On 07/21/2018 10:20 PM, ToddAndMargo wrote:
On 07/21/2018 06:57 PM, Samuel Sieb wrote:
> This makes a rule for that specific PID which becomes invalid the next
> time it starts up. If you've been doing this regularly, I would
> suggest removing the old modules.
How do I do that? What modules are you speaking of?
You deleted the part I was quoting:
> I have an SE Linux alert that keeps coming back and back.
>
> # ausearch -c 'geoclue' --raw | audit2allow -M my-geoclue
> # semodule -X 300 -i my-geoclue.pp
>
> Gets rid of it for a day.
Actually, I think I'm wrong. From checking the man page, I see that
command should replace the previous version, so you only have one
installed. I think you can run "semodule -r my-geoclue" to remove the
module later. The "module" is the selinux policy module that you
created and installed with those commands.