Contents
How do I troubleshoot SELinux issues?
Troubleshooting SELinux AVC Messages on the Command Line
- Use the ausearch utility to find any recent AVC messages and confirm that SELinux denies the action:
- Use the journalctl utility to view more information about the AVC message:
- Use the sealert utility to further inspect the AVC message:
What is SELinux AVC denial?
SELinux decisions, such as allowing or disallowing access, are cached. This cache is known as the Access Vector Cache (AVC). Denial messages are logged when SELinux denies access. These denials are also known as “AVC denials”, and are logged to a different location, depending on which daemons are running: Daemon.
What is AVC denied in Android?
In easy words: it means that there is “someone” that has tried to “{read}” something but SELinux stops it because that App wasn’t found in the “trusted” list of SELinux.
How do I troubleshoot an error in SELinux?
To troubleshoot an error, click the troubleshoot button in the SELinux Alert browser. The browser will return available options for resolving the error and commands to run to fix the problem. Some troubleshooting events can be resolved by enabling a boolean switch policy.
Is there a way to silence AVC denials?
If SELinux is active and the Audit daemon is not running on your system, then search for certain SELinux messages in the output of the dmesg command: Even after the previous three checks, it is still possible that you have not found anything. In this case, AVC denials can be silenced because of dontaudit rules.
How to query audit logs in SELinux red?
To query Audit logs, use the ausearch tool. Because the SELinux decisions, such as allowing or disallowing access, are cached and this cache is known as the Access Vector Cache (AVC), use the AVC and USER_AVC values for the message type parameter, for example: If there are no matches, check if the Audit daemon is running.
What to do when your scenario is blocked by SELinux?
When your scenario is blocked by SELinux, the /var/log/audit/audit.log file is the first place to check for more information about a denial. To query Audit logs, use the ausearch tool.