Re: Need Info adding\editing to a personal module?
Frank Murphy wrote:
Examples only:
If exim gave an avc denial.
1: Create policy.
audit2allow -M myexim < /var/log/audit/audit.log
then enable it.
semodule -i myexim.pp
2: If then in a couple of days exim generates another avc denial,
different from the first.
How does one edid\use audid2allow to include the new avc.
Have looked at "man audit2allow" and can't seem to grasp an edit from
the options.
Frank
On the day that it generates another denial, you could try something like:
/sbin/ausearch -m avc -ts today | grep x | audit2allow -M
myexim2;/usr/sbin/semodule -i myexim2.pp
Where "x" is the domain, such as "httpd_t" for Apache. It is probably
best to run "/sbin/ausearch -m avc -ts today | grep x" first, to make
sure you get the results you want.
Cheers.