From Fedora Project Wiki

< SELinux

Revision as of 06:21, 27 May 2020 by Vmojzis (talk | contribs)

Creating Own Product Policies

In Fedora, there is a lot of applications and daemons which require customized SELinux security policy. The former approach with providing all policies only as a part of the system has been enhanced by the option to create custom product policy.

With the possibility to create custom product policy, required changes in a policy can be released immediately, so the product package maintainer does not need to wait for another SELinux policy package release. In other words, a product SELinux policy is always synchronized with the corresponding product (package).

This chapter is dedicated to shipping custom SELinux security module as a subpackage for a daemon or an application.

SELinux policy maintainers are not responsible for bugs in customized SELinux policies.

Independent SELinux Policy

While considering custom product policy, a product maintainer has two options:

Distribution policies have GPL license, so any policy extracted from Distribution policy must have a GPL compatible license.

Agreement workflow

Before you start with shipping custom product policies, let the SELinux team know about your intentions. To do this, use SELinux Fedora mailing list or contact SELinux policy maintainer:

Preparing sources for the Policy repository

It is recommended to create a Git repository for the SELinux policy sources.

Corresponding policy module can than be extracted from selinux-policy-contrib repository. If there is no policy for the product, new policy should be created in this step and added to the repository.

When the custom policy is ready, the product maintainer should create a build script (e.g. Makefile), attach a license file and make sure the policy compiles properly.


A Git repository should not contain only SELinux policy source files, but also a license. For more information how to add an open source license in your repository, see the Adding a license to a repository article on the GitHub Help. Distribution policies have GPL license, so any policy extracted from Distribution policy must have a GPL compatible license.


To compile a product policy, you can use a makefile, for example (automatically generated by sepolicy generate):


all: ${TARGET:=.pp.bz2}

%.pp.bz2: %.pp
    @echo Compressing $^ -\> $@
    bzip2 -9 $^

%.pp: %.te
    make -f ${SHAREDIR}/selinux/devel/Makefile $@

    rm -f *~  *.tc *.pp *.pp.bz2
    rm -rf tmp *.tar.gz

man: install-policy
    sepolicy manpage --path . --domain ${TARGET}_t

install-policy: all
    semodule -i ${TARGET}.pp.bz2

install: man
    install -D -m 644 ${TARGET}.pp.bz2 ${DESTDIR}${SHAREDIR}/selinux/packages/${SELINUXTYPE}/${TARGET}.pp.bz2
    install -D -m 644 ${TARGET}_selinux.8 ${DESTDIR}${SHAREDIR}/man/man8/

If you choose not to use a Makefile, replace the make command in spec file with the following:

make -f %{_datadir}/selinux/devel/Makefile %{modulename}.pp
bzip2 -9 %{modulename}.pp

Policy source examples

For the purpose of this example, we create a policy named myapp:

$ cat myapp.te

type myapp_t;
type myapp_exec_t;
init_daemon_domain(myapp_t, myapp_exec_t)

# Grant myapp_t the signal privilege
allow myapp_t self:process { signal };

$ cat myapp.fc
/sbin/myapp --  gen_context(system_u:object_r:myapp_exec_t,s0)

$ cat myapp.if
My app service.

The SELinux policy Git repository should contain the following files (replace myapp with a name of your product):

$ ls
Makefile  myapp.fc  myapp.if  myapp.te COPYING

Compiling custom policy

To compile finished policy, use the make command:

$ make
make -f /usr/share/selinux/devel/Makefile myapp.pp
make[1]: Entering directory '/home/lvrabec/devel/documentations/examples'
Compiling targeted myapp module
/usr/bin/checkmodule:  loading policy configuration from tmp/myapp.tmp
/usr/bin/checkmodule:  policy configuration loaded
/usr/bin/checkmodule:  writing binary representation (version 17) to tmp/myapp.mod
Creating targeted myapp.pp policy package
rm tmp/myapp.mod.fc tmp/myapp.mod
make[1]: Leaving directory '/home/lvrabec/devel/documentations/examples'
Compressing myapp.pp -> myapp.pp.bz2
bzip2 -9 myapp.pp

After a succesful compilation, make an archive containing your policy:

$ cd ../
$ tar -czf myapp-selinux.tar.gz myapp-selinux/

Using custom interfaces

Custom interface naming
All custom interfaces must be prefixed with "ipp_" not to be confused with distribution interfaces.

The interface file of the custom policy module is not installed in the system because it would conflict with the interface file of the distribution module. Therefore any changes to it will not have effect on other policy modules. In order to use custom interfaces it is necessary to create new interface file with unique name (ipp-[modulename].if) and include it in the new package as follows:

install -D -p -m 644 %{modulename}.if %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}/ipp-%{modulename}.if


All custom interfaces must be prefixed with "ipp_" not to be confused with distribution interfaces.

Changes to interfaces of the original module can only be delivered via distribution selinux-policy-* packages. If such a change is necessary, please contact the SELinux team, or submit a pull request. Please bear in mind that such changes will influence other policy modules that use given interface.

Backwards compatibility

The most common problem with using custom policies on older distributions is undefined interfaces.

Compiling targeted nagios module
selinux/nagios.te:374:ERROR 'syntax error' at token 'sssd_signull' on line 19406:

This issue can be resolved by conditionally defining the missing interface. To do this, find definition of the missing interface in SELinux-policy-contrib or SELinux-policy repository, copy it to your interface file and enclose in an ifndef statement.

Example using sssd_signull (necessary to use this interface in epel8):

# Interface compatibility blocks
# The following definitions ensure compatibility with distribution policy
# versions that do not contain given interfaces (epel, or older Fedora
# releases).
# Each block tests for existence of given interface and defines it if needed.

## <summary>
##    Allow caller to signull sssd.
##    Backport from RHEL8
## </summary>
## <param name="domain">
##    <summary>
##    Domain allowed access.
##    </summary>
## </param>
          type sssd_t;

      allow $1 sssd_t:process signull;

Moving type/attribute/alias definitions

Contact SELinux team
Moving definitions between modules is usually not advised and you should consult any such changes with the SELinux team beforehand.

Whenever a type,attribute or alias definition is moved between modules (this is usually done when two modules are merged together, or some distinct part of a policy is moved to a separate module) it is necessary to include the following steps in your custom policy installation:

  • Disable the distribution version of affected module(s) before calling %selinux_modules_install
    • semodule -d <module_name> &> /dev/null || true;
  • Re-enable the original policy modules after %selinux_modules_uninstall
    • semodule -e <module_name> &> /dev/null || true;
&> /dev/null || true
This part is needed because the commands are expected to fail in some situations (e.g. during update of the custom policy package, or when the changes where also adopted in the distribution policy).

These steps are necessary to avoid type, attribute or alias redefinition errors, which may cause the custom package installation to fail. Example of such error:

Running scriptlet: freeipa-selinux-4.8.6-1.fc33.noarch                            2/4
Re-declaration of type ipa_custodia_t
Failed to create node
Bad type declaration at /var/lib/selinux/targeted/tmp/modules/100/ipa_custodia/cil:1
/usr/sbin/semodule:  Failed!

Custom policy modules and distribution policy

It’s important to note that distribution policies should not use interfaces from removable policy modules.

When using types from custom policy modules stub interfaces should be used instead of directly requiring given type. Stub interface is defined and used in distribution module as follows.

$ cat distribution_module.if
## <summary>
##  DBUS stub interface.  No access allowed.
## </summary>
## <param name="domain" unused="true">
## <summary>
##  Domain allowed access
## </summary>
## </param>
        type dystro_t;

$ cat myapp.te
    allow distro_t myapp_log_t:file read_file_perms;

As with any type defined outside of SELinux policy base modules, optional_policy block must be used when using types from removable modules in distribution policy.

Creating the Spec File

When a Git repository with SELinux policy sources is ready, create your product .spec file (rpmbuild configuration file).

The Preamble

First of all an SELinux policy type, a module type, and a module name should be defined:

# defining macros needed by SELinux
%global selinuxtype targeted
%global moduletype contrib
%global modulename myapp

Then it is necessary to fill in all the information about the subpackage such as a name, a version, a license, and so on.

Name: myapp-selinux
Version: 1.0
Release: 1%{?dist}
License: GPLv2
URL: # URL to git repository with policy source files
Summary: SELinux policies for product
Source0: # archive with SELinux policy sources. e.g: myapp-selinux.tar
Requires: selinux-policy-targeted
Requires(post): selinux-policy-targeted
BuildRequires: selinux-policy-devel
BuildArch: noarch
SELinux policy modules for product.

The %prep and %install Section

The following part of the .spec file describes the way a product policy is compiled and installed:

%setup -q


%selinux_relabel_pre -s %{selinuxtype}

# install policy modules
install -D -m 0644 %{modulename}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.bz2


After this step, a product policy is installed on your system.

The %post Section

Next step is loading a product policy into the kernel in the RPM post-install process. This step also contains the post-uninstall process to remove a product policy properly during a product uninstallation.

%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.bz2

if [ $1 -eq 0 ]; then
    %selinux_modules_uninstall -s %{selinuxtype} %{modulename}

%selinux_relabel_post -s %{selinuxtype}

The %files Section

The end of the .spec file contains the %files section. This section declares which files and directories are owned by the package. The last part of the spec file is changelog.

%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename}
%license COPYING

* Mon Jan 01 2017 Author Name <> - 0.1.0-1
- First Build

Adding dependency to the spec file of corresponding package

The *-selinux package should only be required on SELinux enabled systems. Therefore the following rich dependency syntax should be used:

Requires: (%{name}-selinux if selinux-policy-%{selinuxtype})

This ensures that the *-selinux package and all its dependencies are not pulled into containers and other systems that do not use SELinux.

SELinux Policy module priorities

Policy modules can be installed with different priorities. When multiple modules of the same name exist in the system, only the module with the highest priority takes effect.

Distribution policy modules are installed with priority of 100. Custom policy should always be shipped with priority of 200 to override distribution policy. This value is contained inside the selinux_modules_install macro and should not be changed.

Note that semodule installs policy modules with priority of 400 by default.

See SELinux modules and priority for more details about module priority.

Example spec file changes to incorporate -selinux subpackage

This example shows all the code that should be added to an existing spec file to start building an SELinux subpackage.

%global with_selinux 1
%global selinuxtype targeted


Source2:       %{name}.te
Source3:       %{name}.if
Source4:       %{name}.fc


%if 0%{?with_selinux}
# This ensures that the *-selinux package and all it’s dependencies are not pulled
# into containers and other systems that do not use SELinux
Requires:        (%{name}-selinux if selinux-policy-%{selinuxtype})
%endif # if with_selinux


%if 0%{?with_selinux}
# SELinux subpackage
%package selinux
Summary:             Myapp SELinux policy
BuildArch:           noarch
Requires:            selinux-policy-targeted
Requires(post):      selinux-policy-targeted
BuildRequires:       selinux-policy-devel

%description selinux
Custom SELinux policy module
%endif # if with_selinux

-------- %build section ----------------

%if 0%{?with_selinux}
# SELinux policy (originally from selinux-policy-contrib)
# this policy module will override the production module
mkdir selinux
cp -p %{SOURCE2} selinux/
cp -p %{SOURCE3} selinux/
cp -p %{SOURCE4} selinux/

make -f %{_datadir}/selinux/devel/Makefile %{name}.pp
bzip2 -9 %{name}.pp
%endif # if with_selinux

-------- %install section --------------

%if 0%{?with_selinux}
install -D -m 0644 %{name}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
%endif # if with_selinux


%if 0%{?with_selinux}
# SELinux contexts are saved so that only affected files can be
# relabeled after the policy module installation
%pre selinux
%selinux_relabel_pre -s %{selinuxtype}

%post selinux
%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2

%postun selinux
if [ $1 -eq 0 ]; then
    %selinux_modules_uninstall -s %{selinuxtype} %{name}

%posttrans selinux
%selinux_relabel_post -s %{selinuxtype}
%endif # if with_selinux


%if 0%{?with_selinux}
%files selinux
%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name}
%endif # if with_selinux

Building a Package with an SELinux Product Policy

Setting Booleans During an Product Policy Installation

In some cases, it is necessary to enable or disable some booleans defined in a system security policy. This change should be done during the installation phase of the SELinux product package and it should also follow a couple of rules.

Setting generic booleans can open security holes in the system.

To change system booleans, use the following steps:

  • Find a boolean that fits your needs best. Try to avoid generic booleans, which allow many things and their change could bring security holes to the system.

  • Specify booleans in the following format in the .spec file:

    # default boolean values need to be changed due to product policy
    # the change is performed by "%selinux_set_booleans" macro in %post phase
    %global selinuxbooleans booleanname=1 booleanname2=0
  • It is necessary to use special macro _%selinux_set_booleans during "%post" phase of rpmbuild to make sure that the specified boolean values are set.

See the following example:

%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.bz2
%selinux_set_booleans -s %{selinuxtype} %{selinuxbooleans}

%selinux_modules_uninstall -s %{selinuxtype} %{modulename}
%selinux_unset_booleans -s %{selinuxtype} %{selinuxbooleans}

The boolean macros mentioned above behave as follows:

  • The value of each boolean set using "%selinux_set_booleans" is recorded and will be reset to the original value when "%selinux_unset_booleans" is called
  • Number of calls to "%selinux_set_booleans" and "%selinux_unset_booleans" has to match in order for this mechanism to work properly

Port Labeling

If your product policy does not define port labels (such as "product_port_t"), you can skip this section.

You should assign a port number and a port type to every port label. Assigning a port label should be done in %post install phase. For example, for the TCP 1111 port, the semanage port -a -t product_port_t -p tcp 1111 command should be added to the if statement in the .spec file:

if %{_sbindir}/selinuxenabled ; then
     %{_sbindir}/semanage port -a -t product_port_t -p tcp 1111

Where the a, t, and p of the semanage command mean the following:

-a   Add a record of the specified object type
-t   SELinux type for the port
-p   Protocol  for  the  specified  port  (tcp|udp)

For the %post uninstall phase, the port assignment should be removed. To do this, add the semanage port -d -t <PORT> command in your .spec file. For example:

if %{_sbindir}/selinuxenabled ; then
    %{_sbindir}/semanage port -d  -p tcp -t product_port_t

Removing your Product Policy from the System Policy

When your own product SELinux subpackage is ready for a release, contact the SELinux policy maintainer. He should remove the product policy from the SELinux distribution policy and update the package. You should then add a dependency on the new selinux-policy package:

# Version of selinux-policy when product policy was removed
%global selinux_policyver POLICY_VERSION
Requires: selinux-policy >= %{selinux_policyver}

If the released policy was not part of the distribution policy, there is no need to add a version dependency to your .spec file.

Now your SELinux subpackage is ready for release. It is recommended to create a group update together with selinux-policy package to ensure that the updating process will be successful.


SELinux in general

Why is SELinux useful