Replacing and updating existing policies
When we replace or update existing policies, we need to load them using the semodule commands, as shown in the Handling policy modules section. But how do we create or update the policies, exactly? Let's consider a few use cases where SELinux policy adjustments are triggered.
Creating policies using audit2allow
When SELinux prevents certain actions, we know it will log the appropriate denial (assuming no dontaudit statements are defined) in the audit logs. This denial can be used as the source to generate a custom SELinux policy that allows the activity.
Consider the following denial, which occurred when a confined user called su to switch to the root user:
type=AVC msg=audit(...): avc: denied { write } for pid=58002 comm="su" name="btmp" dev="vda1" ino=4213650 scontext=staff_u:staff_r:staff_t:s0 tcontext=system_u:object_r:faillog_t:s0 tclass=file permissive=0
If we are certain that these operations...