sh
This is a helper shell script to compile, install and fix the labeling on your test system. It will also generate a man page based on the installed policy, and compile and build an RPM suitable to be installed on other machines
If a generate is possible, this tool will print out all generate paths from the source domain to the target domain