[m4rtink]

I think all the SELinux denials are logged in Journal and there are good tools to analyze them and possibly turn them to rule changes if necessary.