Red Hat ENTERPRISE LINUX 4 - SELINUX GUIDE Manual

Also see for ENTERPRISE LINUX 4 - DEVELOPER TOOLS GUIDE: Installation guide Installation guide Tuning guide Installation guide Manual

Contents

Chapter 7.Compiling SELinux PolicyWarningThe commands and steps covered in this chapter may render your system inoperable or unable tobe supported.Nothing in this chapter should be performed on a production system without having been thoroughlytested in a development or sandbox environment first.If you are going to compile and install a custom policy, be prepared to take the actions you needto safeguard your data and installation. Proper backup procedures, change-reversal plans, and aninformed methodology are key to your success.This chapter covers the considerations and methods for compiling SELinux policy. Following instruc-tions on compiling SELinux policy, this chapter presents some reference information and considera-tions.7.1. Policy Compile ProcedurePolicy is usually compiled to enable a customization to take effect on your system. You may alsocompile policy under development, such as when working on writing a new policy or SELinux-awareapplication.When you install a new policy, you must eventually reboot to test that it works during system start-up.If the policy change is significant enough, such as installing an entirely new policy, you need to rebootto ensure all applications are running in the right context for the loaded policy. This is similar to anymajor configuration change under Linux; you want to be sure it works properly from system start-upon at least one production-equivalent machine.NotePolicy updates from Red Hat should not require a reboot after installation. If a reboot were required,that fact would be clearly noted in the package advisory.A reboot is required when the policy change is significantly different. For example, switching from thetargeted to the strict policy requires a reboot. Ordinary policy updates do not.To compile SELinux policy:Compiling the SELinux Policy1. cd /etc/selinux/targeted/src/policy/