semanage-dontaudit(8)

💅 semanage-dontaudit — the manual page, but make it make sense

okay bestie, welcome to the semanage-dontaudit(8) page 🎀 this is the SELinux Policy Management dontaudit tool, and yes the name is a whole mouthful, we're getting through it together.

---

✨ SYNOPSIS ✨

semanage dontaudit [-h] [-S STORE] [-N] {on,off}

that's it. that's the whole vibe. on or off, choose your fighter 🫶

---

🌸 DESCRIPTION 🌸

so semanage is the girl that configures certain elements of SELinux policy without needing you to modify or recompile anything from the policy sources. she just does it. main character energy fr.

semanage dontaudit toggles whether or not dontaudit rules will be in the policy. and the way that policy writers use dontaudit rules is to make confined applications use alternative paths. lowkey iconic of them.

here's the tea though 🍵: dontaudit rules are denied but not reported in the logs. so they just... happen. silently. no paper trail, no receipts.

and because of that, sometimes dontaudit rules can cause bugs in applications and the policy writers will not realize it, because the AVC is not audited. 😭 the bug is right there and nobody can see it. screaming.

so turn off dontaudit rules with this command to see if the kernel is blocking an access. that's the whole point. that's the detective work. slay.

---

✨ OPTIONS ✨

• -h, --help — show this help message and exit. the classic. the safe word. 💖
• -S STORE, --store STORE — select an alternate SELinux Policy Store to manage. you wanna manage a different store? go off, be picky 👑
• -N, --noreload — do not reload the policy after commit. you commit and you simply do not reload. no reloading. none. 💅

---

🌈 EXAMPLE 🌈

turn off dontaudit rules:

# semanage dontaudit off

boom. done. the dontaudits are gone and now the kernel has to say something. 🦋

---

👀 SEE ALSO 👀

• selinux(8)
• semanage(8)

go read those too, iykyk.

---

💜 AUTHOR 💜

this man page was written by Daniel Walsh <dwalsh@redhat.com> — thank you king, we appreciate you 🫶

---

k bye bestie, this page is from 20130617 and it lives in the semanage-dontaudit(8) section of the manual, mwah 😘💖✨