SELinux Cookbook

Ignoring permissions we don't need

After repeated testing, we will have a policy that works, even though denials might still show up in the audit logs. In order not to alarm any administrator, we might want to disable auditing of those specific denials (while, of course, ensuring that critical access vectors are still logged by the audit daemon).

How to do it…

In order to disable logging of certain denials that do not influence an application's behavior, trigger the denial and then register the dontaudit statements as explained in the following steps:

1. For each denial shown in the audit logs, we need to find the corresponding dontaudit rule set. Consider the following instance:

   type=AVC msg=audit(1398936489.877:2464): avc: denied { search } for pid=8241 ...