Andrew Dunstan <andrew@dunslane.net> writes: > On 4/1/21 8:32 AM, Dave Page wrote: >> It seems to me that sepgsql should also log the denial, but flag that >> permissive mode is on.
> +1 for doing what selinux does if possible.
+1. If selinux itself is doing that, it's hard to see a reason why we should not; and I concur that the info is useful.
Thanks both. I'll take a look at the code and see if I can whip up a patch (it'll be a week or so as I'm taking some time off for Easter).