1

I am setting up selinux and ran

grep ${1} /var/log/audit/audit.log | audit2allow -r -M local_${1}

within an compilation script (oneliner).

I'd like to run it like "compile_selinux collectd_t" so it grabs me all relevant issues. Now I can review the .te file with what audit2allow -a returns me.

Next thing is installing the module by running

semodule -i local_collectd_t.pp

But this command does not return and uses up 100% cpu. I have been waiting for 3.5 hours now. I don't know whats wrong and hope you could help me.

Example for collectd_t:

module local_collectd_t 1.0;

require {
        type var_log_t;
        type collectd_t;
        type openvpn_var_log_t;
        class file { read open };
}

#============= collectd_t ==============
allow collectd_t openvpn_var_log_t:file { read open };
allow collectd_t var_log_t:file open;

Thanks for help

Silberling

Improve this question
4
  • Is it still running?
    – Michael Hampton
    Aug 16, 2015 at 2:08
  • Cancelled it :-S
    – Silberling
    Aug 16, 2015 at 4:42
  • After half a day it says: libsepol.check_assertion_helper: neverallow violated by allow restorecond_t semanage_store_t:file { relabelto }; libsemanage.semanage_expand_sandbox: Expand module failed semodule: Failed!
    – Silberling
    Sep 2, 2015 at 18:30
  • You've got some other issue with your system. That should have taken only a minute or two, even on a very old and slow system.
    – Michael Hampton
    Sep 3, 2015 at 19:27

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.