SELinux

Monitoring SELinux

SELinux writes log entries that enable system administrators to monitor its operation. The following subsections explain the format of SELinux log messages, some logging subtleties, and how to use the Audit2allow utility to automatically generate rules to allow operations logged as denied.

SELinux Log Message Format

When a program attempts an operation that is checked by the SELinux security engine, SELinux may make a log entry. As more fully explained in Chapter 2, operations that are denied generally cause a log entry to be made, whereas permitted operations generally do not. However, SELinux policy rules can override this principle.

Apart from the timestamp and other information that accompanies every system log message, SELinux log messages have the following general format:

avc: result { operation } for pid=pid exe=exe path=opath dev=devno:ptno ino=node scontext=source tcontext=target tclass=class

Tip

A given SELinux log message may omit one or more of the attribute-value pairs given in the general format. Log messages include only the applicable attribute-value pairs.

The variable fields within the log message have the following meanings:

result

The value granted or denied, indicating whether SELinux permitted or prohibited the operation.

operation

The operation that was attempted, such as read or write. SELinux defines about 150 operations. Appendix B summarizes the SELinux operations that can appear in log messages.

pid

The process ID of the process that attempted ...