audit2allow tips — authorized AVC-to-allow literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run audit2allow on the lab host (syllabus box you own or were given access to; typically needs audit log read access).
2. Prefer documenting who / why / ticket before any allow-rule generation — never widen production policy without change control.
3. Record short factual notes; quote short Evidence (type-pair allow summary — never secrets or full AVC blobs).
4. Optional: search peer → ausearch-tips.
5. Optional: compile peer → checkmodule-tips.
6. Prefer disposable lab VMs for AVC drills; quote non-secret type pairs afterward as Evidence.
7. Prefer reviewing generated rules before any install — refuse unauthorized hostile-allow cookbooks.
8. Stop at literacy — no attack or unauthorized MAC-bypass cookbooks.

Allowed framing

• Classroom labs reviewing audit2allow -a summaries on authorized disposable hosts.
• Binding short factual notes as Evidence (source/target type pairs — no secrets).
• Documenting expected vs observed AVC→allow candidates for authorized notes.
• Comparing audit2allow ↔ ausearch / aureport / checkmodule / semodule peer tip pages under one binder.
• Testing syllabus-approved allow generation only when change control authorizes that drill on lab resources.

Scope we will not cover

• No crack/pirate/keygen via audit2allow.
• No intentional unauthorized AVC mining against foreign hosts.
• No secret-theft or audit-log credential harvesting against hosts you do not own.
• No cookbooks that weaken SELinux via blanket allow rules for attack without authorization.
• No audit2allow -M install framed as an exploit step against production.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with policycoreutils / audit2allow and lab AVCs available.
2. Prefer a throwaway lab VM before any allow-generation drill.
3. With authorization, run audit2allow -a (or -i on a redacted lab log); quote selected type-pair labels as Evidence.
4. Optional: peer tip pages above when the syllabus asks.
5. Stop at literacy — no attack or unauthorized allow-bypass cookbooks.

Practical notes for authorized labs

• audit2allow turns AVC denials into candidate allow rules — keep Evidence labels distinct from ausearch-tips raw search.
• Pair with checkmodule-tips / semodule-tips when the syllabus zooms on compile→install after generation.
• AVC logs may embed sensitive paths — never paste secrets into notes or git.
• Prefer documenting allow-rule type pairs the syllabus authorized without dumping full privileged audit blobs.
• Never commit AVC dumps with secrets to git — even for labs.

FAQ-aligned refusals (quick)

• Foreign-host AVC mining / hostile allow generation → refuse.
• Unauthorized MAC-bypass / blanket-allow attack cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources