Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was looking into my selinux alert logfile and running over multiple entries labeled

**** Invalid AVC allowed in current policy ***

I understand that this signals a problem (on read or getattr etc.) and I see which processes cause it, but what I do not understand is the label.

What is an Invalid AVC? And how can it be allowed?

share|improve this question
up vote 1 down vote accepted

In the source for setroubleshoot, you can see that this is where the error comes from:

self.why, bools = audit2why.analyze(str(self.scontext), str(self.tcontext), str(self.tclass), self.access)
    if self.why == audit2why.ALLOW:
        raise ValueError(_("%s \n**** Invalid AVC allowed in current policy ***\n") %  self.avc_record)

This code suggests that the message is prepended by self.avc_record. I don't have a lot of time right now, but as the method this code is in is called derive_avc_info_from_audit_event, I am guessing this means an audit.log message is not correctly parsed into AVC information.

The messages in the rest of the if ... else block suggest this could be caused by a bug in the policy.

Maybe you can post the complete error: I haven't seen this before and knowing the exact output might help shedding some light onto it.

share|improve this answer
Could be, I always updated the policy with suggestions from the plugins, now my sealerter doesn't work any longer so I'm pretty sure those automations have destroyed the policy. Maybe a reinstall of the system helps. – hakre Jul 3 '11 at 18:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.