---
name: "policygentool"
section: "1"
platform: "linux"
package: "selinux-policy-dev"
version: "2:2.20250213-13~deb13u1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/policygentool"
---

# policygentool(1)

Interactive SELinux policy generation tool

## NAME

policygentool - Interactive SELinux policy generation tool

## SYNOPSIS

**policygentool** *\[options\]* *\<Module Name\>* *\<full path for application binary file\>*

## DESCRIPTION

This tool generate three files for policy development, A Type Enforcement (te) file, a File Context (fc), and a Interface File(if).  Most of the policy rules will be written in the te file.  Use the File Context file to associate file paths with security context.  Use the interface rules to allow other protected domains to interact with the newly defined domains.

The tool prompts for locations of *pidfiles,* any  *logfiles,* files in  */var/lib,* and any *init scripts,* and whether any network access is desirable for the application. The tool then generates the appropriate policy rules for the module. After these files have been generated, the make files for the appropriate SELinux policy, namely, */usr/share/selinux/refpolicy-targeted/include/Makefile* or */usr/share/selinux/refpolicy-strict/include/Makefile* can be used to compile the SELinux policy policy package.  The resulting policy package can be loaded using **semodule.**

  \# /usr/bin/policygentool myapp /usr/bin/myapp\
   \# cat \>Makefile\
   \> HEADERDIR:=/usr/share/selinux/refpolicy-targeted/include\
   \> include $(HEADERDIR)/Makefile\
   \> ^D\
   \# make\
   \# semodule -l myapp.pp\
   \# restorecon -R -v /usr/bin/myapp "all files defined in myapp.fc"\
   \# setenforce 0\
   \# /etc/init.d/myapp start\
   \# audit2allow -R -i /var/log/audit/audit.log

## OPTIONS

- **-h, --help**

  Print a short usage message.

## FILES

*myapp.te,* *myapp.if,* *myapp.fc.*

## SEE ALSO

[semodule(8)](/semodule/8.md), check\_policy(8), [load\_policy(8)](/load_policy/8.md).

## BUGS

None known.

## AUTHOR

This manual page was written by Manoj Srivastava \<srivasta@debian.org\>, for the Debian GNU/Linux system.