selinux-knowledge-patch

What problem does it solve?

This skill provides concise, post-training-cutoff guidance for SELinux policy development and container policy generation to prevent outdated or incorrect policy use that can cause permission failures or insecure allowances.

Core Features & Use Cases

• CIL policy guidance: Explains modern S-expression CIL syntax, block namespacing, and blockinherit patterns for migrating from M4-based policies.
• Container policies with udica: Shows how to generate tailored CIL container policies from container inspection output and install them alongside udica templates.
• Kernel policy extensions: Documents allowxperm netlink message filtering, policycap requirements, and default object rules for recent kernels.
• Use Case: Generate a CIL policy for a container that exposes network interfaces and mounts, install it with semodule, and apply the policy type when launching the container to avoid AVC denials.

Quick Start

Generate a CIL policy for the specified container from its inspection output and provide the semodule installation steps and recommended udica templates.