Install policycoreutils-python-utils package
Ensures the policycoreutils-python-utils package is installed so SELinux management tools like semanage and audit2allow are available.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
This package is required to operate and manage an SELinux environment and its policies. It provides the higher-level management utilities semanage (manage policy elements like ports, file contexts and booleans), audit2allow/audit2why (turn denials into policy modules and explain them), chcat and sandbox. Without these tools, administrators cannot adjust SELinux policy to fit local services, leading either to broken applications or to the temptation to weaken SELinux to permissive.
What Pavois checks
Pavois checks the effective package state with package('policycoreutils-python-utils') (resolved through rpm). The base policycoreutils can be present while these management utilities are not; Pavois confirms this specific package exists rather than assuming SELinux being active implies the full management toolchain.
describe package('policycoreutils-python-utils') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q policycoreutils-python-utils. Expected output is a versioned package name. You can confirm a key tool is callable with semanage boolean -l | head.
Inspect & investigate
Installation history is visible with dnf history and in /var/log/dnf.log. SELinux denials that you would analyze with audit2why/audit2allow are in /var/log/audit/audit.log (look for type=AVC).
Remediation
Pavois's harden plan installs the policycoreutils-python-utils package via the package resource (action: install). It is applied with pavois harden apply. This only adds the management tooling; it does not itself create or load any new SELinux policy.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | policycoreutils-python-utils |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing this package is low-risk and changes no running policy. Risk arises only from later use of the tools: a broad audit2allow module can grant unnecessary permissions and silently widen the attack surface, and a wrong semanage fcontext plus restorecon can mislabel files. - Review generated policy modules before loading them rather than blindly allowing every denial. - Test semanage changes on a staging host where possible.