# sepolicy-generate

## NAME



           sepolicy-generate - Generate an initial SELinux policy module
           template.
    


## SYNOPSIS



           Common options
    
           **sepolicy generate [-h ] [-p PATH]**
    
           Confined Applications
    
           **sepolicy generate --application [-n NAME] [-u USER ]command [-w**
           **WRITE_PATH ]**
           **sepolicy generate --cgi [-n NAME] command [-w WRITE_PATH ]**
           **sepolicy generate --dbus [-n NAME] command [-w WRITE_PATH ]**
           **sepolicy generate --inetd [-n NAME] command [-w WRITE_PATH ]**
           **sepolicy generate --init [-n NAME] command [-w WRITE_PATH ]**
    
           Confined Users
    
           **sepolicy generate --admin_user [-r TRANSITION_ROLE] -n NAME**
           **sepolicy generate --confined_admin -n NAME [-a ADMIN_DOMAIN] [-u**
           **USER] [-n NAME] [-w WRITE_PATH]**
           **sepolicy generate --desktop_user -n NAME [-w WRITE_PATH]**
           **sepolicy generate --term_user -n NAME [-w WRITE_PATH]**
           **sepolicy generate --x_user -n NAME [-w WRITE_PATH]**
    
           Miscellaneous Policy
    
           **sepolicy generate --customize -d DOMAIN -n NAME [-a ADMIN_DOMAIN]**
           **sepolicy generate --newtype -t type -n NAME**
           **sepolicy generate --sandbox -n NAME**
    


## DESCRIPTION



           Use **sepolicy generate** to generate an SELinux policy Module.
    
           **sepolicy generate** will create 5 files.
    
           When specifying a **confined application** you must specify a path.
           **sepolicy generate** will use the rpm payload of the application
           along with **nm -D APPLICATION** to help it generate types and policy
           rules for your policy files.
    
           **NAME.te**
           This file can be used to define all the types enforcement rules
           for a particular domain.
    
           _Note:_ Policy generated by **sepolicy generate** will automatically add
           a _permissive DOMAIN_ to your **.te** file. When you are satisfied that
           your policy works, you need to remove the permissive line from the
           **.te** file to run your domain in enforcing mode.
    
           **NAME.if**
           This file defines the interfaces for the types generated in the
           **.te** file, which can be used by other policy domains.
    
           **NAME.fc**
           This file defines the default file context for the system, it
           takes the file types created in the **.te** file and associates file
           paths to the types.  Tools like restorecon and RPM will use these
           paths to put down labels.
    
           **NAME_selinux.spec**
           This file is an RPM SPEC file that can be used to install the
           SELinux policy on to machines and setup the labeling. The spec
           file also installs the interface file and a man page describing
           the policy. You can use **sepolicy manpage -d NAME** to generate the
           man page.
    
           **NAME.sh**
           This is a helper shell script to compile, install and fix the
           labeling on your test system. It will also generate a man page
           based on the installed policy, and compile and build an RPM
           suitable to be installed on other machines.
    


## OPTIONS



           _-h, --help_
                  Display help message
    
           _-d, --domain_
                  Enter domain type(s) which you will be extending
    
           _-n, --name_
                  Specify alternate name of policy. The policy will default
                  to the executable or name specified
    
           _-p, --path_
                  Specify the directory to store the created policy files.
                  (Default to current working directory )
    
           optional arguments:
    
           _-r, --role_
                  Enter role(s) to which this admin user will transition
    
           _-t, --type_
                  Enter type(s) for which you will generate new definition
                  and rule(s)
    
           _-u, --user_
                  SELinux user(s) which will transition to this domain
    
           _-w, --writepath_
                  Path(s) which the confined processes need to write to
    
           _-a, --admin_
                  Domain(s) which the confined admin will administrate
    
           _--admin_user_
                  Generate Policy for Administrator Login User Role
    
           _--application_
                  Generate Policy for User Application
    
           _--cgi_  Generate Policy for Web Application/Script (CGI)
    
           _--confined_admin_
                  Generate Policy for Confined Root Administrator Role
    
           _--customize_
                  Generate Policy for Existing Domain Type
    
           _--dbus_ Generate Policy for DBUS System Daemon
    
           _--desktop_user_
                  Generate Policy for Desktop Login User Role
    
           _--inetd_
                  Generate Policy for Internet Services Daemon
    
           _--init_ Generate Policy for Standard Init Daemon (Default)
    
           _--newtype_
                  Generate new policy for new types to add to an existing
                  policy
    
           _--sandbox_
                  Generate Policy for Sandbox
    
           _--term_user_
                  Generate Policy for Minimal Terminal Login User Role
    
           _--x_user_
                  Generate Policy for Minimal X Windows Login User Role
    


## EXAMPLE



           **> sepolicy generate --init /usr/sbin/rwhod**
           Generating Policy for /usr/sbin/rwhod named rwhod
           Created the following files:
           rwhod.te # Type Enforcement file
           rwhod.if # Interface file
           rwhod.fc # File Contexts file
           rwhod_selinux.spec # Spec file
           rwhod.sh # Setup Script
    


* * *