SELinux: Confirm a Denial Without Breaking It

A service on this enforcing RHEL server misbehaves, and you suspect SELinux. To prove it you want only that service's denials logged but allowed, while every other service stays protected. Find the SELinux domain the service runs in (the brief, /root/case/brief.txt, names the service and its binary), make just that domain permissive persistently with semanage permissive, and leave the system mode enforcing in /etc/selinux/config. This lab machine's kernel has SELinux disabled, so nothing is enforced live; grading reads the persistent SELinux policy store, which is what an enforcing box loads at boot.