46.2.1. Using audit2allow to Build a Local Policy Module
The audit2allow utility now has the ability to build policy modules. Use the following command to build a policy module based on specific contents of the audit.log file:
[root@host2a ~]# grep setsebool /var/log/audit/audit.log | audit2allow -M mysemanage Generating type enforcement file: mysemanage.te Compiling policy checkmodule -M -m -o mysemanage.mod mysemanage.te semodule_package -o mysemanage.pp -m mysemanage.mod ******************** IMPORTANT *********************** In order to load this newly created policy package into the kernel, you are required to execute semodule -i mysemanage.pp
The audit2allow utility has built a type enforcement file (mysemanage.te). It then executed the checkmodule command to compile a module file (mysemanage.mod). Lastly, it uses the semodule_package command to create a policy package (mysemanage.pp). The semodule_package command combines different policy files (usually just the module and potentially a file context file) into a policy package.