[root@metroid local]# rpm -qf $(which audit2allow) policycoreutils-1.33.2-2.fc6 [root@metroid local]# grep nethack /var/log/audit/audit.log | tail -n1 | audit2allow -M nethack-prelink Generating type enforcment file: nethack-prelink.te Compiling policy checkmodule -M -m -o nethack-prelink.mod nethack-prelink.te /usr/bin/audit2allow: (unknown source)::ERROR 'syntax error' at token 'nethack-prelink' on line 1: checkmodule: error(s) encountered while parsing configuration checkmodule: loading policy configuration from nethack-prelink.te Using "nethack_prelink" instead works fine. A more useful error message for checkmodule would suggest using a different filename. Also, audit2allow should probably refuse to create a module with a dash in the name.
I have changed audit2allow to generate an error on an invalid module name. Fixed in policycoreutils-1.33.4-2.fc6