> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/onboarding-in-cortex-xsoar/podman/configure-the-selinux-policy-for-powershell-integrations.md).

# Configure the SELinux Policy for PowerShell Integrations

The SELinux Policy is a set of rules that guides the SELinux security engine, and defines types for file objects and domains for processes. When running in rootless mode, the default SELinux policy used by Podman may affect processes that mmap **`/dev/zero`**, which may affect running PowerShell integrations.

PowerShell integrations mmap **`/dev/zero`** as part of the .NET Core PInvoke capabilities.

To see whether PowerShell integrations can run in Cortex XSOAR, type the following command:

**`!pwsh script="$demisto.results('ok')"`**

If the SELinux policy blocks the mapping of **`/dev/zero`** an error is issued about **`OutOfMemoryException`**. For example, in the playground, you can see the error:

![podman-error.png](/files/O2uKOd3vVhcMorKnb8Wg)

You need to configure the policy module and then reset the containers. If you use engines with Podman, you need to apply the policy configuration on each engine machine.

{% hint style="info" %}

### Note

PowerShell integrations use an internal socket which may be blocked by SELinux depending upon the container-selinux version installed. It is recommended to use version 2.144.0 or higher for the container-selinux. To upgrade to the latest container-selinux run the \*\*`sudo yum update container-selinux` \*\*command.
{% endhint %}

1. Fix the SELinux policy by installing the SELinux policy module.
   1. In the Cortex XSOAR Server, create the following file:

      **`podman_rootless.te`**
   2. Add the following content:

      ```screen
      module podman_rootless 1.0;

      require {
          type zero_device_t;
          type container_t;
          class chr_file execute;
      }

      #============= container_t ==============
      allow container_t zero_device_t:chr_file execute;
      ```
   3. After running a PowerShell integration in Cortex XSOAR, generate the SELinux policy using the **`audit2allow`** tool by running the following command:

      **`sudo grep pwsh /var/log/audit/audit.log | audit2allow -m podman_rootless`**
   4. Compile the policy module by running the following commands:
      * **`checkmodule -M -m -o podman_rootless.mod podman_rootless.te`**
      * **`semodule_package -o podman_rootless.pp -m podman_rootless.mod`**
   5. Install the policy module by running the following command:

      **`sudo semodule -i podman_rootless.pp`**
2. Add server configurations and reset the containers in Cortex XSOAR.

   Configure label confinement to allow Python and PowerShell containers to access other script folders.

   1. In Cortex XSOAR Settings → Troubleshooting → **Server Configuration**, set the following parameters:
      * For Python containers, set **python.pass.extra.keys** to **`--security-opt=label=level:s0:c100,c200`**
      * For PowerShell containers, set **powershell.pass.extra.keys** to **`--security-opt=label=level:s0:c100,c200`**
   2. In the Cortex XSOAR CLI, run the **`/reset_containers`** command.
3. Test the PowerShell script by running the following command:

   **`!pwsh script="$demisto.results('ok')"`**


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/onboarding-in-cortex-xsoar/podman/configure-the-selinux-policy-for-powershell-integrations.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.