Building A Local Policy Module; Using Audit2Allow To Build A Local Policy Module; Analyzing The Type Enforcement (Te) File - Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual

Chapter 46. Customizing SELinux Policy
Note
This command does not list the base policy module, which is also installed.
The /usr/share/selinux/targeted/ directory contains a number of policy package
(*.pp) files. These files are included in the selinux-policy rpm and are used to build
the policy file.

46.2. Building a Local Policy Module

The following section uses an actual example to demonstrate building a local policy module to address
an issue with the current policy. This issue involves the ypbind init script, which executes the
setsebool command, which in turn tries to use the terminal. This is generating the following denial:
type=AVC msg=audit(1164222416.269:22): avc:
name="0" dev=devpts ino=2 \
scontext=system_u:system_r:semanage_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=fd
Even though everything still works correctly (that is, it is not preventing any applications form running
as intended), it does interrupt the normal work flow of the user. Creating a local policy module
addresses this issue.

46.2.1. Using audit2allow to Build a Local Policy Module

The audit2allow utility now has the ability to build policy modules. Use the following command to
build a policy module based on specific contents of the audit.log file:
ausearch -m AVC --comm setsebool | audit2allow -M mysemanage
The audit2allow utility has built a type enforcement file (mysemanage.te). It then executed
the checkmodule command to compile a module file (mysemanage.mod). Lastly, it uses
the semodule_package command to create a policy package (mysemanage.pp). The
semodule_package command combines different policy files (usually just the module and potentially
a file context file) into a policy package.

46.2.2. Analyzing the Type Enforcement (TE) File

Use the cat command to inspect the contents of the TE file:
[root@host2a ~]# cat mysemanag.te
module mysemanage 1.0;
require {
class fd use;
type init_t;
type semanage_t;
role system_r;
};
allow semanage_t init_t:fd use;
772
denied { use } for pid=1940 comm="setsebool"