SELinux local policy maintenance workflow

category: notez · date: 2018-01-01 · author: LALA

noteHistorical technical note from 2018. Environment-specific identifiers and credentials have been anonymized. Commands reflect the technology and operating-system generation used at the time and should be reviewed before reuse on a current system.

This note turns the original iterative systemd-machined example into a generic procedure for maintaining a local SELinux module without retaining host-specific policy names or permissions.

1. Reproduce and collect

bash

$ ausearch -m AVC,USER_AVC -ts recent

2. Diagnose

bash

$ ausearch -m AVC -ts recent | audit2why
$ ausearch -m AVC -ts recent | audit2allow -R

Treat output as analysis, not as a policy to install automatically.

3. Verify labels

bash

$ ls -lZ /path
$ matchpathcon /path

If the label is wrong, fix it persistently with semanage fcontext and restorecon.

4. Update module source

Add only the interface or narrowly scoped rule that matches intended behavior. Increment the local module version in source control and document why each non-standard permission exists.

5. Build and install

bash

$ make -f /usr/share/selinux/devel/Makefile localpolicy.pp
$ semodule -i localpolicy.pp

6. Verify

Re-run the operation and inspect recent AVCs again. A successful command is not sufficient; confirm the new rule did not hide a broader labeling or confinement problem.

References

Red Hat - Writing a custom SELinux policy: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/using_selinux/writing-a-custom-selinux-policy_using-selinux
semodule(8): https://man7.org/linux/man-pages/man8/semodule.8.html