I'd like to create a new context from my SELinux module (written using the CIL syntax) that will then beu sed for my application's log file so logrotate can access it. However, when I try to semodule -i a file with the following contents:

(type indico_log_t)
(typeattributeset file_type (indico_log_t))
(typeattributeset logfile (indico_log_t))

(filecon "/opt/indico/log/.*\.log" any (system_u object_r indico_log_t ((s0)(s0))))

I get this error:

Type indico_log_t is invalid for role object_r
Invalid context
Invalid filecon at /etc/selinux/targeted/tmp/modules/400/indico-new/cil:5
Failed to verify cil database
Failed to verify cil database
semodule:  Failed!

Am I doing anything wrong? Is there a different way of creating a new type that can be used for a file?

FWIW, if I remove the last line I can install the module, but chcon doesn't accept the type (chcon: invalid context: indico_log_t).


You need to use roletype to allow a type to be associate with a role.

(roletype object_r indico_log_t)
  • Indeed, that solved it. Someone in #selinux on IRC had suggested the same and it worked fine, but I had completely forgotten about this question here. – ThiefMaster Aug 21 '17 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.