Add custom policies

To add custom rules to your configuration, create a new policy package for those rules and then add them to Splunk Enterprise. Do not modify the existing Splunk policy package files.

To create and install a new policy package:

1. . Temporarily set SELinux to "Permissive" mode:

   setenforce 0

2. Create policy package files using the sepolgen command. This creates three files: *.fc, *.if, *.te:

   package into .pp 

3. Install the policy package:

   semodule –i *.pp

4. Review the audit log to ensure there are no relevant denials:

   type=AVC 

5. If there are any denials, convert them to allow rules for the Type Enforcement definition file (*.te), for example in grep denies "/vr/log/audit/audit.log:

   grep "denied" /var/log/audit/audit.log | audit2allow

6. Once there are no denial messages set SELinux back to "Enforced"

   setenforce 1

7. Restart Splunk Enterprise:

   service splunk restart