Debug SELinux denials

In Splunk Enterprise for Common Criteria, denials are almost always the result of introducing a new policy:

1. Check the audit log to ensure there are no relevant denials:

type=AVC 

2. If there are any denials, convert them to allow rules for the Type Enforcement definition file (*.te).

For example, grep denies "/vr/log/audit/audit.log, you can convert to allow as follows:

grep "denied" /var/log/audit/audit.log | audit2allow