Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I just created a custom policy and did the semodule -i test.te.

I reran all my tests after a few days and I noticed there were additional AVC denials in the audit.log.

I want to add the new stuff to my existing test.te file so that I won't have multiple policies. I just want to have one policy and just keep adding to it, is that possible and how? Thanks in advance.

share|improve this question

1 Answer 1

All the procedure is very well documented in the manpages of audit2allow(1), checkmodule(8) andsemodule(8).

An example workflow would be (all taken from the mentioned manpages):

  • review local.te and customize as desired

$ cat local.te
  module local 1.0;
       require {
               class file {  getattr open read };
               type myapp_t;
               type etc_t;
        };
       allow myapp_t etc_t:file { getattr open read };
  • Compile the module

$ checkmodule -M -m -o local.mod local.te
  • Create the package

$ semodule_package -o local.pp -m local.mod
  • Load the module into the kernel

$ semodule -i local.pp
  • Install or replace a non-base policy package.

$ semodule -i httpd.pp
  • List non-base modules.

$ semodule -l

If your modules are versioned, you might find interesting to use semodule(8) -u switch:


 -u,--upgrade=MODULE_PKG
   upgrade an existing module package, or install if the module does not exist
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.