This is great, thanks for sharing. Now if I could just find something that acts like selinux in permissive logging mode so I can grant : to something in a dev

This is great, thanks for sharing. Now if I could just find something that acts like selinux in permissive logging mode so I can grant : to something in a dev environment run the thing I need to write a policy for and have it log every permission needed to run the thing I just ran. Would simplify policy writing a ton.