From afb0414c5cc075da768aa3d2a0020d7f10f370d8 Mon Sep 17 00:00:00 2001
From: Nick Anderson <nick@cmdln.org>
Date: Fri, 7 Aug 2026 23:38:14 -0500
Subject: [PATCH 1/2] Widened the cf-support SELinux denial search to the
 object context

Ticket: ENT-14405
Changelog: none
---
 misc/cf-support | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/misc/cf-support b/misc/cf-support
index e97cffeaf1..23fd241a35 100755
--- a/misc/cf-support
+++ b/misc/cf-support
@@ -390,9 +390,9 @@ else
 fi
 echo "Captured output of $syslog_cmd filtered for cf-|CFEngine"
 
-# cf- component related SELinux denials
+# cf- component related SELinux denials, as either subject or object
 if command -v ausearch >/dev/null; then
-  ausearch -m avc -su cfengine > "$tmpdir"/ausearch-cfengine-avcs.log
+  ausearch -m avc -se cfengine > "$tmpdir"/ausearch-cfengine-avcs.log || true
 fi
 
 gzip_add $WORKDIR/outputs/previous

From 78c5c96721f3e094db4c6066fb81fa7ef0e30b63 Mon Sep 17 00:00:00 2001
From: Nick Anderson <nick@cmdln.org>
Date: Fri, 7 Aug 2026 23:38:32 -0500
Subject: [PATCH 2/2] Added SELinux state and Federated Reporting transport
 metadata to cf-support

Ticket: ENT-14405
Changelog: Title
---
 misc/cf-support | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/misc/cf-support b/misc/cf-support
index 23fd241a35..d8bb15a0e7 100755
--- a/misc/cf-support
+++ b/misc/cf-support
@@ -395,6 +395,19 @@ if command -v ausearch >/dev/null; then
   ausearch -m avc -se cfengine > "$tmpdir"/ausearch-cfengine-avcs.log || true
 fi
 
+# SELinux state, to interpret the denials above
+log_cmd "sestatus"
+log_cmd "semodule -l | grep cfengine"
+log_cmd "semanage fcontext -C -l"
+
+# Federated Reporting transport: metadata only, the transport private key is here
+if [ -d /opt/cfengine/federation ]; then
+  log_cmd "getent passwd cftransport"
+  log_cmd "ls -ldZ /opt /opt/cfengine /opt/cfengine/federation /opt/cfengine/federation/cftransport /opt/cfengine/federation/cftransport/.ssh"
+  log_cmd "ls -laZ /opt/cfengine/federation/cftransport/.ssh"
+  log_cmd "ssh -V"
+fi
+
 gzip_add $WORKDIR/outputs/previous
 gzip_add $WORKDIR/outputs/dc-scripts.log # masterfiles-stage log
 # Collect up to the two most recent standalone_self_upgrade logs (separate cf-agent process)