When I run audit2why to see why there is a failure when trying to upload files via SCP to folder /foo/bar on a remote server which results in access denied to folder /foo/bar, I get the following text:
Was caused by:
Unknown - would be allowed by active policy
Possible mismatch between this policy and the one
under which the audit message was generated.
Possible mismatch between current in-memory
boolean settings vs. permanent ones.
I know that this is definitely being caused by SELinux as when I run the command:
setenforce 0
I can upload the files via SCP to /foo/bar. Also of note, if I SSH in and cd to folder /foo/bar with SELinux enabled I can create a file in this folder.
How would I debug to see what is causing the exact issue within SELinux?
EDIT
Here is the output of ls -lZ
of /foo/bar
drwxrwx--T. root foo-users user_u:object_r:default_t:s0 bar
and the output of an AVC denial from audit2allow
type=AVC msg=audit(1519304988.434:6984): avc: denied { write } for pid=26506 comm="scp" name="event-20180203.log.gz" dev="dm-4" ino=7260 scontext=user_u:user_r:user_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=file
Was caused by:
Unknown - would be allowed by active policy
Possible mismatch between this policy and the one under which the audit message was generated.