I'm currently playing around with SELinux on a Debian Wheezy VM.
I've seen a video by a RedHat employee talking about how easy SELinux is to use and that everything will be logged into /var/log/messages
in a nice, human-readable format.
However, I can't find this on my system. The only logs I get after a policy violation are in /var/log/audit/audit.log
, which are far from being understandable. Also, I can see some SELinux audit logs in dmesg
, but incomprehensible, too. Currently I do cat /var/log/audit/audit.log | audit2allow
to get a more informative result and to see whether a boolean can be set for this problem and to create a policy afterwards, if not.
Is there any way of enabling those human-readable logs on Debian? Or is this RedHat-exclusive?
If you need any config files etc., let me know.