Selinux seems to be blocking but no denied message appearing in audit log

If you think SELinux is blocking something, but you see no denial in the audit log, it may be because of silent denials. These denials take place, but aren't audited because a rules exists that explicitly disables auditing. This rule is called dontaudit.

From the RHEL SELinux docs:

Applications and system library functions often probe for more access than required to perform their tasks. To maintain least privilege without filling audit logs with AVC denials for harmless application probing, the policy can silence AVC denials without allowing a permission by using dontaudit rules. These rules are common in standard policy. The downside of dontaudit is that, although SELinux denies access, denial messages are not logged, making troubleshooting more difficult.

To rebuild the SELinux policy ignoring all dontaudit-rules, run semodule -DB. The -D option disables dontaudit rules; the -B option rebuilds policy.

Then try if you can trigger an audit log event. If so, fix it, and then re-enable dontaudit rules by running: semodule -B.

For a full list of dontaudit rules, run the sesearch --dontaudit command. Narrow down searches using the -s domain option and the grep command. For example:

» sesearch --dontaudit -s smbd_t | grep squid dontaudit smbd_t squid_port_t : tcp_socket name_bind ; dontaudit smbd_t squid_port_t : udp_socket name_bind ;