checkmodule- Unix, Linux Command




checkmodule - SELinux policy module compiler


 checkmodule [-h] [-b] [-m] [-M] [-U handle_unknown ] [-V] [-o output_file] [input_file]


checkmodule is a program that checks and compiles a SELinux security policy module into a binary representation. It can generate either a base policy module (default) or a non-base policy module (-m option); typically, you would build a non-base policy module to add to an existing module store that already has a base module provided by the base policy. Use semodule_package to combine this module with its optional file contexts to create a policy package, and then use semodule to install the module package into the module store and load the resulting policy.


-b,--binary Read an existing binary policy module file rather than a source policy module file. This option is a development/debugging aid.
-h,--help Print usage.
-m Generate a non-base policy module.
-M,--mls Enable the MLS/MCS support when checking and compiling the policy module.
-V,--version Show policy versions created by this program
-o,--output filename  Write a binary policy module file to the specified filename. Otherwise, checkmodule will only check the syntax of the module source file and will not generate a binary module at all.
 -U,--handle-unknown <action>  Specify how the kernel should handle unknown classes or permissions (deny, allow or reject).



Build a MLS/MCS-enabled non-base policy module.

$ checkmodule -M -m httpd.te -o httpd.mod
(To understand this example you need to understand the below commands , please go through them first)


To List or display loaded modules:

$ less /proc/modules


$ lsmod


$ lsmod
Module Size Used by
vboxsf 45056 0
openvswitch 81920 0
libcrc32c 16384 1 openvswitch
bnep 20480 2
rfcomm 69632 0
bluetooth 491520 10 bnep,rfcomm
snd_intel8x0 40960 2
snd_ac97_codec 131072 1 snd_intel8x0
ac97_bus 16384 1 snd_ac97_codec
snd_pcm 106496 2 snd_ac97_codec,snd_intel8x0
snd_seq_midi 16384 0
snd_seq_midi_event 16384 1 snd_seq_midi
snd_rawmidi 32768 1 snd_seq_midi


To find more info about any module or driver

$ modinfo openvswitch            <openvswitch is the driver name>


filename: /lib/modules/3.19.0-78-generic/kernel/net/openvswitch/openvswitch.ko
license: GPL
description: Open vSwitch switching datapath
srcversion: 080C41949A98092B5836C55
depends: libcrc32c
intree: Y
vermagic: 3.19.0-78-generic SMP mod_unload modversions
signer: Magrathea: Glacier signing key
sig_key: EF:A6:92:8E:6C:79:3D:B1:F2:70:94:A3:9D:DD:50:2E:D2:02:91:B2
sig_hashalgo: sha512


To view all the drivers :

$ ls -l /lib/modules/$(uname -r)/kernel/drivers/

total 324
drwxr-xr-x 3 root root 4096 Dec 29 16:19 acpi
drwxr-xr-x 2 root root 4096 Dec 29 16:20 ata
drwxr-xr-x 2 root root 4096 Dec 29 16:20 atm
drwxr-xr-x 2 root root 4096 Dec 29 16:20 auxdisplay
drwxr-xr-x 3 root root 4096 Dec 29 16:19 base
drwxr-xr-x 2 root root 4096 Dec 29 16:20 bcma
drwxr-xr-x 9 root root 4096 Dec 29 16:20 block
drwxr-xr-x 2 root root 4096 Dec 29 16:20 bluetooth