Views:

To resolve the issue, create custom SELinux policy with Audit2allow:

  1. Connect to the Deep Security Agent console as a root user.
  2. Run the following commands to create a custom policy that will allow access to Deep Security Agent files:

    # cd /tmp
    # grep ds_agent /var/log/audit/audit* | audit2allow -M ds_agent
    # semodule -i ds_agent.pp

  3. Restart the ds_agent.
  4. Check system messages and confirm that there are no alerts related to ds_agent.

    # cat /var/log/messages | grep ds_agent

  5. If there are still some alerts showing, run again the command from Step 2. This will update the existing policy and re-apply it.

To remove the SELinux policy, use the following command

# semodule -r ds_agent

Keywords: SELinux alerts,SELinux error message,remove SELinux alert