SELinux AVC denials
SELinux AVC denials. SELinux access-vector-cache messages record an access-control decision and security contexts.
Source and collection
Typically /var/log/audit/audit.log when auditd is configured; audit transport records can be aggregated differently.
Review audit rules, backlog/lost-event counters, daemon state and retention. Use ausearch with an authorized local log copy.
Native example and provenance
upstream test fixture. Published example; no independent capture provenance claimed.
Original publisher / pinned upstream fixture — line 49
One complete record selected; values unchanged.
Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031
Download the exact sample · Offline research kit
SHA-256: a4650a2b56bab5a0c3f42e046842c6204fd2e770035df2cf0ff3f3e1f5881a06
type=AVC msg=audit(1702909843.777:105992): avc: denied { fowner } for pid=603 comm="syslog-ng" capability=3 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=capability permissive=1
Structure and field interpretation
| Field/path | Serialized type |
|---|---|
raw record | audit |
- type
- Audit record type.
- msg=audit(epoch:serial)
- Timestamp and serial used to group records.
- auid / uid
- Login identity and effective process context differ.
- arch
- Syscall architecture discriminator when present.
Investigation uses
- Review denied permissions with source and target labels and application activity.
- Preserve the raw record and its complete event group before enrichment or normalization.
Validation boundaries
Permissive mode changes enforcement; a denial record must be interpreted with policy and permissive state.
This text sample passed byte-integrity and record-framing checks. Its field interpretation follows the cited format; a vendor-specific semantic parser has not been certified.
For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.
Related sources
Ecosystem connections
- Telemetry Library — ATT&CK data components
- Detection Rules — candidate detection content
- Threat hunting — from intelligence to validated defense
- Practical security learning paths
- AdversaryGraph — evidence-led investigation
References
Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.