10.5.2. Generating SELinux Policy Modules: sepolicy generate
In previous versions of Fedora, the sepolgen
or selinux-polgengui
utilities were used for generating a SELinux policy. These tools have been merged to the sepolicy
suite and the sepolicy generate
command is used to generate an initial SELinux policy module template.
Unlike
sepolgen
, it is not necessary to run
sepolicy generate
as the root user. This utility also creates an RPM spec file, which can be used to build an RPM package that installs the policy package file (
NAME.pp
) and the interface file (
NAME.if
) to the correct location, provides installation of the SELinux policy into the kernel, and fixes the labeling. The setup script continues to install SELinux policy and sets up the labeling. In addition, a manual page based on the installed policy is generated using the
sepolicy manpage
command.
Finally,
sepolicy generate
builds and compiles the SELinux policy and the manual page into an RPM package, ready to be installed on other systems.
When sepolicy generate
is executed, the following files are produced:
NAME.te
– type enforcing file
This file defines all the types and rules for a particular domain.
NAME.if
– interface file
This file defines the default file context for the system. It takes the file types created in the NAME.te
file and associates file paths to the types. Utilities, such as restorecon
and rpm
, use these paths to write labels.
NAME_selinux.spec
– RPM spec file
This file is an RPM spec file that installs SELinux policy and sets up the labeling. This file also installs the interface file and a man page describing the policy. You can use the sepolicy manpage -d NAME
command to generate the man page.
NAME.sh
– helper shell script
This script helps to compile, install, and fix the labeling on the system. It also generates a man page based on the installed policy, compiles, and builds an RPM package suitable to be installed on other systems.
If it is possible to generate an SELinux policy module, sepolicy generate
prints out all generated paths from the source domain to the target domain. See the sepolicy-generate(8) manual page for further information about sepolicy generate
.