Custom SELinux Policy Needed for Internal App

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

A custom daemon still hits AVC denials after basic relabeling and boolean tuning.

Environment & Reproduction

Inspect denials with ausearch -m avc and summarize with audit2why to identify missing allow rules.

Root Cause Analysis

Default SELinux policy lacks permissions for the app’s unusual resource access pattern.

Quick Triage

Generate candidate module via audit2allow -M, review rules, and install with semodule -i cautiously.

Step-by-Step Diagnosis

Capture raw AVC records and generated policy snippets before loading modules.

Solution – Primary Fix

Service works in enforcing mode and no new denials match the prior signature.

Solution – Alternative Approaches

Restart service with systemctl and monitor audit logs to confirm policy sufficiency.

Verification & Acceptance Criteria

Design applications with standard SELinux domains and labeled paths where possible.

Rollback Plan

Remove problematic module using semodule -r and revert to previous policy state.

Prevention & Hardening

Version-control local policy source and promote through test environments first.

Related Errors & Cross-Refs

Audit logs remain authoritative; also review service logs in journalctl -u .

Related tutorial: View the step-by-step tutorial for rhel-9.

View all rhel-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Include policy module source, AVC samples, and rationale for each added permission.