Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just created a custom policy and did the semodule -i test.te.

I reran all my tests after a few days and I noticed there were additional AVC denials in the audit.log.

I want to add the new stuff to my existing test.te file so that I won't have multiple policies. I just want to have one policy and just keep adding to it, is that possible and how? Thanks in advance.

share|improve this question

All the procedure is very well documented in the manpages of audit2allow(1), checkmodule(8) andsemodule(8).

An example workflow would be (all taken from the mentioned manpages):

  • review local.te and customize as desired

$ cat local.te
  module local 1.0;
       require {
               class file {  getattr open read };
               type myapp_t;
               type etc_t;
       allow myapp_t etc_t:file { getattr open read };
  • Compile the module

$ checkmodule -M -m -o local.mod local.te
  • Create the package

$ semodule_package -o local.pp -m local.mod
  • Load the module into the kernel

$ semodule -i local.pp
  • Install or replace a non-base policy package.

$ semodule -i httpd.pp
  • List non-base modules.

$ semodule -l

If your modules are versioned, you might find interesting to use semodule(8) -u switch:

   upgrade an existing module package, or install if the module does not exist
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.