I have ended up on some of my systems some alerts that are found with sealert -l * but cannot be located with executing the suggested ausearch command sequence. This is happening on headless systems from which I have not installed X-Windows. How can I either process the issues behind these alerts or clear them out?
[psmode@cristal ~]$ sudo sealert -l \*
SELinux is preventing /usr/sbin/sendmail.postfix from append access on the unix_stream_socket unix_stream_socket.
***** Plugin leaks (86.2 confidence) suggests *****************************
If you want to ignore sendmail.postfix trying to append access the unix_stream_socket unix_stream_socket, because you believe it should not need this access.
Then you should report this as a bug.
You can generate a local policy module to dontaudit this access.
Do
# ausearch -x /usr/sbin/sendmail.postfix --raw | audit2allow -D -M my-newaliases
# semodule -X 300 -i my-newaliases.pp
<snip>
[psmode@cristal ~]$ sudo ausearch -x /usr/sbin/sendmail.postfix --raw | audit2allow -D -M my-newaliases
Nothing to do