Does this mean, the "setenforce 0" won't work anymore?
I use it quite a lot to examine the denials and audit2allow to generate updated rules which fixes my issues.
I would see the inability of such workflow as a major drawback for *anyone* who doesn't just consume the default configuration. e.g. "My database datadir should reside elsewhere"; "my container should access pulseaudio socket"; "I've ran the default configuration with my data and it crashed" ...
--
Michal Schorm Software Engineer Core Services - Databases Team Red Hat