Need Info adding\editing to a personal module?

[Murray McAllister]

Frank Murphy wrote:
> Examples only:
> 
> 
> If exim gave an avc denial.
> 
> 1: Create policy.
> audit2allow -M myexim < /var/log/audit/audit.log
> 
> then enable it.
> semodule -i myexim.pp
> 
> 2: If then in a couple of days exim generates another avc denial,
> different from the first.
> 
> How does one edid\use audid2allow to include the new avc.
> 
> Have looked at "man audit2allow" and can't seem to grasp an edit from
> the options.
> 
> Frank
> 
On the day that it generates another denial, you could try something like:

/sbin/ausearch -m avc -ts today | grep x | audit2allow -M 
myexim2;/usr/sbin/semodule -i myexim2.pp

Where "x" is the domain, such as "httpd_t" for Apache. It is probably 
best to run "/sbin/ausearch -m avc -ts today | grep x" first, to make 
sure you get the results you want.

Cheers.