In this lesson, you will learn how to systematically identify and resolve security denials using system audit logs rather than resorting to the dangerous practice of disabling your security modules.
When a Mandatory Access Control (MAC) system like SELinux or AppArmor blocks an action, it is often tempting to switch the system into permissive or complain mode to "see if that fixes it." This practice compromises your entire security posture. Instead, we use the audit subsystem to capture exactly what was denied and why.
Interpreting the Audit Trail
When a service is denied access to a file or socket, the kernel logs a message. On most systems, these are stored in /var/log/audit/audit.log or captured by journalctl.
If you are using SELinux, the most powerful tool for interpretation is ausearch. You can filter for the most recent denials by running:
ausearch -m avc -ts recent
This command pulls the Access Vector Cache (AVC) denials—the specific "no" granted by the security policy. Each message provides the scontext (the security context of the process), the tcontext (the security context of the target), and the tclass (the type of object being accessed, such as a file or directory).
Pinpointing Policy Gaps
Once you have identified the denial, you don't need to guess how to fix it. Tools like audit2allow translate these logs into human-readable policy suggestions.
For example, if a web server is denied access to a custom log directory, you would pipe the specific audit message into audit2allow:
grep "denied" /var/log/audit/audit.log | audit2allow -w
This will show you exactly what rule is missing. Instead of disabling the security module, you use these findings to generate a targeted policy module that authorizes only the required operation. By isolating the denial in the logs, you transform a blind trial-and-error process into a surgical policy update that maintains the integrity of your security hardening.
Key Takeaway: Never disable security to troubleshoot; use ausearch to extract the AVC denial, analyze the missing access vector, and authorize only the specific transition needed.