SELinux Denial Troubleshooting
Not a separate objective, and what the other five are really testing. An AVC record names the process type, the target type and the operation, and those three decide which of the three fixes applies. The guide opens with `ausearch -m AVC` returning nothing on a machine with sixteen denials in its audit log.
Security and SELinux Guide 60 of 67 Advanced
- OSRHEL 10.0 (Coughlan)
- Kernel6.12.0-55.9.1.el10_0
- dnf4.20.0
- Flatpak1.16.0
- TimeAbout 15 min
- Reviewed23 August 2026
Written against the versions above. **`ausearch -m AVC` found nothing on this machine while the denials were plainly in `/var/log/audit/audit.log`.** `--input-logs` makes it read the on-disk logs and returns all of them. Since "run `ausearch -m AVC`" is the standard advice, an empty result reads as "no denial happened" - which is the worst possible wrong conclusion.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| RHCSA-A01 | 192.168.0.31 | RHEL 10.0 (Coughlan) | Practice node (graded) - spare /dev/sda | 2 Core | 4 GB | 50 GB + 15 GB |
Before you start
- A sudo-capable account and a denial to look at.
- This guide reads the audit log; it changes nothing.
-
The search that returns nothing
-
The four fields
-
The suggestion, and its trap