Hello All, I recently was working on an issue that required looking at kerberos functions below the gssapi layer. By setting KRB5_TRACE output I was able to narrow down the issue. To do this I created a drop file for the gssproxy systemd service instead of starting the process at the command line. The drop file designated KRB5_TRACE output to a file under /var/log. This testing was on a system that uses SELinux so it was necessary to either create a custom SELinux policy module or set SELinux to permissive. The policy is relatively non-invasive: (allow gssproxy_t var_log_t (dir ( write add_name ))) (allow gssproxy_t var_log_t (file ( create open ))) I am curious as to what others think about proper documentation. Namely adding a small blurb to a man page or adding/extending a file in gssproxy/docs. As there does not have to be a standard location to direct the KRB5_TRACE output, I don't see it necessary to modify selinux-policy with fixed entries. Regards, Jacob Shivers _______________________________________________ gss-proxy mailing list -- gss-proxy(a)lists.fedorahosted.org To unsubscribe send an email to gss-proxy-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/gss-proxy@lists.fedorahosted... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure