Linux:SELinux Useful Tips - Revision history

Queo at 12:40, 8 March 2017

2017-03-08T12:40:09Z

← Older revision		Revision as of 12:40, 8 March 2017
Line 20:		Line 20:
	[user@host ~]# cd /etc/selinux/		[user@host ~]# cd /etc/selinux/
	[user@host selinux]# export POLICYNAME=<insert-policyname-here>.local \		[user@host selinux]# export POLICYNAME=<insert-policyname-here>.local \
	> && checkmodule -M -m -o ${POLICYNAME}.mod ${POLICYNAME}.te \		&& checkmodule -M -m -o ${POLICYNAME}.mod ${POLICYNAME}.te \
	> && semodule_package -o ${POLICYNAME}.pp -m ${POLICYNAME}.mod \		&& semodule_package -o ${POLICYNAME}.pp -m ${POLICYNAME}.mod \
	> && semodule -u ${POLICYNAME}.pp		&& semodule -u ${POLICYNAME}.pp
	* Check the SELinux logs once again		* Check the SELinux logs once again
	[user@host ~]# audit2allow -l -a		[user@host ~]# audit2allow -l -a
	* If everything went smooth set SELinux to enforcing again		* If everything went smooth set SELinux to enforcing again
	setenforce 1		setenforce 1

Queo at 09:58, 17 February 2017

2017-02-17T09:58:56Z

← Older revision		Revision as of 09:58, 17 February 2017
Line 1:		Line 1:
			== Create/Install a local SELinux policy module ==
			* Install the policycoreutils-python package if not already installed
			[user@host ~]# yum install policycoreutils-python
			* Generate SELinux policy module from logs of denied operations
			[user@host ~]# audit2allow -l -a -M <insert-policyname-here>.local
			* Install the policy module
			[user@host ~]# semodule -i <insert-policyname-here>.local.pp

	== Update a local SELinux policy module with additional settings ==		== Update a local SELinux policy module with additional settings ==
	* Set SELinux to permissive mode		* Set SELinux to permissive mode

Queo: Created page with "== Update a local SELinux policy module with additional settings == * Set SELinux to permissive mode [user@host ~]# setenforce 0 * Install the policycoreutils-python package..."

2017-02-17T09:51:46Z

Created page with "== Update a local SELinux policy module with additional settings == * Set SELinux to permissive mode [user@host ~]# setenforce 0 * Install the policycoreutils-python package..."

New page

== Update a local SELinux policy module with additional settings ==
* Set SELinux to permissive mode
[user@host ~]# setenforce 0
* Install the policycoreutils-python package if not already installed
[user@host ~]# yum install policycoreutils-python
* Generate SELinux policy allow/dontaudit rules from logs of denied operations
[user@host ~]# audit2allow -l -a
* Insert these new line(s) into the following policy
Dont forget to insert the class(es)/type(s) and always increment the module version (!)
[user@host ~]# vim /etc/selinux/<insert-policyname-here>.local.te
* Compile & update the module
[user@host ~]# cd /etc/selinux/
[user@host selinux]# export POLICYNAME=<insert-policyname-here>.local \
> && checkmodule -M -m -o ${POLICYNAME}.mod ${POLICYNAME}.te \
> && semodule_package -o ${POLICYNAME}.pp -m ${POLICYNAME}.mod \
> && semodule -u ${POLICYNAME}.pp
* Check the SELinux logs once again
[user@host ~]# audit2allow -l -a
* If everything went smooth set SELinux to enforcing again
setenforce 1