I mostly agree with you but sometimes it is extraordinarily difficult to find out what went wrong. audit2allow and audit2why are often helpful but at least as

I mostly agree with you but sometimes it is extraordinarily difficult to find out what went wrong. audit2allow and audit2why are often helpful but at least as often they offer the wrong solution. Did you know that some selinux violations are not even reported by default? This was the case for me; selinux transitions are prevented by a filesystem mounted _nosuid_. The failure is not reported because transition failures are apparently so common and unimportant selinux does not report them by default. Took me a looong time to troubleshoot this.