SELinux custom policy troubleshooting notes

category: notez · date: 2018-01-01 · author: LALA

noteHistorical technical note from 2018. Environment-specific identifiers and credentials have been anonymized. Commands reflect the technology and operating-system generation used at the time and should be reviewed before reuse on a current system.

These were working notes for diagnosing SELinux denials affecting services such as Dovecot and systemd-machined. What is kept here is the policy-development workflow; generated rules from the old environment are not reproduced because they were specific to its labels and services.

Recommended troubleshooting flow

Reproduce the denied operation, then inspect recent AVC records:

bash

$ ausearch -m AVC,USER_AVC -ts recent

Use audit2why to understand the denial:

bash

$ ausearch -m AVC -ts recent | audit2why

audit2allow can suggest policy, but its output is not automatically correct:

bash

$ ausearch -m AVC -ts recent | audit2allow -R

Review the suggested interfaces and permissions before adding them.

Check labeling first

A denial involving generic types such as default_t is often a sign of mislabeling. Inspect:

bash

$ ls -lZ /path/to/object
$ matchpathcon /path/to/object

Define persistent corrections with semanage fcontext, then apply with restorecon.

Avoid the automatic-fix anti-pattern

Do not pipe an audit log into audit2allow -M and immediately install the generated module. It can grant permissions caused by bad labels, unrelated historical events or an application bug.

References

Red Hat - Writing a custom SELinux policy: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/using_selinux/writing-a-custom-selinux-policy_using-selinux
SELinux Project: https://selinuxproject.org/

Current practice (checked 2026-10)

noteThe article above is kept as it was written in 2018. This section lists what has changed since and what to do instead today.

Still valid: the flow above (check labels first, read audit2why, treat audit2allow output as a suggestion) is what the current Red Hat documentation recommends; it states that audit2allow should not be the first option when a denial appears.
Message types: search for AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR, not only AVC records.
sealert: where the setroubleshoot packages are installed, sealert -l "*" prints each denial with an analysis and a proposed fix, and journalctl -t setroubleshoot shows the same events when auditd is not running.
Hidden denials: if the operation fails without any AVC, a dontaudit rule is hiding it. Disable those rules temporarily with semodule -DB, reproduce, then restore them with semodule -B.

Sources: