semanage

Install

# RHEL / Alma / Rocky
sudo dnf install policycoreutils-python-utils

# Debian / Ubuntu
sudo apt install policycoreutils-python-utils

# openSUSE
sudo zypper install policycoreutils-python-utils

# Arch
sudo pacman -S policycoreutils

What it does

semanage modifies SELinux policy configuration persistently. It allows administrators to manage port labels, file contexts, booleans, user mappings, and other SELinux settings without directly editing policy files.

How it works (mechanical)

• Writes changes to the local SELinux policy store.
• Adjusts persistent policy configuration rather than runtime-only state.
• Works with SELinux modules and context databases.
• Changes usually require relabeling or policy reload to take effect.

Quick Start

# List managed SELinux ports
sudo semanage port -l

10 Practical Examples

# 1) List all managed ports
sudo semanage port -l

# 2) Add a new HTTP port
sudo semanage port -a -t http_port_t -p tcp 8080

# 3) Modify existing port definition
sudo semanage port -m -t http_port_t -p tcp 8081

# 4) Delete a custom port rule
sudo semanage port -d -p tcp 8080

# 5) List file context rules
sudo semanage fcontext -l

# 6) Add persistent file context mapping
sudo semanage fcontext -a -t httpd_sys_content_t "/srv/www(/.*)?"

# 7) Apply context changes
sudo restorecon -Rv /srv/www

# 8) List SELinux booleans
sudo semanage boolean -l

# 9) View SELinux login mappings
sudo semanage login -l

# 10) List SELinux users
sudo semanage user -l

Notes & Gotchas

• Requires SELinux to be enabled and enforcing or permissive.
• Most operations require sudo.
• Port additions must not conflict with existing policy definitions.
• After changing file contexts, use restorecon to apply labels.
• Do not edit SELinux policy files manually unless building custom modules.

Related Commands

• getenforce — check SELinux mode.
• setenforce — change enforcing state (temporary).
• restorecon — apply correct file contexts.
• chcon — change file context (temporary).
• audit2allow — generate policy rules from audit logs.