[PATCH] improve semanage man pages: Add examples for -r RANGE flag usage

[PATCH] improve semanage man pages: Add examples for -r RANGE flag usage

[Pranav Lawate]

From: Pranav Lawate <pran.lawate@gmail.com>

Hello,
 I tried to send an email on Sept 12 and waited for 20 days. Today I got
to know it didn't really reach properly. So now retrying with 'git
send-email' instead of using gmail with plain text.

 This patch adds missing examples to the semanage-port and
semanage-fcontext man pages showing the correct usage of the -r RANGE
flag for MLS/MCS systems. Currently, users who try to use the -r flag
without proper examples often encounter unclear error messages when
they provide invalid range formats.

For example, Here is a command with wrong range string value:
~~~
# semanage fcontext -a -t admin_home_t -r s0.c0 /root/test
libsepol.mls_from_string: invalid MLS context s0.c0 (No such file or directory).
libsepol.mls_from_string: could not construct mls context structure
(No such file or directory).
libsepol.context_from_record: could not create context structure
(Invalid argument).
libsemanage.validate_handler: invalid context
system_u:object_r:admin_home_t:s0.c0 specified for /root/test [all
files] (Invalid argument).
libsemanage.dbase_llist_iterate: could not iterate over records
(Invalid argument).
OSError: Invalid argument
~~~
Similarly for port
~~~
# semanage port -a -t http_port_t -p tcp -r s0.c0 8888
libsepol.mls_from_string: invalid MLS context s0.c0 (No such file or directory).
libsepol.mls_from_string: could not construct mls context structure
(No such file or directory).
libsepol.context_from_record: could not create context structure
(Invalid argument).
libsepol.port_from_record: could not create port structure for range
8888:8888 (tcp) (Invalid argument).
libsepol.sepol_port_modify: could not load port range 8888 - 8888
(tcp) (Invalid argument).
libsemanage.dbase_policydb_modify: could not modify record value
(Invalid argument).
libsemanage.semanage_base_merge_components: could not merge local
modifications into policy (Invalid argument).
OSError: Invalid argument
~~~

My main motive is to come up with a logic to handle this error better
but before undertaking that big of a change I wanted to push a small
improvement to the code and so I have added correct example strings of
MLS range into man pages for semanage-fcontext and semanage-port which
I have tested to work properly on my RHEL 9.5 VM.

This is my first contribution to the SELinux project.

  The added examples demonstrate:
  - Correct MLS range format: s0:c0.c255
  - Complete command syntax with the -r flag for both port and
fcontext operations
  - Clear indication that this is for MLS/MCS systems only
  - Practical use cases (HTTPS port and secure directory)

  This should help users avoid common mistakes with range formatting
and reduce support requests related to unclear error messages.
* Here is my Patch: 

Signed-off-by: Pranav Lawate <pran.lawate@gmail.com>
---
 python/semanage/semanage-fcontext.8 | 4 ++++
 python/semanage/semanage-port.8     | 2 ++
 2 files changed, 6 insertions(+)

diff --git a/python/semanage/semanage-fcontext.8 b/python/semanage/semanage-fcontext.8
index 3a96c62f..3e7a1d8b 100644
--- a/python/semanage/semanage-fcontext.8
+++ b/python/semanage/semanage-fcontext.8
@@ -100,6 +100,10 @@ execute the following commands.
 # semanage fcontext \-a \-e /home /disk6/home
 # restorecon \-R \-v /disk6
 
+Add file-context with MLS range s0:c0.c255 for /secure directory (MLS/MCS systems only)
+# semanage fcontext \-a \-t admin_home_t \-r s0:c0.c255 "/secure(/.*)?"
+# restorecon \-R \-v /secure
+
 .SH "SEE ALSO"
 .BR selinux (8),
 .BR semanage (8),
diff --git a/python/semanage/semanage-port.8 b/python/semanage/semanage-port.8
index c6048660..217fa398 100644
--- a/python/semanage/semanage-port.8
+++ b/python/semanage/semanage-port.8
@@ -61,6 +61,8 @@ Allow Apache to listen on tcp port 81 (i.e. assign tcp port 81 label http_port_t
 # semanage port \-a \-t http_port_t \-p tcp 81
 Allow sshd to listen on tcp port 8991 (i.e. assign tcp port 8991 label ssh_port_t, which sshd is allowed to listen on)
 # semanage port \-a \-t ssh_port_t \-p tcp 8991
+Allow Apache to listen on tcp port 443 with MLS range s0:c0.c255 (MLS/MCS systems only)
+# semanage port \-a \-t http_port_t \-p tcp \-r s0:c0.c255 443
 
 .SH "SEE ALSO"
 .BR selinux (8),
-- 
2.51.0

Re: [PATCH] improve semanage man pages: Add examples for -r RANGE flag usage

[Stephen Smalley]

On Wed, Oct 1, 2025 at 1:30 PM Pranav Lawate <plawate@redhat.com> wrote:
>
> From: Pranav Lawate <pran.lawate@gmail.com>
>
> Hello,
>  I tried to send an email on Sept 12 and waited for 20 days. Today I got
> to know it didn't really reach properly. So now retrying with 'git
> send-email' instead of using gmail with plain text.

Remove the above from your message so that it doesn't get included in
the actual commit message.

>
>  This patch adds missing examples to the semanage-port and
> semanage-fcontext man pages showing the correct usage of the -r RANGE
> flag for MLS/MCS systems. Currently, users who try to use the -r flag
> without proper examples often encounter unclear error messages when
> they provide invalid range formats.
>
> For example, Here is a command with wrong range string value:
> ~~~
> # semanage fcontext -a -t admin_home_t -r s0.c0 /root/test
> libsepol.mls_from_string: invalid MLS context s0.c0 (No such file or directory).
> libsepol.mls_from_string: could not construct mls context structure
> (No such file or directory).
> libsepol.context_from_record: could not create context structure
> (Invalid argument).
> libsemanage.validate_handler: invalid context
> system_u:object_r:admin_home_t:s0.c0 specified for /root/test [all
> files] (Invalid argument).
> libsemanage.dbase_llist_iterate: could not iterate over records
> (Invalid argument).
> OSError: Invalid argument
> ~~~
> Similarly for port
> ~~~
> # semanage port -a -t http_port_t -p tcp -r s0.c0 8888
> libsepol.mls_from_string: invalid MLS context s0.c0 (No such file or directory).
> libsepol.mls_from_string: could not construct mls context structure
> (No such file or directory).
> libsepol.context_from_record: could not create context structure
> (Invalid argument).
> libsepol.port_from_record: could not create port structure for range
> 8888:8888 (tcp) (Invalid argument).
> libsepol.sepol_port_modify: could not load port range 8888 - 8888
> (tcp) (Invalid argument).
> libsemanage.dbase_policydb_modify: could not modify record value
> (Invalid argument).
> libsemanage.semanage_base_merge_components: could not merge local
> modifications into policy (Invalid argument).
> OSError: Invalid argument
> ~~~
>
> My main motive is to come up with a logic to handle this error better
> but before undertaking that big of a change I wanted to push a small
> improvement to the code and so I have added correct example strings of
> MLS range into man pages for semanage-fcontext and semanage-port which
> I have tested to work properly on my RHEL 9.5 VM.
>
> This is my first contribution to the SELinux project.
>
>   The added examples demonstrate:
>   - Correct MLS range format: s0:c0.c255
>   - Complete command syntax with the -r flag for both port and
> fcontext operations
>   - Clear indication that this is for MLS/MCS systems only
>   - Practical use cases (HTTPS port and secure directory)
>
>   This should help users avoid common mistakes with range formatting
> and reduce support requests related to unclear error messages.
> * Here is my Patch:

Remove the "Here is my Patch above".

>
> Signed-off-by: Pranav Lawate <pran.lawate@gmail.com>
> ---
>  python/semanage/semanage-fcontext.8 | 4 ++++
>  python/semanage/semanage-port.8     | 2 ++
>  2 files changed, 6 insertions(+)
>
> diff --git a/python/semanage/semanage-fcontext.8 b/python/semanage/semanage-fcontext.8
> index 3a96c62f..3e7a1d8b 100644
> --- a/python/semanage/semanage-fcontext.8
> +++ b/python/semanage/semanage-fcontext.8
> @@ -100,6 +100,10 @@ execute the following commands.
>  # semanage fcontext \-a \-e /home /disk6/home
>  # restorecon \-R \-v /disk6
>
> +Add file-context with MLS range s0:c0.c255 for /secure directory (MLS/MCS systems only)
> +# semanage fcontext \-a \-t admin_home_t \-r s0:c0.c255 "/secure(/.*)?"
> +# restorecon \-R \-v /secure

This didn't appear to relabel /secure when I tried it; seemed to
require adding the -F flag to force it.

> +
>  .SH "SEE ALSO"
>  .BR selinux (8),
>  .BR semanage (8),
> diff --git a/python/semanage/semanage-port.8 b/python/semanage/semanage-port.8
> index c6048660..217fa398 100644
> --- a/python/semanage/semanage-port.8
> +++ b/python/semanage/semanage-port.8
> @@ -61,6 +61,8 @@ Allow Apache to listen on tcp port 81 (i.e. assign tcp port 81 label http_port_t
>  # semanage port \-a \-t http_port_t \-p tcp 81
>  Allow sshd to listen on tcp port 8991 (i.e. assign tcp port 8991 label ssh_port_t, which sshd is allowed to listen on)
>  # semanage port \-a \-t ssh_port_t \-p tcp 8991
> +Allow Apache to listen on tcp port 443 with MLS range s0:c0.c255 (MLS/MCS systems only)
> +# semanage port \-a \-t http_port_t \-p tcp \-r s0:c0.c255 443

Not fond of this example since we wouldn't want anyone to do that in
reality, but also how did you confirm that it actually worked?
semanage port -l only appears to show the type information.

>
>  .SH "SEE ALSO"
>  .BR selinux (8),
> --
> 2.51.0
>
>