Selinux政策 - 不工作

Question

每一天我有錯誤消息，因爲蛤蜊AV掃描 - 這是一個selinux問題 - 我已經有一個selinux模塊創建 - 但錯誤沒有解決。任何人都可以看看嗎？我認爲模塊應該允許寫入，讀取訪問clamscan的文件？

的SELinux錯誤：

Additional Information: 
Source Context    system_u:system_r:antivirus_t:s0-s0:c0.c1023 
Target Context    system_u:object_r:httpd_sys_rw_content_t:s0 
Target Objects    sess_604rv54bntl70jig0bjf1lfja4 [ file ] 
Source      clamscan 
Source Path     /usr/bin/clamscan 
Port       <Unknown> 
Host       myserver.com 
Source RPM Packages   clamav-0.99.1-1.el7.x86_64 
Target RPM Packages   
Policy RPM     selinux-policy-3.13.1-60.el7_2.3.noarch 
Selinux Enabled    True 
Policy Type     targeted 
Enforcing Mode    Enforcing 
Host Name      myserver.com 
Platform      Linux myserver.com 
          3.10.0-327.18.2.el7.x86_64 #1 SMP Thu May 12 
          11:03:55 UTC 2016 x86_64 x86_64 
Alert Count     94 
First Seen     2016-05-15 03:56:15 CEST 
Last Seen      2016-05-17 03:45:49 CEST 
Local ID      68ee97b8-2226-4481-97be-1eeccbb0e566 

Raw Audit Messages 
type=AVC msg=audit(1463449549.453:49931): avc: denied { read } for pid=9274 comm="clamscan" name="sess_604rv54bntl70jig0bjf1lfja4" dev="dm-1" ino=67123073 scontext=system_u:system_r:antivirus_t:s0-s0:c0.c1023 tcontext=system_u:object_r:httpd_sys_rw_content_t:s0 tclass=file 


type=SYSCALL msg=audit(1463449549.453:49931): arch=x86_64 syscall=open success=no exit=EACCES a0=7f16e0aee540 a1=0 a2=0 a3=fffffffffffffb85 items=0 ppid=9135 pid=9274 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5454 comm=clamscan exe=/usr/bin/clamscan subj=system_u:system_r:antivirus_t:s0-s0:c0.c1023 key=(null) 

Hash: clamscan,antivirus_t,httpd_sys_rw_content_t,file,read 

，這裏的政策：

module clamscanlocal 1.0; 

require { 
type antivirus_t; 
type httpd_sys_rw_content_t; 
type usr_t; 
class dir search; 
class file { write read getattr append }; 
} 

#============= antivirus_t ============== 

#!!!! This avc can be allowed using the boolean 'antivirus_can_scan_system' 
allow antivirus_t httpd_sys_rw_content_t:dir search; 

#!!!! This avc can be allowed using the boolean 'antivirus_can_scan_system' 
allow antivirus_t httpd_sys_rw_content_t:file getattr; 
allow antivirus_t usr_t:file { write read append }; 

Answer 1

爲什麼不乾脆讓布爾作爲創建策略由audit2allow輸出聲明呢？

setsebool -P antivirus_can_scan_system=on

良好的SELinux教程：https://wiki.gentoo.org/wiki/SELinux/Tutorials