I kept getting the following notice in apache /var/log/messages and many others same messages :

kernel: type=1400 audit(1422862414.790:3222): avc: denied { getattr } for pid=2484 comm="deliver" path="/var/panel/sieve/globalfilter.sieve" dev=dm-0 ino=659172 scontext=system_u:system_r:dovecot_deliver_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=lnk_file
Kernel : type=1400 audit(1422862549.898:3244): avc: denied { getattr } for pid=2320 comm="httpd" path="/var/panel/hostdata/admin/public_html/Mywebsite_com$$ai_com/admin/ajax.php" dev=dm-0 ino=5625763 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
kernel: type=1400 audit(1422862414.813:3229): avc:  denied  { lock } for  pid=2484 comm="deliver" path="/var/panel/vmail/website.com/fail2ban/dovecot.index" index" dev=dm-0 ino=787081 scontext=system_u:system_r:dovecot_deliver_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
kernel: type=1400 audit(1422863078.135:3252): avc: denied { write } for pid=2740 comm="pop3" name="cur" dev=dm-0 ino=3794960scontext=system_u:system_r:dovecot_t:$cot_t:s0tcontext=system_u:object_r:var_t:s0 tclass=dir

I lately installed SELinux permissive mode , Help would be appreciates ..


  • how do you tryied to fix it?
    – c4f4t0r
    Feb 2, 2015 at 8:23
  • "chcon -t public_content_t '/var/panel/hostdata/admin/public_html/Mywebsite_com$$ai_com/admin/ajax.php'" but didn't help Feb 2, 2015 at 10:51
  • Are you using some kind of web control panel? Feb 2, 2015 at 16:06
  • Yes I am using Zpanel "var/panel/hostdata/admin/public_html/Mywebsite_com$$ai_com" Feb 2, 2015 at 16:29

1 Answer 1


If you wish to translate this message into more human readable text, try to use

audit2allow -w -a

Then - you can use

audit2allow -a -M mymodule

to automate create of selinux module which allow this type of activity, and then

semodule -i mymodule.pp

to install it into selinux.

  • 'audit2allow -w -a' Returned <no matches> cd /var/log tail messages | audit2allow #============= ftpd_t ============== #!!!! This avc can be allowed using one of the these booleans: # allow_ftpd_full_access, ftpd_connect_db allow ftpd_t mysqld_db_t:dir search; #!!!! This avc can be allowed using one of the these booleans: # allow_ftpd_full_access, ftpd_connect_db allow ftpd_t mysqld_var_run_t:sock_file write; #============= httpd_t ============== Feb 2, 2015 at 11:38
  • logs to audit are usually in /var/log/audit/audit.log
    – undefine
    Feb 2, 2015 at 12:22
  • I try to create module but I have the following problem : '# audit2allow -a -M dovecot_t <no matches> compilation failed: dovecot_t.te:6:ERROR 'syntax error' at token '' on line 6: /usr/bin/checkmodule: error(s) encountered while parsing configuration /usr/bin/checkmodule: loading policy configuration from dovecot_t.te ' Feb 2, 2015 at 12:31
  • show /var/log/audit/audit.log - there should be info needed to create selinux module.
    – undefine
    Feb 2, 2015 at 12:48
  • the /var/log/audit/audit.log in empty Feb 2, 2015 at 12:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.