Selinux: Blocked-Messages in permissive mode?

[David Timms]

Peter Gordon wrote:
> On Sat, 2008-02-16 at 15:19 +0100, Roger Grosswiler wrote:
>> So, now, what is fact? is this blocking or just saying that it is
>> blocking?
> 
> My understanding is that you are correct about this. "Permissive" only
> logs these denials of what _would_ happen should you switch the SELinux
> configuration to "enforcing" mode. However, the access is still granted.
Further to what Peter said:
Because selinux is permitting the first item, sometimes this leads to a 
second or more selinux denial warning. If selinux were enforcing, you 
would only see the first message, where it blocked a certain access - 
end of story.

What does sestatus say ?
# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 21
Policy from config file:        targeted

Some issues might be resolved with restorecon: {don't apply, recurse, 
verbose}
# restorecon -nrv /

, which could let you see files with bad contexts as a diagnostic, 
before actually doing {suggested best to do during reboot}:

http://docs.fedoraproject.org/selinux-faq-fc5/#id2961890

DaveT.