[PATCH] semanage man pages: Add examples for -r RANGE flag usage

[PATCH] semanage man pages: Add examples for -r RANGE flag usage

[Pranav Lawate]

Hello,
 This patch adds missing examples to the semanage-port and
semanage-fcontext man pages showing the correct usage of the -r RANGE
flag for MLS/MCS systems. Currently, users who try to use the -r flag
without proper examples often encounter unclear error messages when
they provide invalid range formats.

For example, Here is a command with wrong range string value:
~~~
# semanage fcontext -a -t admin_home_t -r s0.c0 /root/test
libsepol.mls_from_string: invalid MLS context s0.c0 (No such file or directory).
libsepol.mls_from_string: could not construct mls context structure
(No such file or directory).
libsepol.context_from_record: could not create context structure
(Invalid argument).
libsemanage.validate_handler: invalid context
system_u:object_r:admin_home_t:s0.c0 specified for /root/test [all
files] (Invalid argument).
libsemanage.dbase_llist_iterate: could not iterate over records
(Invalid argument).
OSError: Invalid argument
~~~
Similarly for port
~~~
# semanage port -a -t http_port_t -p tcp -r s0.c0 8888
libsepol.mls_from_string: invalid MLS context s0.c0 (No such file or directory).
libsepol.mls_from_string: could not construct mls context structure
(No such file or directory).
libsepol.context_from_record: could not create context structure
(Invalid argument).
libsepol.port_from_record: could not create port structure for range
8888:8888 (tcp) (Invalid argument).
libsepol.sepol_port_modify: could not load port range 8888 - 8888
(tcp) (Invalid argument).
libsemanage.dbase_policydb_modify: could not modify record value
(Invalid argument).
libsemanage.semanage_base_merge_components: could not merge local
modifications into policy (Invalid argument).
OSError: Invalid argument
~~~

My main motive is to come up with a logic to handle this error better
but before undertaking that big of a change I wanted to push a small
improvement to the code and so I have added correct example strings of
MLS range into man pages for semanage-fcontext and semanage-port which
I have tested to work properly on my RHEL 9.5 VM.

This is my first contribution to the SELinux project.

  The added examples demonstrate:
  - Correct MLS range format: s0:c0.c255
  - Complete command syntax with the -r flag for both port and
fcontext operations
  - Clear indication that this is for MLS/MCS systems only
  - Practical use cases (HTTPS port and secure directory)

  This should help users avoid common mistakes with range formatting
and reduce support requests related to unclear error messages.

  Signed-off-by: Pranav Lawate <pran.lawate@gmail.com>
  ---
   python/semanage/semanage-fcontext.8 | 4 ++++
   python/semanage/semanage-port.8     | 2 ++
   2 files changed, 6 insertions(+)

  diff --git a/python/semanage/semanage-fcontext.8
b/python/semanage/semanage-fcontext.8
  index 3a96c62f..3e7a1d8b 100644
  --- a/python/semanage/semanage-fcontext.8
  +++ b/python/semanage/semanage-fcontext.8
  @@ -100,6 +100,10 @@ execute the following commands.
   # semanage fcontext \-a \-e /home /disk6/home
   # restorecon \-R \-v /disk6

  +Add file-context with MLS range s0:c0.c255 for /secure directory
(MLS/MCS systems only)
  +# semanage fcontext \-a \-t admin_home_t \-r s0:c0.c255 "/secure(/.*)?"
  +# restorecon \-R \-v /secure
  +
   .SH "SEE ALSO"
   .BR selinux (8),
   .BR semanage (8),
  diff --git a/python/semanage/semanage-port.8 b/python/semanage/semanage-port.8
  index c6048660..217fa398 100644
  --- a/python/semanage/semanage-port.8
  +++ b/python/semanage/semanage-port.8
  @@ -61,6 +61,8 @@ Allow Apache to listen on tcp port 81 (i.e. assign
tcp port 81 label http_port_t
   # semanage port \-a \-t http_port_t \-p tcp 81
   Allow sshd to listen on tcp port 8991 (i.e. assign tcp port 8991
label ssh_port_t, which sshd is
  allowed to listen on)
   # semanage port \-a \-t ssh_port_t \-p tcp 8991
  +Allow Apache to listen on tcp port 443 with MLS range s0:c0.c255
(MLS/MCS systems only)
  +# semanage port \-a \-t http_port_t \-p tcp \-r s0:c0.c255 443

   .SH "SEE ALSO"
   .BR selinux (8),
  --

Looking forward to your positive response.

Regards,
Pranav Lawate
Software Maintenance Engineer, RHCE
Red Hat India Pvt. Ltd.
plawate@redhat.com IRC: Pranav
@RedHat   Red Hat  Red Hat

Re: [PATCH] semanage man pages: Add examples for -r RANGE flag usage

[Pranav Lawate]

Hello,

This is a gentle reminder mail to check if there was any progress.
It's been around 17 days now, just wanted to check if someone has time
to consider this patch.

Regards,
Pranav Lawate
Software Maintenance Engineer, RHCE
Red Hat India Pvt. Ltd.
plawate@redhat.com IRC: Pranav
@RedHat   Red Hat  Red Hat

Pranav Lawate

Software Maintenance Engineer, RHCE


Red Hat India Pvt. Ltd.

plawate@redhat.com IRC: Pranav

@RedHat   Red Hat  Red Hat



On Fri, Sep 12, 2025 at 12:18 AM Pranav Lawate <plawate@redhat.com> wrote:
>
> Hello,
>  This patch adds missing examples to the semanage-port and
> semanage-fcontext man pages showing the correct usage of the -r RANGE
> flag for MLS/MCS systems. Currently, users who try to use the -r flag
> without proper examples often encounter unclear error messages when
> they provide invalid range formats.
>
> For example, Here is a command with wrong range string value:
> ~~~
> # semanage fcontext -a -t admin_home_t -r s0.c0 /root/test
> libsepol.mls_from_string: invalid MLS context s0.c0 (No such file or directory).
> libsepol.mls_from_string: could not construct mls context structure
> (No such file or directory).
> libsepol.context_from_record: could not create context structure
> (Invalid argument).
> libsemanage.validate_handler: invalid context
> system_u:object_r:admin_home_t:s0.c0 specified for /root/test [all
> files] (Invalid argument).
> libsemanage.dbase_llist_iterate: could not iterate over records
> (Invalid argument).
> OSError: Invalid argument
> ~~~
> Similarly for port
> ~~~
> # semanage port -a -t http_port_t -p tcp -r s0.c0 8888
> libsepol.mls_from_string: invalid MLS context s0.c0 (No such file or directory).
> libsepol.mls_from_string: could not construct mls context structure
> (No such file or directory).
> libsepol.context_from_record: could not create context structure
> (Invalid argument).
> libsepol.port_from_record: could not create port structure for range
> 8888:8888 (tcp) (Invalid argument).
> libsepol.sepol_port_modify: could not load port range 8888 - 8888
> (tcp) (Invalid argument).
> libsemanage.dbase_policydb_modify: could not modify record value
> (Invalid argument).
> libsemanage.semanage_base_merge_components: could not merge local
> modifications into policy (Invalid argument).
> OSError: Invalid argument
> ~~~
>
> My main motive is to come up with a logic to handle this error better
> but before undertaking that big of a change I wanted to push a small
> improvement to the code and so I have added correct example strings of
> MLS range into man pages for semanage-fcontext and semanage-port which
> I have tested to work properly on my RHEL 9.5 VM.
>
> This is my first contribution to the SELinux project.
>
>   The added examples demonstrate:
>   - Correct MLS range format: s0:c0.c255
>   - Complete command syntax with the -r flag for both port and
> fcontext operations
>   - Clear indication that this is for MLS/MCS systems only
>   - Practical use cases (HTTPS port and secure directory)
>
>   This should help users avoid common mistakes with range formatting
> and reduce support requests related to unclear error messages.
>
>   Signed-off-by: Pranav Lawate <pran.lawate@gmail.com>
>   ---
>    python/semanage/semanage-fcontext.8 | 4 ++++
>    python/semanage/semanage-port.8     | 2 ++
>    2 files changed, 6 insertions(+)
>
>   diff --git a/python/semanage/semanage-fcontext.8
> b/python/semanage/semanage-fcontext.8
>   index 3a96c62f..3e7a1d8b 100644
>   --- a/python/semanage/semanage-fcontext.8
>   +++ b/python/semanage/semanage-fcontext.8
>   @@ -100,6 +100,10 @@ execute the following commands.
>    # semanage fcontext \-a \-e /home /disk6/home
>    # restorecon \-R \-v /disk6
>
>   +Add file-context with MLS range s0:c0.c255 for /secure directory
> (MLS/MCS systems only)
>   +# semanage fcontext \-a \-t admin_home_t \-r s0:c0.c255 "/secure(/.*)?"
>   +# restorecon \-R \-v /secure
>   +
>    .SH "SEE ALSO"
>    .BR selinux (8),
>    .BR semanage (8),
>   diff --git a/python/semanage/semanage-port.8 b/python/semanage/semanage-port.8
>   index c6048660..217fa398 100644
>   --- a/python/semanage/semanage-port.8
>   +++ b/python/semanage/semanage-port.8
>   @@ -61,6 +61,8 @@ Allow Apache to listen on tcp port 81 (i.e. assign
> tcp port 81 label http_port_t
>    # semanage port \-a \-t http_port_t \-p tcp 81
>    Allow sshd to listen on tcp port 8991 (i.e. assign tcp port 8991
> label ssh_port_t, which sshd is
>   allowed to listen on)
>    # semanage port \-a \-t ssh_port_t \-p tcp 8991
>   +Allow Apache to listen on tcp port 443 with MLS range s0:c0.c255
> (MLS/MCS systems only)
>   +# semanage port \-a \-t http_port_t \-p tcp \-r s0:c0.c255 443
>
>    .SH "SEE ALSO"
>    .BR selinux (8),
>   --
>
> Looking forward to your positive response.
>
> Regards,
> Pranav Lawate
> Software Maintenance Engineer, RHCE
> Red Hat India Pvt. Ltd.
> plawate@redhat.com IRC: Pranav
> @RedHat   Red Hat  Red Hat