SELinux Denial Troubleshooting
Not a separate objective, and what the other five are really testing. An AVC record names the process type, the target type and the operation, and those three decide which of the three fixes applies. The guide opens with ausearch -m AVC returning nothing on a machine with sixteen denials in its audit log.
Security and SELinux Guide 60 of 67 Advanced
- OSRHEL 10.0
- Kernel6.12.0-55.9.1.el10_0
- dnf4.20.0
- Flatpak1.16.0
- TimeAbout 15 min
ausearch -m AVC found nothing on this machine while the denials were plainly in /var/log/audit/audit.log. --input-logs makes it read the on-disk logs and returns all of them. Since "run ausearch -m AVC" is the standard advice, an empty result reads as "no denial happened" - which is the worst possible wrong conclusion.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| RHCSA-A01 | 192.168.0.31 | RHEL 10.0 | Practice node (graded) - spare /dev/sda | 2 Core | 4 GB | 50 GB + 15 GB |
This guide includes
Use this because it is what the other five SELinux objectives are really testing. This matters because the search that should find a denial often returns nothing - and the suggested fix arrives with a trap attached.
- running the search that returns nothing, and understanding why
- reading the four fields that identify a denial
- reading the suggested fix, and its trap
Before you start
- A sudo-capable account and a denial to look at.
- This guide reads the audit log; it changes nothing.
-
The search that returns nothing
-
The four fields
-
The suggestion, and its trap