4

I have SELinux in permissive mode enabled on CentOS7 system. But it doesn't seem to produce any logs. No new files in /var/log/audit, grep -i selinux /var/log/messages* finds nothing.

sestatus returns:

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   permissive
Mode from config file:          permissive
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      28

What can be wrong?

5

Do you have the audit packages installed? If so, is auditd enabled and running?

When you don't have the audit packages installed, audit & audit-libs and have the auditd service running, the logs will stop showing up in where you expect (/var/log/audit). When this is the case, they will show up in /var/log/messages.

  • 2
    I have auditd running, but no new logs in /var/log/audit. I tried restarting the service with systemctl, but got this: Operation refused, unit auditd.service may be requested by dependency only. – BartBiczBoży Feb 5 '16 at 6:53
  • 3
    That is correct. Audit, unfortunately, does not play well enough with systemd. Use the classic service command for auditd and it will restart gracefully. – Sokel Feb 6 '16 at 4:03
  • 2
    Allright, restarting it this way helped, thanks! – BartBiczBoży Feb 6 '16 at 6:03
  • 1
    "Where do the AVC (Access Vector Cache) denials go to?" Doc for Red Hat 6, Doc for Red Hat 7 – David Tonhofer Mar 21 '18 at 18:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.