not compatible with audit2allow

[silveraignacio]

Hello! I could check that this audit rules are not compatible with the output that is expected by audit2allow to fix selinux issues.
I have to revert the changes, get the default configuration of auditd and after that, I got the expected log type for selinux issues.
Please can you guide me how can I achieve that? I need this format for selinux

messagestype=AVC msg=audit(1571742292.924:439324): avc: denied { open } for pid=7263 comm="psql" path="/var/lib/zabbix/.pgpass" dev="dm-5" ino=2233826 scontext=system_u:system_r:zabbix_agent_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=0

[kovacs-andras]

Hi @silveraignacio !
If you take a closer look on the ruleset there is even a rule in it which will prevent to get all the necessary info to make a custom SELinux policy:

## Ignore SELinux AVC records
-a always,exclude -F msgtype=AVC

I recommend to build your policies after dropping all these rules (auditctl -D) or build it on a separate machine where this ruleset is not in use.
Let me know if you need further help either with auditd or SELinux!
Regards,