Every story and comment from the Hacker News API, in a layout borrowed from 2001.
A comment on SELinux is unmanageable; just turn it off if it gets in your way. Parent comment
1) The article author is Testing in PROD
2) selinux debugging relies on auditd, so sanity checks required.
df -P /var/log/audit # has space? tail -1 /var/log/audit/audit.log # is recent? semodule -DB # disable dontaudit setenforce 0 # run the failing test audit2allow -l
mk_semod() { module_name=$1; shift audit2allow -l -m ${module_name} -a > ${module_name}.te $EDITOR ${module_name}.te || return checkmodule -M -m -o ${module_name}.mod ${module_name}.te semodule_package -o ${module_name}.pp -m ${module_name}.mod semodule -i ${module_name}.pp }
1) The article author is Testing in PROD
2) selinux debugging relies on auditd, so sanity checks required.
After which the selinux debugging experience boils down to: