I'd like to create a new context from my SELinux module (written using the CIL syntax) that will then beu sed for my application's log file so logrotate can access it. However, when I try to
semodule -i a file with the following contents:
(type indico_log_t) (typeattributeset file_type (indico_log_t)) (typeattributeset logfile (indico_log_t)) (filecon "/opt/indico/log/.*\.log" any (system_u object_r indico_log_t ((s0)(s0))))
I get this error:
Type indico_log_t is invalid for role object_r Invalid context Invalid filecon at /etc/selinux/targeted/tmp/modules/400/indico-new/cil:5 Failed to verify cil database Failed to verify cil database semodule: Failed!
Am I doing anything wrong? Is there a different way of creating a new type that can be used for a file?
FWIW, if I remove the last line I can install the module, but
chcon doesn't accept the type (
chcon: invalid context: indico_log_t).