Contents
How to create an audit2allow policy for SELinux?
From the audit2allow(1) manual page: ” audit2allow – generate SELinux policy allow rules from logs of denied operations” [16]. After analyzing denials as per Section 8.3.7, “sealert Messages”, and if no label changes or Booleans allowed access, use audit2allow to create a local policy module.
Do you use the example of audit2allow in production?
Do not use the example in this section in production. It is used only to demonstrate the use of the audit2allow utility. From the audit2allow(1) manual page: ” audit2allow – generate SELinux policy allow rules from logs of denied operations” [16].
When to use audit2allow to allow access?
If no label changes or Booleans allowed access, use audit2allow to create a local policy module. With a denial logged, such as the certwatch denial in step 1]
Is there an example of allowing access in SELinux?
Allowing Access: audit2allow Do not use the example in this section in production. It is used only to demonstrate the use of the audit2allow utility. The audit2allow utility gathers information from logs of denied operations and then generates SELinux policy allow rules.
How to use the rule displayed by audit2allow-a?
To use the rule displayed by audit2allow -a, run the audit2allow -a -M mycertwatch command as the Linux root user to create custom module. The -M option creates a Type Enforcement file ( .te) with the name specified with -M, in your current working directory:
How to install Java 8 on Alpine Linux?
Go ahead and first enable community repo by uncommenting the community repo in /etc/apk/repositories, then run apk update then execute apk add openjdk11. Thanks for contributing an answer to Unix & Linux Stack Exchange! Please be sure to answer the question.
Why is audit2allow allowed in Red Hat Enterprise?
You can use audit2allow to generate a loadable module to allow this access. As shown, access was denied due to a missing Type Enforcement rule. Missing Type Enforcement rules are usually caused by bugs in SELinux policy, and should be reported in Red Hat Bugzilla.