I am still a complete noob when it comes to managing selinux and custom rules. I understand the concept to a certain degree (only letting applications certain permissions to certain resources, rather than just RWX based on user:group of the process and files)
I usually use this snippet when I need to let things work properly. If I have an issue in the code somewhere, whether it's accessing files, ports, or performing other tasks, this generally unblocks it from being a problem. Probably not the best route, but it works for what I need.
I would like to figure out how to manage it better, but I can't seem to find any information on managing current/custom/default rules and add them another way. I know there's also some boolean settings that can be toggled/set using setsebool, but other than that I'm a bit lost.
This is what I generally run (as root) when attempting to allow whatever I'm doing.
sudo grep nginx /var/log/audit/audit.log | audit2allow -m nginx > nginx.te
sudo grep nginx /var/log/audit/audit.log | audit2allow -M nginx
# Make this policy package active
sudo semodule -i nginx.pp
# Cleanup
sudo rm -f nginx.te && sudo rm -f nginx.pp
When I run the third line to make the policy package active, I get the following error:
Failed to resolve typeattributeset statement at /etc/selinux/targeted/tmp/modules/100/redis/cil:82
semodule: Failed!
I cannot open the file either, because /etc/selinux/targeted/tmp/ doesn't exist afterwards.