26.2.1 About SELinux Administration

The following table describes the utilities that you can use to administer SELinux, and the packages that contain each utility.

Utility

Package

Description

audit2allow

policycoreutils-python

Generates SELinux policy allow_audit rules from logs of denied operations.

audit2why

policycoreutils-python

Generates SELinux policy don’t_audit rules from logs of denied operations.

avcstat

libselinux-utils

Displays statistics for the SELinux Access Vector Cache (AVC).

chcat

policycoreutils-python

Changes or removes the security category for a file or user.

findcon

setools-console

Searches for file context.

fixfiles

policycoreutils

Fixes the security context for file systems.

getenforce

libselinux-utils

Reports the current SELinux mode.

getsebool

libselinux-utils

Reports SELinux boolean values.

indexcon

setools-console

Indexes file context.

load_policy

policycoreutils

Loads a new SELinux policy into the kernel.

matchpathcon

libselinux-utils

Queries the system policy and displays the default security context that is associated with the file path.

replcon

setools-console

Replaces file context.

restorecon

policycoreutils

Resets the security context on one or more files.

restorecond

policycoreutils

Daemon that watches for file creation and sets the default file context.

sandbox

policycoreutils-python

Runs a command in an SELinux sandbox.

sealert

setroubleshoot-server, setroubleshoot

Acts as the user interface to the setroubleshoot system, which diagnoses and explains SELinux AVC denials and provides recommendations on how to prevent such denials.

seaudit-report

setools-console

Reports from the SELinux audit log.

sechecker

setools-console

Checks SELinux policies.

secon

policycoreutils

Displays the SELinux context from a file, program, or user input.

sediff

setools-console

Compares SELinux polices.

seinfo

setools-console

Queries SELinux policies.

selinuxconlist

libselinux-utils

Displays all SELinux contexts that are reachable by a user.

selinuxdefcon

libselinux-utils

Displays the default SELinux context for a user.

selinuxenabled

libselinux-utils

Indicates whether SELinux is enabled.

semanage

policycoreutils-python

Manages SELinux policies.

semodule

policycoreutils

Manages SELinux policy modules.

semodule_deps

policycoreutils

Displays the dependencies between SELinux policy packages.

semodule_expand

policycoreutils

Expands a SELinux policy module package.

semodule_link

policycoreutils

Links SELinux policy module packages together.

semodule_package

policycoreutils

Creates a SELinux policy module package.

sesearch

setools-console

Queries SELinux policies.

sestatus

policycoreutils

Displays the SELinux mode and the SELinux policy that are in use.

setenforce

libselinux-utils

Modifies the SELinux mode.

setsebool

policycoreutils

Sets SELinux boolean values.

setfiles

policycoreutils

Sets the security context for one or more files.

system-config-selinux

policycoreutils-gui

Provides a GUI that you can use to manage SELinux.

togglesebool

libselinux-utils

Flips the current value of an SELinux boolean.