audit2allow

Generate SELinux policy allow rules from audit logs. tldr-pages

On Linux

Linux

Generate SELinux policy allow rules from audit logs. Part of the policycoreutils-python-utils package.

Generate allow rules from recent audit denials and display them

sudo audit2allow --allIdentify

Generate allow rules from a specific audit log file

sudo audit2allow --input path/to/audit.logIdentify

Generate a policy module from recent audit denials

sudo audit2allow --all --module module_nameIdentify

Explain why SELinux denials occurred (same as audit2why)

sudo audit2allow --all --whyIdentify

Display detailed information around generated messages

sudo audit2allow --all --explainIdentify

Use installed macros to generate a reference policy

sudo audit2allow --all --referenceIdentify

Generate allow rules for a specific service

sudo ausearch --message avc --comm service_name | audit2allow --module policy_nameIdentify

Enable verbose output mode

sudo audit2allow --all --verboseIdentify