Important Notice: Our web hosting provider recently started charging us for additional visits, which was unexpected. In response, we're seeking donations. Depending on the situation, we may explore different monetization options for our Community and Expert Contributors. It's crucial to provide more returns for their expertise and offer more Expert Validated Answers or AI Validated Answers. Learn more about our hosting issue here.

I get a specific permission denial only when SELinux is in enforcing mode, but I don see any audit messages in /var/log/messages. How can I identify the cause of these silent denials?

April 26, 2017audit denial enforcing log Messages mode permission SELinux var

0

Posted

I get a specific permission denial only when SELinux is in enforcing mode, but I don see any audit messages in /var/log/messages. How can I identify the cause of these silent denials?

1 Answer

0

Posted

The most common reason for a silent denial is when the policy contains an explicit dontaudit rule to suppress audit messages. The dontaudit rule is often used this way when a benign denial is filling the audit logs.