audit2allow(1)
Generate SELinux policy allow rules from audit logs of denied access attempts.
Synopsis
audit2allow [-a] [-d] [-l] [-r] [-t type] [-M module_name] [-o output_file]Description
audit2allow generates SELinux policy allow rules by analyzing audit logs (typically from /var/log/audit/audit.log) that contain AVC (Access Vector Cache) denial messages. It converts these denials into corresponding policy rules that can be compiled and loaded to permit the blocked operations.
This tool is commonly used when SELinux denies legitimate application behavior. Instead of disabling SELinux entirely, you can use audit2allow to generate targeted policy rules that allow specific operations while maintaining overall system security.
The tool can output rules in human-readable format, generate loadable modules, or both. Generated modules can be compiled with checkmodule and semodule_package, then installed with semodule.
Common options
| Flag | What it does |
|---|---|
-a | Read input from audit daemon and analyze all current denials in the audit log |
-d | Use dmesg instead of audit log (for systems without auditd running) |
-l | List all possible avcs in the current policy. Useful for policy development |
-r | Remove an installed module (requires -M flag for module name) |
-M module_name | Create a compilable module with the given name; generates .pp policy package |
-o output_file | Write output to specified file instead of stdout |
-t type | Only process rules for the specified domain type |
-R | Generate reference policy rules (requires refpolicy installed) |
Examples
Analyze all denials in the audit log and print allow rules to stdout
audit2allow -aGenerate a compilable SELinux module named myapp_policy from audit denials
audit2allow -a -M myapp_policyRead denials from kernel dmesg (useful when auditd is not running)
audit2allow -dGenerate a module and immediately install it (after semodule_package compiles it)
audit2allow -a -M custom && semodule -i custom.ppWrite generated allow rules to a file for review before applying
audit2allow -a -o /tmp/rules.txtGenerate rules only for denials involving the httpd_t domain type
audit2allow -a -t httpd_tGenerate a module from the last 100 audit log entries (piped input)
tail -100 /var/log/audit/audit.log | audit2allow -M temp_fix