I'm unable to remove an SELinux policy

Ask Fedora
,
1

Problem

sudo semodule -l | grep my-RenderThread returns:

my-RenderThread

However, sudo semodule -r my-RenderThread returns:

libsemanage.semanage_direct_remove_key: Unable to remove module my-RenderThread at priority 400. (No such file or directory).
semodule:  Failed!

How? Why?

Context

image
image1352Ă—779 74.3 KB

2

Try

sudo semodule -lfull | grep my-RenderThread

It could be it wasn’t installed at priority 400 in which case you might need the -X option for semodule -r. Run man semodule` for the options.

3

@vekruse, yeah, it was installed at P300 (sealert’s default):

300 my-RenderThread                        pp

I’ve tried sudo semodule -r my-RenderThread -X 300, but see:

libsemanage.semanage_direct_remove_key: Unable to remove module my-RenderThread at priority 400. (No such file or directory).

4

From the man page on F42:

       -X,--priority=PRIORITY
              set priority for following operations (1-999)

So you may need to try sudo semodule -X 300 -r my-RenderThread instead

1 Like
5

@tswsl1989, thank you! That works:

libsemanage.semanage_direct_remove_key: Removing last my-RenderThread module (no other my-RenderThread module exists at another priority).

However, isn’t that merely a reorganisation of what I previously attempted?

6

It is, but the word on the man page that stood out to me is “following”.

It looks like you can chain multiple actions with different priorities between them in a single call to semodule.

1 Like
7

Does anyone know whether I need to retain the generated files in $HOME?

  1. #!/usr/bin/env sh
tree $HOME -L 1 | grep -E '\.pp|\.te'

  2. ├── emulator_execheap.pp
├── emulator_execheap.te
├── my-RenderThread.pp
├── my-RenderThread.te
├── my-rpcvirtqemud.pp
└── my-rpcvirtqemud.te

I’d like to rm them.