Fix semanage and sysctl Command Not Found on Linux

Updated: 18 October 2026 · Applies to: AlmaLinux 8.10, 9.8 and 10.2, Debian 13 and Ubuntu 24.04, tested; Rocky Linux and RHEL use the same packages

semanage: command not found means the package that contains it is not installed. On AlmaLinux, Rocky Linux and RHEL 8, 9 and 10 install it with:

sudo dnf install policycoreutils-python-utils

On CentOS and RHEL 7 the package was called policycoreutils-python (sudo yum install policycoreutils-python). According to Red Hat, RHEL 8 replaced it with policycoreutils-python-utils and python3-policycoreutils, so old guides that tell you to install policycoreutils-python fail on current versions. On AlmaLinux 10.2 that gave:

No match for argument: policycoreutils-python
Error: Unable to find a match: policycoreutils-python

CentOS Linux 6, 7 and 8 are end of life and get no updates; move such servers to AlmaLinux or Rocky Linux.

sysctl: command not found has a different cause: either the procps package is missing (common in containers and minimal images), or you run it as a normal user (or after a plain su) on Debian, where /usr/sbin is not in your PATH. All three cases are covered in section 5.

1. Install semanage on AlmaLinux, Rocky Linux and RHEL

1. Optional: ask dnf which package provides the command. On AlmaLinux 10.2 (lab output, shortened):

   dnf provides /usr/sbin/semanage

   policycoreutils-python-utils-3.10-2.el10_2.noarch : SELinux policy core python utilities
   Repo        : appstream
   Matched from:
   Filename    : /usr/sbin/semanage

   AlmaLinux 9.8 showed policycoreutils-python-utils-3.6-5.el9 and AlmaLinux 8.10 policycoreutils-python-utils-2.9-25.el8. dnf provides '*/semanage' also works.
2. Install it:

   sudo dnf install policycoreutils-python-utils

3. Check that it works:

   sudo semanage port -l | grep http_port_t

   http_port_t                    tcp      80, 81, 443, 488, 8008, 8009, 8443, 9000
   http_port_t                    udp      80, 443

The same package also installs audit2allow, audit2why and chcat.

2. ValueError: SELinux policy is not managed or store cannot be accessed

If semanage now runs but stops with this error, the system has no SELinux policy installed. We got it in an AlmaLinux 10.2 container before selinux-policy-targeted was installed. A normal AlmaLinux, Rocky Linux or RHEL server has that package; if yours does not, install it with sudo dnf install selinux-policy-targeted. Run getenforce to see whether SELinux is Enforcing, Permissive or Disabled.

3. Common semanage commands

sudo semanage port -a -t http_port_t -p tcp 8085      # let Apache or nginx listen on port 8085
sudo semanage port -m -t http_port_t -p tcp 8080      # port already has another type: modify it
sudo semanage port -l -C                              # list only your own changes
sudo semanage port -d -t http_port_t -p tcp 8085      # remove your change again
sudo semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/app/uploads(/.*)?"
sudo restorecon -Rv /var/www/app/uploads
sudo semanage boolean -l | grep httpd_can_network_connect

Port 8080 is already assigned to http_cache_port_t, so the right command for it is -m (modify). On AlmaLinux 9.8 and 10.2, -a handled this by itself and printed Port tcp/8080 already defined, modifying instead.

After a change, restart the service. If it is still blocked, sudo ausearch -m avc -ts recent | audit2why explains the denial.

4. semanage on Debian and Ubuntu

The package has the same name there: sudo apt install policycoreutils-python-utils (version 3.8.1 on Debian 13, 3.5 on Ubuntu 24.04). But Debian and Ubuntu use AppArmor by default, not SELinux, so on both lab systems semanage port -l only printed:

ValueError: SELinux policy is not managed or store cannot be accessed.

If a guide for AlmaLinux or Rocky Linux tells you to run semanage, you can usually skip that step on Debian and Ubuntu. To see what AppArmor protects, run sudo aa-status.

5. Fix sysctl: command not found

The sysctl command is part of procps-ng on the RHEL family and procps on Debian and Ubuntu. Check which case you have:

1. The package is missing. The AlmaLinux 10.2 and Debian 13 container images have no sysctl at all (bash: sysctl: command not found). Install the package:

   sudo dnf install procps-ng      # AlmaLinux, Rocky Linux, RHEL
   sudo apt install procps         # Debian, Ubuntu

   dnf provides /usr/sbin/sysctl confirms the package name (procps-ng-4.0.4-11.el10 on AlmaLinux 10.2).
2. Debian: you are a normal user. sysctl lives in /usr/sbin, and on Debian 13 a normal user's PATH is /usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games, without the sbin folders. Our Debian 13 test with a user called alice:

   $ su - alice -c 'sysctl -n kernel.ostype'
   -bash: line 1: sysctl: command not found
   $ su - alice -c '/usr/sbin/sysctl -n vm.swappiness'
   60

   Reading values works with the full path. To change them you need root anyway, so use sudo sysctl ... (sudo's secure_path includes /usr/sbin). Ubuntu puts /usr/sbin in every user's PATH, so this case does not happen there.
3. Debian: you switched to root with plain su. su without a dash keeps your old PATH, so root still cannot find sysctl. Use su - (a login shell), which set the full root PATH in our Debian 13 test.

To read and change kernel settings once sysctl works, see how to query and change kernel parameters with sysctl. If a setting is lost after a reboot, see sysctl kernel parameter does not take effect after reboot. For other missing commands, see netstat: command not found and setfacl command not found.

Official documentation: Red Hat: Using SELinux (RHEL 9).