python/audit2allow/audit2allow.1

 NOTE: These examples are for systems using the audit package. If you do   not use the audit package, the AVC messages will be in /var/log/messages.  Please substitute /var/log/messages for /var/log/audit/audit.log in the   examples.
 Using audit2allow to generate module policy
$ cat /var/log/audit/audit.log | audit2allow -m local > local.te
$ cat local.te
module local 1.0;

require {
 class file { getattr open read };


 type myapp_t;
 type etc_t;
 };


allow myapp_t etc_t:file { getattr open read };
<review local.te and customize as desired>

 Using audit2allow to generate module policy using reference policy
$ cat /var/log/audit/audit.log | audit2allow -R -m local > local.te
$ cat local.te
policy_module(local, 1.0)

gen_require(`
 type myapp_t;
 type etc_t;
 };

files_read_etc_files(myapp_t)
<review local.te and customize as desired>

 Building module policy using Makefile
# SELinux provides a policy devel environment under
# /usr/share/selinux/devel including all of the shipped
# interface files.
# You can create a te file and compile it by executing

$ make -f /usr/share/selinux/devel/Makefile local.pp


# This make command will compile a local.te file in the current
# directory. If you did not specify a "pp" file, the make file
# will compile all "te" files in the current directory. After
# you compile your te file into a "pp" file, you need to install
# it using the semodule command.

$ semodule -i local.pp

 Building module policy manually
# Compile the module
$ checkmodule -M -m -o local.mod local.te

# Create the package
$ semodule_package -o local.pp -m local.mod

# Load the module into the kernel
$ semodule -i local.pp

 Using audit2allow to generate and build module policy
$ cat /var/log/audit/audit.log | audit2allow -M local
Generating type enforcement file: local.te

Compiling policy: checkmodule -M -m -o local.mod local.te
Building package: semodule_package -o local.pp -m local.mod

******************** IMPORTANT ***********************

In order to load this newly created policy package into the kernel,
you are required to execute

semodule -i local.pp

 Using audit2allow to generate monolithic (non-module) policy
$ cd /etc/selinux/$SELINUXTYPE/src/policy
$ cat /var/log/audit/audit.log | audit2allow >> domains/misc/local.te
$ cat domains/misc/local.te
allow cupsd_config_t unconfined_t:fifo_file { getattr ioctl };
<review domains/misc/local.te and customize as desired>
$ make load