5. User test1: visits the file of correct type, and his request is approved. The user test1 visits the file again and succeeds.
$ vi /file
6. root: Refer to the audit log:
/var/log/audit/audit.log
with commands
audit2why
and
audit2allow
.
$ audit2why -a
There is an AVC information about access denied and a reasonable root cause as shown in the below figure.
Figure 15. Audit log for vi
$ audit2allow -a
This command suggests the rules that can approve the access.
Figure 16. Audit suggestion for Vi
Example 2: Denying a root user from changing SELinux running mode
In this example, the root user is restricted to have no permission to change the SELinux running mode when SELinux is enforced.
NXP Semiconductors
Industrial features
Open Industrial User Guide, Rev. 1.8, 05/2020
User's Guide
63 / 199
