Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER ADMINISTRATION, Руководство по развертыванию

Страница: 798 / 848

Chapter 46. Customizing SELinux Policy
772
Note
This command does not list the base policy module, which is also installed.
The
/usr/share/selinux/targeted/
directory contains a number of policy package
(*.pp) files. These files are included in the
selinux-policy
rpm and are used to build
the policy file.
46.2. Building a Local Policy Module
The following section uses an actual example to demonstrate building a local policy module to address
an issue with the current policy. This issue involves the
ypbind init
script, which executes the
setsebool
command, which in turn tries to use the terminal. This is generating the following denial:
type=AVC msg=audit(1164222416.269:22): avc: denied { use } for pid=1940 comm="setsebool"
name="0" dev=devpts ino=2 \
scontext=system_u:system_r:semanage_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=fd
Even though everything still works correctly (that is, it is not preventing any applications form running
as intended), it does interrupt the normal work flow of the user. Creating a local policy module
addresses this issue.
46.2.1. Using audit2allow to Build a Local Policy Module
The
audit2allow
utility now has the ability to build policy modules. Use the following command to
build a policy module based on specific contents of the
audit.log
file:
ausearch -m AVC --comm setsebool | audit2allow -M mysemanage
The
audit2allow
utility has built a type enforcement file (
mysemanage.te
). It then executed
the
checkmodule
command to compile a module file (
mysemanage.mod
). Lastly, it uses
the
semodule_package
command to create a policy package (
mysemanage.pp
). The
semodule_package
command combines different policy files (usually just the module and potentially
a file context file) into a policy package.
46.2.2. Analyzing the Type Enforcement (TE) File
Use the
cat
command to inspect the contents of the TE file:
[root@host2a ~]# cat mysemanag.te
module mysemanage 1.0;
require {
class fd use;
type init_t;
type semanage_t;
role system_r;
};
allow semanage_t init_t:fd use;