Am I editing the selinux policy correctly?

Question

linux

sealert after parsing the audit.log suggests actions via audit2allow or setsebool. I have read that it is not safe to use audit2allow. Is it so?

Answer 1

I think setsebool is safe.
audit2allow is dangerous. You just need to understand what you allow. Usually all requests to something are allowed, which is dangerous and in some cases tantamount to disabling selinux.
But usually - you have no other choice: either all you need is to allow, or rebuild / reconfigure your subsystem in a different way, so as not to use audit2allow, or whether to develop your own policy for yourself (requires a deeper understanding of selinux).