SELinux: Build a Policy Module From AVC Denials

A legitimate access on this RHEL box is being denied, and the AVC records are in /root/case/avc.log (the brief, /root/case/brief.txt, says what the service is trying to do). The labels are right, and no boolean or port label covers it, so the policy needs a new allow rule. Confirm that with audit2why, generate a policy module from the denials with audit2allow, read the .te it writes, install it with semodule -i, and re-check the log until every denial is allowed. This lab machine's kernel has SELinux disabled, so nothing is enforced live; grading reads the persistent SELinux policy store, which is what an enforcing box loads at boot. Grading checks the installed module set and re-runs audit2why against the rebuilt policy.