I'd like to create a new context from my SELinux module (written using the CIL syntax) that will then beu sed for my application's log file so logrotate can access it. However, when I try to semodule -i a file with the following contents:

(type indico_log_t)
(typeattributeset file_type (indico_log_t))
(typeattributeset logfile (indico_log_t))

(filecon "/opt/indico/log/.*\.log" any (system_u object_r indico_log_t ((s0)(s0))))

I get this error:

Type indico_log_t is invalid for role object_r
Invalid context
Invalid filecon at /etc/selinux/targeted/tmp/modules/400/indico-new/cil:5
Failed to verify cil database
Failed to verify cil database
semodule:  Failed!

Am I doing anything wrong? Is there a different way of creating a new type that can be used for a file?

FWIW, if I remove the last line I can install the module, but chcon doesn't accept the type (chcon: invalid context: indico_log_t).

1 Answer 1


You need to use roletype to allow a type to be associate with a role.

(roletype object_r indico_log_t)
  • Indeed, that solved it. Someone in #selinux on IRC had suggested the same and it worked fine, but I had completely forgotten about this question here. Commented Aug 21, 2017 at 14:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .