In this lesson, you will learn how to configure your system audit logs to capture denied access requests, providing the visibility necessary to validate your security policies.
When you implement Mandatory Access Control (MAC) systems like SELinux or AppArmor, the primary mechanism for verifying your rules is the audit log. By default, these systems log "denials"—instances where a process tried to perform an action that violated the security policy. However, to effectively use these logs for troubleshooting or compliance, you need to ensure they are captured reliably and are readable.
Understanding the Denial Stream
In SELinux, for example, access denials are logged by the Linux Audit Framework (auditd). When a process is blocked, the kernel generates an AVC (Access Vector Cache) message. You can find these in /var/log/audit/audit.log or by using the ausearch utility.
To validate your policy, you must look for the denied keyword. A typical entry looks like this:
type=AVC msg=audit(1672531200.123:456): avc: denied { read } for pid=1234 comm="httpd" name="secret.conf" dev="sda1" ino=98765 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=0
Validating with ausearch
Rather than parsing raw files, use ausearch to filter these events. To specifically isolate denied requests from the last hour, run:
ausearch -m AVC -ts recent -i
This command focuses on AVC messages and interprets them into a human-readable format. If you notice a high volume of denials for a specific service, it indicates that your security context labels (the "Security Labels" we discussed in lesson 22) or your path-based AppArmor profiles are too restrictive for the legitimate function of that application.
By analyzing these logs, you aren't just troubleshooting errors; you are validating that your enforcement mode (introduced in lesson 24) is behaving exactly as intended, ensuring that your system security hardening is functional without breaking core application operations.
Key Takeaway: Security policy validation relies on auditing denied access events to distinguish between legitimate system blockages and overly restrictive policy definitions.