I've setup an application called altermime (http://www.pldaniels.com/altermime/) for postfix (SMTP server) which alters emails midstream. I'm injecting a X-ListUnsubscribe  header into every email message sent from our server for spam reasons.Altermime needs to be able to write to /var/spool/filter (normally I think postfix writes to /var/spool/postfix). Anyway this all works fine with SELinux disabled but with it enabled it breaks.As tempting as it might be to simply turn off SELinux and be done with it, I'd rather not compromise the security of my box in that manner. So I'm trying to modify SELinux to so that writing to /var/spool/filter is allowed.I've tried:  cat /var/log/audit/audit.log | audit2why Which shows me the exceptions (I'll include them below). And I've done this multiple times: audit2allow -M altermime < /var/log/audit/audit.log semodule -i altermime.ppHowever that doesn't seem to work. I'm assuming it may be because the audit2allow is naming individual files (/var/spool/filter/xxxx) being blocked vs the entire directory (/var/spool/filter/*). I can't figure out how to create a policy or change SELinux to allow access.Can some SELinux Guru help me? :)Here is an excerpt of my audit2why:type=AVC msg=audit(1409231063.712:263024): avc:  denied  { add_name } for  pid=21280 comm=disclaimer name=in.21279 scontext=unconfined_u:system_r:postfix_pipe_t:s0 tcontext=unconfined_u:object_r:var_spool_t:s0 tclass=dir    Was caused by:            Missing type enforcement (TE) allow rule.            You can use audit2allow to generate a loadable module to allow this access.type=AVC msg=audit(1409231065.905:263025): avc:  denied  { add_name } for  pid=21285 comm=disclaimer name=in.21284 scontext=unconfined_u:system_r:postfix_pipe_t:s0 tcontext=unconfined_u:object_r:var_spool_t:s0 tclass=dir    Was caused by:            Missing type enforcement (TE) allow rule.            You can use audit2allow to generate a loadable module to allow this access.type=AVC msg=audit(1409231067.380:263026): avc:  denied  { add_name } for  pid=21289 comm=disclaimer name=in.21288 scontext=unconfined_u:system_r:postfix_pipe_t:s0 tcontext=unconfined_u:object_r:var_spool_t:s0 tclass=dir    Was caused by:            Missing type enforcement (TE) allow rule.            You can use audit2allow to generate a loadable module to allow this access.
Altermime and SELINUX
postfix;selinux;smtp
I'm going to answer my own question. First I did the following:semodule -l | grep mymodulename(Replace mymodulename with any previous modules you may have imported). Skip this step if you haven't previously imported any modules. Then run this command to remove any previously imported modules. Again skip this step if you haven't imported any previous modules.semodule -r names_of_modules_returned_from_prior_commandWe should now be back at a clean slate.Next run the following to set selinux to permissive (monitor/log but don't block):setenforce 0Do getenforce and make sure it returns: permissiveRun the following command to clear the SELinux log:echo  >/var/log/audit.logWAIT AT LEAST 15-20 minutes for selinux to create new log entries in /var/log/audit/audit.logThen run the following command to create a comprehensive selinux policy:cat /var/log/audit/audit.log | audit2allow -m yourname >yourname.teThen run the following command which I believe checks the .te file and creates a .mod file(?)checkmodule -M -m -o yourname.mod yourname.teNext compile the .mod file into a binary .pp file with the following command: semodule_package -m yourname.mod  -o yourname.ppFinally install the module: semodule -i yourname.ppMonitor the /var/log/audit/audit.log for awhile and ensure no new entries show up.cat /var/log/audit/audit.log | audit2whyIf no new entries show up set selinux back to enforcing:setenforce 1That seemed to work for me. It may be a bit more permissive than needed but at least I'm not turning SELinux off entirely.Hopefully this helps someone else.ThanksBrad