[PATCH 0/1] improve semanage man pages: Add examples for -r RANGE flag

[PATCH 0/1] improve semanage man pages: Add examples for -r RANGE flag

[Pranav Lawate]

From: Pranav Lawate <pran.lawate@gmail.com>

This patch addresses feedback from Stephen Smalley on my previous
submission.

Changes made:
- Added -F flag to restorecon in fcontext example (required to force
  relabeling)
- Changed port example from 443 to custom port 9999 (more realistic
  use case)
- Added seinfo --portcon -x verification command to demonstrate that
  MLS range is actually applied (semanage port -l only shows type
  information, not the MLS range)

The seinfo verification output shows:
  portcon tcp 9999 system_u:object_r:http_port_t:s0:c0.c255

Pranav Lawate (1):
  improve semanage man pages: Add examples for -r RANGE flag usage

 python/semanage/semanage-fcontext.8 | 4 ++++
 python/semanage/semanage-port.8     | 3 +++
 2 files changed, 7 insertions(+)

-- 
2.51.0

[PATCH 1/1] improve semanage man pages: Add examples for -r RANGE flag usage

[Pranav Lawate]

From: Pranav Lawate <pran.lawate@gmail.com>

This patch adds missing examples to the semanage-port and
semanage-fcontext man pages showing the correct usage of the -r RANGE
flag for MLS/MCS systems. Currently, users who try to use the -r flag
without proper examples often encounter unclear error messages when
they provide invalid range formats.

For example, here is a command with wrong range string value:
libsepol.mls_from_string: invalid MLS context s0.c0 (No such file or directory)
[...error output...]

The added examples demonstrate:
  - Correct MLS range format: s0:c0.c255
  - Complete command syntax with the -r flag for both port and
    fcontext operations
  - Clear indication that this is for MLS/MCS systems only
  - Verification method using seinfo for port changes (semanage port -l
    only shows type, not MLS range)
  - Use -F flag to restorecon in fcontext example (required to force
    relabeling)

Signed-off-by: Pranav Lawate <pran.lawate@gmail.com>
---
 python/semanage/semanage-fcontext.8 | 4 ++++
 python/semanage/semanage-port.8     | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/python/semanage/semanage-fcontext.8 b/python/semanage/semanage-fcontext.8
index 3a96c62f..a29b7499 100644
--- a/python/semanage/semanage-fcontext.8
+++ b/python/semanage/semanage-fcontext.8
@@ -100,6 +100,10 @@ execute the following commands.
 # semanage fcontext \-a \-e /home /disk6/home
 # restorecon \-R \-v /disk6
 
+Add file-context with MLS range s0:c0.c255 for /secure directory (MLS/MCS systems only)
+# semanage fcontext \-a \-t admin_home_t \-r s0:c0.c255 "/secure(/.*)?"
+# restorecon \-R \-F \-v /secure
+
 .SH "SEE ALSO"
 .BR selinux (8),
 .BR semanage (8),
diff --git a/python/semanage/semanage-port.8 b/python/semanage/semanage-port.8
index c6048660..0df44290 100644
--- a/python/semanage/semanage-port.8
+++ b/python/semanage/semanage-port.8
@@ -61,6 +61,9 @@ Allow Apache to listen on tcp port 81 (i.e. assign tcp port 81 label http_port_t
 # semanage port \-a \-t http_port_t \-p tcp 81
 Allow sshd to listen on tcp port 8991 (i.e. assign tcp port 8991 label ssh_port_t, which sshd is allowed to listen on)
 # semanage port \-a \-t ssh_port_t \-p tcp 8991
+Add a custom port 9999 with MLS range s0:c0.c255 (MLS/MCS systems only). Verify with seinfo.
+# semanage port \-a \-t http_port_t \-p tcp \-r s0:c0.c255 9999
+# seinfo \-\-portcon \-x | grep 9999
 
 .SH "SEE ALSO"
 .BR selinux (8),
-- 
2.51.0

Re: [PATCH 1/1] improve semanage man pages: Add examples for -r RANGE flag usage

[Stephen Smalley]

On Tue, Oct 7, 2025 at 11:07 AM Pranav Lawate <plawate@redhat.com> wrote:
>
> From: Pranav Lawate <pran.lawate@gmail.com>
>
> This patch adds missing examples to the semanage-port and
> semanage-fcontext man pages showing the correct usage of the -r RANGE
> flag for MLS/MCS systems. Currently, users who try to use the -r flag
> without proper examples often encounter unclear error messages when
> they provide invalid range formats.
>
> For example, here is a command with wrong range string value:
> libsepol.mls_from_string: invalid MLS context s0.c0 (No such file or directory)
> [...error output...]
>
> The added examples demonstrate:
>   - Correct MLS range format: s0:c0.c255
>   - Complete command syntax with the -r flag for both port and
>     fcontext operations
>   - Clear indication that this is for MLS/MCS systems only
>   - Verification method using seinfo for port changes (semanage port -l
>     only shows type, not MLS range)
>   - Use -F flag to restorecon in fcontext example (required to force
>     relabeling)
>
> Signed-off-by: Pranav Lawate <pran.lawate@gmail.com>

Technically tcp port 9999 seems to already be defined in my policy for
jboss_management_port_t and has an entry in /etc/services for
"distinct" but I don't feel strongly enough to insist on changing it
again.

Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>


> ---
>  python/semanage/semanage-fcontext.8 | 4 ++++
>  python/semanage/semanage-port.8     | 3 +++
>  2 files changed, 7 insertions(+)
>
> diff --git a/python/semanage/semanage-fcontext.8 b/python/semanage/semanage-fcontext.8
> index 3a96c62f..a29b7499 100644
> --- a/python/semanage/semanage-fcontext.8
> +++ b/python/semanage/semanage-fcontext.8
> @@ -100,6 +100,10 @@ execute the following commands.
>  # semanage fcontext \-a \-e /home /disk6/home
>  # restorecon \-R \-v /disk6
>
> +Add file-context with MLS range s0:c0.c255 for /secure directory (MLS/MCS systems only)
> +# semanage fcontext \-a \-t admin_home_t \-r s0:c0.c255 "/secure(/.*)?"
> +# restorecon \-R \-F \-v /secure
> +
>  .SH "SEE ALSO"
>  .BR selinux (8),
>  .BR semanage (8),
> diff --git a/python/semanage/semanage-port.8 b/python/semanage/semanage-port.8
> index c6048660..0df44290 100644
> --- a/python/semanage/semanage-port.8
> +++ b/python/semanage/semanage-port.8
> @@ -61,6 +61,9 @@ Allow Apache to listen on tcp port 81 (i.e. assign tcp port 81 label http_port_t
>  # semanage port \-a \-t http_port_t \-p tcp 81
>  Allow sshd to listen on tcp port 8991 (i.e. assign tcp port 8991 label ssh_port_t, which sshd is allowed to listen on)
>  # semanage port \-a \-t ssh_port_t \-p tcp 8991
> +Add a custom port 9999 with MLS range s0:c0.c255 (MLS/MCS systems only). Verify with seinfo.
> +# semanage port \-a \-t http_port_t \-p tcp \-r s0:c0.c255 9999
> +# seinfo \-\-portcon \-x | grep 9999
>
>  .SH "SEE ALSO"
>  .BR selinux (8),
> --
> 2.51.0
>

Re: [PATCH 1/1] improve semanage man pages: Add examples for -r RANGE flag usage

[Stephen Smalley]

On Tue, Oct 7, 2025 at 11:14 AM Stephen Smalley
<stephen.smalley.work@gmail.com> wrote:
>
> On Tue, Oct 7, 2025 at 11:07 AM Pranav Lawate <plawate@redhat.com> wrote:
> >
> > From: Pranav Lawate <pran.lawate@gmail.com>
> >
> > This patch adds missing examples to the semanage-port and
> > semanage-fcontext man pages showing the correct usage of the -r RANGE
> > flag for MLS/MCS systems. Currently, users who try to use the -r flag
> > without proper examples often encounter unclear error messages when
> > they provide invalid range formats.
> >
> > For example, here is a command with wrong range string value:
> > libsepol.mls_from_string: invalid MLS context s0.c0 (No such file or directory)
> > [...error output...]
> >
> > The added examples demonstrate:
> >   - Correct MLS range format: s0:c0.c255
> >   - Complete command syntax with the -r flag for both port and
> >     fcontext operations
> >   - Clear indication that this is for MLS/MCS systems only
> >   - Verification method using seinfo for port changes (semanage port -l
> >     only shows type, not MLS range)
> >   - Use -F flag to restorecon in fcontext example (required to force
> >     relabeling)
> >
> > Signed-off-by: Pranav Lawate <pran.lawate@gmail.com>
>
> Technically tcp port 9999 seems to already be defined in my policy for
> jboss_management_port_t and has an entry in /etc/services for
> "distinct" but I don't feel strongly enough to insist on changing it
> again.
>
> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>

Thanks, merged.