zabbix selinux audit2allow 问题

han8809

Run the audit2allow -a command to view the Type Enforcement rule that allows the denied access:　　

~]# audit2allow -a　　

　　

　　

#============= certwatch_t ==============　　
allow certwatch_t var_t
:dir write;　　

　　*****
　　Missing Type Enforcement rules are usually caused by bugs in SELinux policy, and should be reported in Red Hat Bugzilla. For Red Hat Enterprise Linux, create bugs against the Red Hat Enterprise Linux product, and select the selinux-policy component. Include the output of the audit2allow -w -a and audit2allow -a commands in such bug reports.
　　****
　　To use the rule displayed by audit2allow -a, run the audit2allow -a -M mycertwatch command as the Linux root user to create custom module. The -M option creates a Type Enforcement file (.te) with the name specified with -M, in your current working directory:
　　

~]# audit2allow -a -M mycertwatch　　

　　
******************** IMPORTANT ***********************
　　
To make this policy package active
, execute:　　

　　
semodule -i mycertwatch
.pp　　

　　
~]
# ls　　
mycertwatch
.pp  mycertwatch.te　　

　　Also, audit2allow compiles the Type Enforcement rule into a policy package (.pp). To install the module, run the semodule -i mycertwatch.pp command as the Linux root user.
　　*****
　　Modules created with audit2allow may allow more access than required. It is recommended that policy created with audit2allow be posted to an SELinux list, such as fedora-selinux-list, for review. If you believe their is a bug in policy, create a bug in Red Hat Bugzilla.
　　*****
　　If you have multiple denials from multiple processes, but only want to create a custom policy for a single process, use the grep command to narrow down the input for audit2allow. The following example demonstrates using grep to only send denials>certwatch through audit2allow:
　　

~]# grep certwatch /var/log/audit/audit.log | audit2allow -M mycertwatch2　　
******************** IMPORTANT ***********************
　　
To make this policy package active
, execute:　　

　　
~]
# semodule -i mycertwatch2.pp　　

　　Refer to Dan Walsh's "Using audit2allow to build policy modules. Revisited." blog entry for further information about using audit2allow to build policy modules.