I do test driven development where all my APIs are tested with a batch of tests. Initially, I ran the tests in ‘permissive’ mode in selinux. So, I decided to enable selinux to ‘enforcing’ mode. Obviously, I started getting AVC denials in the audit.log and half of the tests were failing. So, I used audit2allow to create a module for all the failed stuff (many denials) in the audit.log and did semodule –i to incorporate the new module into the kernel. However there are a few tests that are still failing in permissive mode but it’s not writing what’s wrong to either the audit.log or messages file, so I’m clueless on fixing this. When I put the server in ‘permissive’ mode, the tests that failed in ‘enforcing’ mode now works flawlessly. How do I go about troubleshooting this?
You need to disable the
dontaudit rules. You can do that using
From the manpage:
Disable/Enable dontaudit rules in policy semanage dontaudit [-S store] [ on | off ]
You can also rebuild the whole policy without dontaudit rules, but that's possibly not what you want. The procedure is explained in detail in the Fedora documentation, and mentioned in the
You can also search for
dontaudit in specific modules using