Frank Murphy wrote:
> Examples only:
>
>
> If exim gave an avc denial.
>
> 1: Create policy.
> audit2allow -M myexim < /var/log/audit/audit.log
>
> then enable it.
> semodule -i myexim.pp
>
> 2: If then in a couple of days exim generates another avc denial,
> different from the first.
>
> How does one edid\use audid2allow to include the new avc.
>
> Have looked at "man audit2allow" and can't seem to grasp an edit from
> the options.
>
> Frank
>
On the day that it generates another denial, you could try something like:
/sbin/ausearch -m avc -ts today | grep x | audit2allow -M
myexim2;/usr/sbin/semodule -i myexim2.pp
Where "x" is the domain, such as "httpd_t" for Apache. It is probably
best to run "/sbin/ausearch -m avc -ts today | grep x" first, to make
sure you get the results you want.
Cheers.
--
fedora-selinux-list mailing list
fedora-selinux-list@...
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
