5.2. Generating SELinux Policy Modules: sepolicy generate

In previous versions of Red Hat Enterprise Linux, the sepolgen or selinux-polgengui utilities were used for generating a SELinux policy. These tools have been merged to the sepolicy suite. In Red Hat Enterprise Linux 7, the sepolicy generate command is used to generate an initial SELinux policy module template.

Unlike sepolgen, it is not necessary to run sepolicy generate as the root user. This utility also creates an RPM spec file, which can be used to build an RPM package that installs the policy package file (NAME.pp) and the interface file (NAME.if) to the correct location, provides installation of the SELinux policy into the kernel, and fixes the labeling. The setup script continues to install SELinux policy and sets up the labeling. In addition, a manual page based on the installed policy is generated using the sepolicy manpage command. ^[7] Finally, sepolicy generate builds and compiles the SELinux policy and the manual page into an RPM package, ready to be installed on other systems.

When sepolicy generate is executed, the following files are produced:

If it is possible to generate an SELinux policy module, sepolicy generate prints out all generated paths from the source domain to the target domain. See the sepolicy-generate(8) manual page for further information about sepolicy generate.