checkpolicy

Checkpolicy is a compiler used in SELinux to translate policy sources written in the SELinux policy language into a binary policy format that can be loaded by the system. It is a core tool in the SELinux policy development workflow, helping developers convert high-level policy definitions into a form understood by the kernel and runtime policy loaders.

The input to checkpolicy consists of policy source files, including Type Enforcement definitions (.te), file context mappings (.fc), and interface definitions (.if), often organized into modules. The compiler checks syntax and basic semantic consistency, and then emits a binary policy file. The resulting output is typically a binary policy file that the system can load to enforce the defined rules.

Checkpolicy is commonly used during policy development and packaging, such as when building or updating the targeted or reference policy sets provided with a distribution. It may be invoked directly by developers or as part of build scripts that assemble and install policy packages. The exact handling of the produced binary policy varies by distribution and policy framework, but generally the binary is loaded by the system’s policy loader or by policy management tools when the policy is activated or reloaded. If the policy sources contain errors, checkpolicy prints diagnostic messages and exits with a non-zero status, prompting the developer to fix the issues before reattempting compilation.

Overall, checkpolicy is a foundational tool for creating and updating SELinux policies, enabling administrators and developers to define access rules and have them enforced by the system. It is part of the SELinux policy tooling available on many Linux distributions.