DOT-Files/Gentoo/gentooamd/home/user/.tldrc/tldr/pages/linux/audit2allow.md

audit2allow

Generate SELinux policy allow rules from audit logs. Part of the policycoreutils-python-utils package. See also: audit2why, ausearch, semodule. More information: https://manned.org/audit2allow.

• Generate allow rules from recent audit denials and display them:

sudo audit2allow {{[-a|--all]}}

• Generate allow rules from a specific audit log file:

sudo audit2allow {{[-i|--input]}} {{path/to/audit.log}}

• Generate a policy module from recent audit denials:

sudo audit2allow {{[-a|--all]}} {{[-M|--module]}} {{module_name}}

• Explain why SELinux denials occurred (same as audit2why):

sudo audit2allow {{[-a|--all]}} --why

• Display detailed information around generated messages:

sudo audit2allow {{[-a|--all]}} {{[-e|--explain]}}

• Use installed macros to generate a reference policy:

sudo audit2allow {{[-a|--all]}} {{[-R|--reference]}}

• Generate allow rules for a specific service:

sudo ausearch {{[-m|--message]}} avc {{[-c|--comm]}} {{service_name}} | audit2allow {{[-M|--module]}} {{policy_name}}

• Enable verbose output mode:

sudo audit2allow {{[-a|--all]}} {{[-v|--verbose]}}