---
name: "newrole"
section: "1"
platform: "linux"
package: "newrole"
version: "3.8.1-2"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/newrole"
---

# newrole(1)

run a shell with a new SELinux role

## NAME

newrole - run a shell with a new SELinux role

## SYNOPSIS

**newrole** \[**-r**\|**--role**\] *ROLE* \[**-t**\|**--type**\] *TYPE* \[**-l**\|**--level**\] \[**-p**\|**--preserve-environment**\] *LEVEL* \[-- \[*ARGS*\]...\]

## DESCRIPTION

Run a new shell in a new context.  The new context is derived from the  old context in which **newrole** is originally executed.  If the **-r** or **--role** option is specified, then the new context will have the role specified by *ROLE*. If the  **-t** or **--type** option is specified, then the new context will have the type (domain) specified by *TYPE*. If a role is specified, but no type is specified, the default type is derived from the specified role.  If the **-l** or **--level** option is specified, then the new context will have the sensitivity level specified by *LEVEL*. If *LEVEL* is a range, the new context will have the sensitivity level and clearance specified by that range.  If the **-p** or **--preserve-environment** option is specified, the shell with the new SELinux context will preserve environment variables, otherwise a new minimal environment is created.

Additional arguments *ARGS* may be provided after a -- option, in which case they are supplied to the new shell. In particular, an argument of -- -c will cause the next argument to be treated as a command by most command interpreters.

If a command argument is specified to newrole and the command name is found in /etc/selinux/newrole\_pam.conf, then the pam service name listed in that file for the command will be used rather than the normal newrole pam configuration.  This allows for per-command pam configuration when invoked via newrole, e.g. to skip the interactive re-authentication phase.

The new shell will be the shell specified in the user's entry in the  */etc/passwd* file.

The **-V** or  **--version** shows the current version of newrole

## EXAMPLE

Changing role:\
    \# id -Z\
    staff\_u:staff\_r:staff\_t:SystemLow-SystemHigh\
    \# newrole -r sysadm\_r\
    \# id -Z\
    staff\_u:sysadm\_r:sysadm\_t:SystemLow-SystemHigh

Changing sensitivity only:\
    \# id -Z\
    staff\_u:sysadm\_r:sysadm\_t:Unclassified-SystemHigh\
    \# newrole -l Secret\
    \# id -Z\
    staff\_u:sysadm\_r:sysadm\_t:Secret-SystemHigh

Changing sensitivity and clearance:\
    \# id -Z\
    staff\_u:sysadm\_r:sysadm\_t:Unclassified-SystemHigh\
    \# newrole -l Secret-Secret\
    \# id -Z\
    staff\_u:sysadm\_r:sysadm\_t:Secret

Running a program in a given role or level:\
    \# newrole -r sysadm\_r -- -c "/path/to/app arg1 arg2..."\
    \# newrole -l Secret -- -c "/path/to/app arg1 arg2..."

## FILES

/etc/passwd - user account information\
 /etc/shadow - encrypted passwords and age information\
 /etc/selinux/\<policy\>/contexts/default\_type - default types for roles\
 /etc/selinux/\<policy\>/contexts/securetty\_types - securetty types for level changes\
 /etc/selinux/newrole\_pam.conf - optional mapping of commands to separate pam service names\

## SEE ALSO

[**runcon**(1)](/runcon/1.md)

## AUTHORS

```
Anthony Colatrella
Tim Fraser
Steve Grubb <sgrubb@redhat.com>
Darrel Goeddel <DGoeddel@trustedcs.com>
Michael Thompson <mcthomps@us.ibm.com>
Dan Walsh <dwalsh@redhat.com>
```