appending to an existing policy

appending to an existing policy

[Rodney Simioni]

[-- Attachment #1: Type: text/plain, Size: 913 bytes --]

I just created a custom policy and did the semodule -i test.te.

 

I reran all my tests after a few days and I noticed there were
additional AVC denials in the audit.log.

 

I want to add the new stuff to my existing test.te file so that I won't
have multiple policies. I just want to have one policy and just keep
adding to it, is that possible and how? Thanks in advance.



This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free.  Thank you.

[-- Attachment #2: Type: text/html, Size: 2586 bytes --]

Re: appending to an existing policy

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04/10/2013 02:24 PM, Rodney Simioni wrote:
> I just created a custom policy and did the semodule -i test.te.
> 
> 
> 
> I reran all my tests after a few days and I noticed there were additional
> AVC denials in the audit.log.
> 
> 
> 
> I want to add the new stuff to my existing test.te file so that I won't
> have multiple policies. I just want to have one policy and just keep adding
> to it, is that possible and how? Thanks in advance.
> 
> 
> This email message is intended for the use of the person to whom it has
> been sent, and may contain information that is confidential or legally
> protected. If you are not the intended recipient or have received this
> message in error, you are not authorized to copy, distribute, or otherwise
> use this message or its attachments. Please notify the sender immediately
> by return e-mail and permanently delete this message and any attachments.
> Verio Inc. makes no warranty that this email is error or virus free. Thank
> you.
> 
Yes just recreate the te file with the additions or do a

audit2allow -la >> test.te
vi test.te # To make sure the rules added are what you want.
make -f /usr/share/selinux/devel/Makefile
semodule -i test.pp

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlFls/0ACgkQrlYvE4MpobNktgCeMSmaNBPgPObxA+a3VoIkUsQM
eCMAnikWXxVHVvR5wR6Gs5ssYiV2PX7q
=UHgP
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

RE: appending to an existing policy

[Rodney Simioni]

Is this something fixable, thank you.

[root@narf audit]# make -f /usr/share/selinux/devel/Makefile
Compiling targeted lsh64 module
/usr/bin/checkmodule:  loading policy configuration from tmp/lsh64.tmp
lsh64.te":187:ERROR 'unknown type semanage_t' at token ';' on line 1213:
allow semanage_t setfiles_t:process { siginh noatsecure rlimitinh };
#============= semanage_t ==============
/usr/bin/checkmodule:  error(s) encountered while parsing configuration
make: *** [tmp/lsh64.mod] Error 1

-----Original Message-----
From: Daniel J Walsh [mailto:dwalsh@redhat.com] 
Sent: Wednesday, April 10, 2013 2:49 PM
To: Rodney Simioni
Cc: selinux@tycho.nsa.gov
Subject: Re: appending to an existing policy

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04/10/2013 02:24 PM, Rodney Simioni wrote:
> I just created a custom policy and did the semodule -i test.te.
> 
> 
> 
> I reran all my tests after a few days and I noticed there were 
> additional AVC denials in the audit.log.
> 
> 
> 
> I want to add the new stuff to my existing test.te file so that I 
> won't have multiple policies. I just want to have one policy and just 
> keep adding to it, is that possible and how? Thanks in advance.
> 
> 
> This email message is intended for the use of the person to whom it 
> has been sent, and may contain information that is confidential or 
> legally protected. If you are not the intended recipient or have 
> received this message in error, you are not authorized to copy, 
> distribute, or otherwise use this message or its attachments. Please 
> notify the sender immediately by return e-mail and permanently delete
this message and any attachments.
> Verio Inc. makes no warranty that this email is error or virus free. 
> Thank you.
> 
Yes just recreate the te file with the additions or do a

audit2allow -la >> test.te
vi test.te # To make sure the rules added are what you want.
make -f /usr/share/selinux/devel/Makefile semodule -i test.pp

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlFls/0ACgkQrlYvE4MpobNktgCeMSmaNBPgPObxA+a3VoIkUsQM
eCMAnikWXxVHVvR5wR6Gs5ssYiV2PX7q
=UHgP
-----END PGP SIGNATURE-----


This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free.  Thank you.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.