Linux command
audit2allow 命令
安全
权限或系统影响较大，执行前请核对目标。
常用示例
Example
sudo audit2allow -a
Example
sudo audit2allow -i /var/log/audit/audit.log
Example
sudo audit2allow -a -M my_module
Explain
sudo audit2allow -a -w
Example
sudo audit2allow -a -R
Example
sudo ausearch -m avc -c httpd | audit2allow -M httpd_policy
说明
audit2allow generates SELinux policy allow rules from audit logs. It reads denial messages from the audit subsystem and creates type enforcement rules that would permit the denied operations. The tool can produce simple allow rules for quick troubleshooting or generate complete loadable policy modules with the -M option. When used with -R, it generates reference policy using standard macros, producing cleaner and more maintainable rules. It is typically used after audit2why has identified the root cause of denials.
参数
- -a, --all
- Read input from audit and message logs.
- -b, --boot
- Read input from audit messages since the last boot.
- -d, --dmesg
- Read input from dmesg output.
- -i, --input _file_
- Read input from the specified file.
- -l, --lastreload
- Read only AVC denials since the last policy reload.
- -m, --module _name_
- Generate module output (source, not packaged).
- -M _name_
- Generate a loadable policy module package (.pp).
- -o, --output _file_
- Append output to the given file.
- -D, --dontaudit
- Generate dontaudit rules instead of allow rules.
- -R, --reference
- Generate reference policy using installed interface macros.
- -N, --noreference
- Do not generate reference policy; use traditional allow rules.
- -w, --why
- Translate audit messages into a description of why access was denied.
- -e, --explain
- Fully explain the generated output.
- -x, --xperms
- Generate extended permission (ioctl) rules.
- -t, --type _regex_
- Filter output by type regular expression.
- -C
- Generate CIL (Common Intermediate Language) output.
- -r, --requires
- Generate require statements for loadable modules.
- -v, --verbose
- Enable verbose output.
FAQ
What is the audit2allow command used for?
audit2allow generates SELinux policy allow rules from audit logs. It reads denial messages from the audit subsystem and creates type enforcement rules that would permit the denied operations. The tool can produce simple allow rules for quick troubleshooting or generate complete loadable policy modules with the -M option. When used with -R, it generates reference policy using standard macros, producing cleaner and more maintainable rules. It is typically used after audit2why has identified the root cause of denials.
How do I run a basic audit2allow example?
Run `sudo audit2allow -a` in a terminal, then adjust file names, paths, flags, or remote targets for your system.
What does -a, --all do in audit2allow?
Read input from audit and message logs.