I am setting up selinux and ran

grep ${1} /var/log/audit/audit.log | audit2allow -r -M local_${1}

within an compilation script (oneliner).

I'd like to run it like "compile_selinux collectd_t" so it grabs me all relevant issues. Now I can review the .te file with what audit2allow -a returns me.

Next thing is installing the module by running

semodule -i local_collectd_t.pp

But this command does not return and uses up 100% cpu. I have been waiting for 3.5 hours now. I don't know whats wrong and hope you could help me.

Example for collectd_t:

module local_collectd_t 1.0;

require {
        type var_log_t;
        type collectd_t;
        type openvpn_var_log_t;
        class file { read open };

#============= collectd_t ==============
allow collectd_t openvpn_var_log_t:file { read open };
allow collectd_t var_log_t:file open;

Thanks for help


  • Is it still running? Aug 16, 2015 at 2:08
  • Cancelled it :-S
    – Silberling
    Aug 16, 2015 at 4:42
  • After half a day it says: libsepol.check_assertion_helper: neverallow violated by allow restorecond_t semanage_store_t:file { relabelto }; libsemanage.semanage_expand_sandbox: Expand module failed semodule: Failed!
    – Silberling
    Sep 2, 2015 at 18:30
  • You've got some other issue with your system. That should have taken only a minute or two, even on a very old and slow system. Sep 3, 2015 at 19:27


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.