SELINUX local policy creation

Run the command

audit2allow -m local -l > local.te < /var/log/audit.log

This will generate a local.te file that will have the policy to allow the things denied int he current audit.log

You’ll want to review closely to see if those are in fact the things you want to allow.

To turn this into a binary module you use this command:

checkmodule -M -m -o local.mod local1.te

To Create a policy that can be loaded into the kernel use this

semodule_package -o local.pp -m local.mod

Then to activate it use this

semodule -i local.pp

This entry was posted in Uncategorized and tagged . Bookmark the permalink.

Leave a Reply

Your email address will not be published.