Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Have setup a special logging directory for MySQL logs. This required me to run the command

grep mysqld /var/log/audit/audit.log | audit2allow -M mypol

a number of times to authorize MySQL to search, open, write etc in the MySQL log directory.

The final result was a mypol.te file that looks like this:

module mypol 1.0;

require {
    type mysqld_log_t;
    type mysqld_t;
    class dir { write search read remove_name open add_name };

#============= mysqld_t ==============
allow mysqld_t mysqld_log_t:dir open;
#!!!! This avc is allowed in the current policy

allow mysqld_t mysqld_log_t:dir { write remove_name search read add_name };

However I want to use the semanage command in a script to do this automatically in future builds.

Wondering how I can convert the above mypol.te into a set of semanage commands?

share|improve this question
What is your reason to use semanage for this instead of compiling and loading the resulting se-module? – Nils Nov 9 '12 at 15:41
My bash script installs MySQL, creates the logging directory, creates MySQL users, sets permissions, and does some basic SELinux permissions that I have been able to work out, as well as other sundry tasks. It will be much more efficient if I can do everything in the one script rather than doing some things in a script and then have to copy a policy file to the server as well. – Eureka Ikara Nov 10 '12 at 2:30
continuing from last comment: From the Fedora SELinux documentation I have been able to work out certain commands that I have needed to do such as: code semanage fcontext -a -t mysqld_log_t '/var/log/mysql(/.*)?' code If there is a way to add permissions for searching etc, everything will be in a single script. – Eureka Ikara Nov 10 '12 at 2:40
I still do not understand. I hope you do these installation tasks by building a RPM. So it would not be a big problem to put into that RPM a policy file and install that via post-install-script (the same post install will install your users, while creating directories and settings permissions is a typical rpm-installation-task...). Apart from I do not think that there is a general solution for your problem, since - according to the man-page - semanage handles only a subset of what policies can do. – Nils Nov 11 '12 at 20:56
Your suggestion to package everything up in an RPM is interesting. I have always found RPM how to documentation very poor as it makes so many assumptions. Any references for how I would turn my pot pourri of bash scripts into RPMs would be useful. – Eureka Ikara Nov 13 '12 at 22:33
up vote 1 down vote accepted

Ok - this is not right on target, but you may achieve your goal by building a RPM. Since you can write shell-scripts, you will not have a problem with RPMs.

Your target is to install mySQL and do some post-installation tasks like addings users, and adding a SELinux-policy.

I will try to outline a generic receipe. You can find a better overview about building rpms here.

  1. Grab your flavour of mySQL from the mirror of mysql-sources - go for the src.rpm version, download it.
  2. install that src.rpm - this will give you a SPEC-file to start with (and it will install the sources for mySQL as well - ready for compilation)
  3. Include your SEPolicy-file into the source-section
  4. In the %configure Section you can set your specific configure-options - like you would do on a
  5. Modify the %build section so that "your" directories get created there, also compile your SEPolicy at that point
  6. Install the needed users/groups in the %post-section - do not forget the case where these may already be installed - in the %post-section do the activation of the compiled SELinux-policy
  7. Include the built Module in the %install - section, as well as "your" special directories

Once you have made your first RPM - the next ones will be easy. But perhaps you should make this a question of its own. I did not find a good one on UL.

share|improve this answer
Thank you. I will give RPM a try. The Tom Callaway slides give me new hope. – Eureka Ikara Nov 15 '12 at 0:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.