List all unique SELinux policies, grep denied /var/log/audit/audit.log

grep denied /var/log/audit/audit.log | sed "s/^.*denied /denied/g;s/ pid=[0-9]\+ \| ino=[0-9]\+//g;s/ name=.*scontext=\| path=.*scontext=/ /g" | sort | uniq
This can output:
denied  { open } for  comm="mysqladmin" path="/etc/my.cnf" dev="xvda1" ino=613540 scontext=system_u:system_r:zabbix_agent_t:s0 tcontext=system_u:object_r:mysqld_etc_t:s0 tclass=file
denied  { open } for  comm="mysqladmin" path="/var/lib/zabbix/.my.cnf" dev="xvda1" ino=4201026 scontext=system_u:system_r:zabbix_agent_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file
denied  { open } for  comm="mysql" path="/etc/my.cnf" dev="xvda1" ino=613540 scontext=system_u:system_r:zabbix_agent_t:s0 tcontext=system_u:object_r:mysqld_etc_t:s0 tclass=file
denied  { open } for  comm="mysql" path="/var/lib/zabbix/.my.cnf" dev="xvda1" ino=4201026 scontext=system_u:system_r:zabbix_agent_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file
denied  { signal } for  comm="zabbix_server" scontext=system_u:system_r:zabbix_t:s0 tcontext=system_u:system_r:zabbix_script_t:s0 tclass=process
Now we can generate few policies:
grep "denied.*mysqladmin.*zabbix_agent_t" /var/log/audit/audit.log
grep "denied.*mysqladmin.*zabbix_agent_t" /var/log/audit/audit.log | audit2allow -M mysqladmin_zabbix_agent_t
semodule -i mysqladmin_zabbix_agent_t.pp

grep "denied.*mysql.*zabbix_agent_t" /var/log/audit/audit.log
grep "denied.*mysql.*zabbix_agent_t" /var/log/audit/audit.log | audit2allow -M mysql_zabbix_agent_t
semodule -i mysql_zabbix_agent_t.pp

grep "denied.*zabbix_server.*zabbix_script_t" /var/log/audit/audit.log
grep "denied.*zabbix_server.*zabbix_script_t" /var/log/audit/audit.log | audit2allow -M zabbix_server_zabbix_script_t
semodule -i zabbix_server_zabbix_script_t.pp

grep "comm.*zabbix_server.*zabbix_t" /var/log/audit/audit.log
grep "comm.*zabbix_server.*zabbix_t" /var/log/audit/audit.log | audit2allow -M comm_zabbix_server_zabbix_t
semodule -i comm_zabbix_server_zabbix_t.pp

grep "denied.*zabbix_agentd.*zabbix_agent_t" /var/log/audit/audit.log
grep "denied.*zabbix_agentd.*zabbix_agent_t" /var/log/audit/audit.log | audit2allow -M zabbix_agentd_zabbix_agent_t
semodule -i zabbix_agentd_zabbix_agent_t.pp
List all possible direct searches:
grep denied /var/log/audit/audit.log | sed "s/^.*denied /denied/g;s/ pid=[0-9]\+ \| ino=[0-9]\+//g;s/ name=.*scontext=\| path=.*scontext=/ /g" | sort | uniq | sed "s/^.*comm=.//g;s/. .*system_r:/.*/g;s/:.*//g" | sort|uniq | sed "s/^/grep \"comm.*/g;s/$/\" \/var\/log\/audit\/audit.log/g"
Byat