Frank Murphy wrote:
Examples only:
If exim gave an avc denial.
1: Create policy.
audit2allow -M myexim < /var/log/audit/audit.log
then enable it.
semodule -i myexim.pp
2: If then in a couple of days exim generates another avc denial,
different from the first.
How does one edid\use audid2allow to include the new avc.
Have looked at "man audit2allow" and can't seem to grasp an edit from
the options.
Frank
On the day that it generates another denial, you could try something like:
/sbin/ausearch -m avc -ts today | grep x | audit2allow -M
myexim2;/usr/sbin/semodule -i myexim2.pp
Where "x" is the domain, such as "httpd_t" for Apache. It is probably
best to run "/sbin/ausearch -m avc -ts today | grep x" first, to make
sure you get the results you want.
Cheers.
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
