type=AVC msg=audit(1612345678.123:456): avc: denied { read } for pid=1234 comm="nginx" name="index.html" dev="sda1" ino=12345 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0 type=AVC msg=audit(1612345678.123:456): avc: denied { read } for pid=1234 comm="nginx" name="index.html" dev="sda1" ino=12345 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0 type=AVC msg=audit(1612345678.123:456): avc: denied { read } for pid=1234 comm="nginx" name="index.html" dev="sda1" ino=12345 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0 🚨 SELinux Denial Detected! ============================= Who: nginx What: Tried to 'read' the target 'index.html' Why: A process with label 'httpd_t' is not allowed to access objects with label 'user_home_t' 💡 Suggestion: The web server is trying to read a file or directory labeled 'user_home_t'. Fix its context with: `sudo restorecon -Rv </path/to/index.html>` Or set it manually: `sudo chcon -t httpd_sys_content_t </path/to/index.html>` 🚨 SELinux Denial Detected! ============================= Who: nginx What: Tried to 'read' the target 'index.html' Why: A process with label 'httpd_t' is not allowed to access objects with label 'user_home_t' 💡 Suggestion: The web server is trying to read a file or directory labeled 'user_home_t'. Fix its context with: `sudo restorecon -Rv </path/to/index.html>` Or set it manually: `sudo chcon -t httpd_sys_content_t </path/to/index.html>` 🚨 SELinux Denial Detected! ============================= Who: nginx What: Tried to 'read' the target 'index.html' Why: A process with label 'httpd_t' is not allowed to access objects with label 'user_home_t' 💡 Suggestion: The web server is trying to read a file or directory labeled 'user_home_t'. Fix its context with: `sudo restorecon -Rv </path/to/index.html>` Or set it manually: `sudo chcon -t httpd_sys_content_t </path/to/index.html>` sudo selinux-explain --last sudo selinux-explain --last sudo selinux-explain --last selinux-explain --text "type=AVC msg=audit..." selinux-explain --text "type=AVC msg=audit..." selinux-explain --text "type=AVC msg=audit..." grep nginx /var/log/audit/audit.log | selinux-explain grep nginx /var/log/audit/audit.log | selinux-explain grep nginx /var/log/audit/audit.log | selinux-explain rustlet re = Regex::new( r#"denied\s*\{\s*(.*?)\s*\}.*?comm="(.*?)".*?name="(.*?)" .*?scontext=(\S+).*?tcontext=(\S+).*?tclass=(\S+)"# ).ok()?; rustlet re = Regex::new( r#"denied\s*\{\s*(.*?)\s*\}.*?comm="(.*?)".*?name="(.*?)" .*?scontext=(\S+).*?tcontext=(\S+).*?tclass=(\S+)"# ).ok()?; rustlet re = Regex::new( r#"denied\s*\{\s*(.*?)\s*\}.*?comm="(.*?)".*?name="(.*?)" .*?scontext=(\S+).*?tcontext=(\S+).*?tclass=(\S+)"# ).ok()?; rustpub struct AvcData { pub process: String, pub action: String, pub target: String, pub scontext: String, pub tcontext: String, pub tclass: String, } rustpub struct AvcData { pub process: String, pub action: String, pub target: String, pub scontext: String, pub tcontext: String, pub tclass: String, } rustpub struct AvcData { pub process: String, pub action: String, pub target: String, pub scontext: String, pub tcontext: String, pub tclass: String, } rustmatch (source_type, action, tclass) { ("httpd_t", "read" | "open" | "getattr", "file" | "dir") => { // web server trying to read a file with wrong label }, ("httpd_t", "name_connect", "tcp_socket") => { // web server trying to make outbound network connection }, ("container_t", _, _) => { // container trying to access host resource }, _ => { // generic fallback } } rustmatch (source_type, action, tclass) { ("httpd_t", "read" | "open" | "getattr", "file" | "dir") => { // web server trying to read a file with wrong label }, ("httpd_t", "name_connect", "tcp_socket") => { // web server trying to make outbound network connection }, ("container_t", _, _) => { // container trying to access host resource }, _ => { // generic fallback } } rustmatch (source_type, action, tclass) { ("httpd_t", "read" | "open" | "getattr", "file" | "dir") => { // web server trying to read a file with wrong label }, ("httpd_t", "name_connect", "tcp_socket") => { // web server trying to make outbound network connection }, ("container_t", _, _) => { // container trying to access host resource }, _ => { // generic fallback } } - parser.rs is the core. It takes a raw log line and extracts the relevant fields using a regex: - explainer.rs takes an AvcData and produces a human-readable explanation. The interesting part is get_specific_advice(), which matches on a tuple of (source_type, action, tclass) to give contextual suggestions: - reader.rs handles reading from /var/log/audit/audit.log for the --last flag — it scans the file line by line and returns the most recent AVC denial. - main.rs ties everything together with clap for argument parsing, and handles the three input modes: --last, --text, and stdin pipe detection via io::stdin().is_terminal(). - rules.toml support — an external file that maps (source_type, action, tclass) tuples to suggestions, so the community can contribute new cases without needing to know Rust - RPM package and COPR repository — once the tool is stable enough, proper distro packaging for Fedora and RHEL - More covered types — mysqld_t, sshd_t, smbd_t are next on the list