What does “Invalid AVC allowed in current policy” mean?

Question

I was looking into my selinux alert logfile and running over multiple entries labeled

**** Invalid AVC allowed in current policy ***

I understand that this signals a problem (on read or getattr etc.) and I see which processes cause it, but what I do not understand is the label.

What is an Invalid AVC? And how can it be allowed?

Answer 1

In the source for setroubleshoot, you can see that this is where the error comes from:

self.why, bools = audit2why.analyze(str(self.scontext), str(self.tcontext), str(self.tclass), self.access)
    if self.why == audit2why.ALLOW:
        raise ValueError(_("%s \n**** Invalid AVC allowed in current policy ***\n") %  self.avc_record)

This code suggests that the message is prepended by self.avc_record. I don't have a lot of time right now, but as the method this code is in is called derive_avc_info_from_audit_event, I am guessing this means an audit.log message is not correctly parsed into AVC information.

The messages in the rest of the if ... else block suggest this could be caused by a bug in the policy.

Maybe you can post the complete error: I haven't seen this before and knowing the exact output might help shedding some light onto it.