Stephen Smalley wrote:

Sounds like you are getting a DBUS denial, so look for USER_AVC messages
e.g.
/sbin/ausearch -i -m USER_AVC.
    

None there. It turns out they were in /var/log/messages so grep kwrite /var/log/audit/audit.log | audit2allow >> kwrite.te did the trick. It is strange that some AVCs go to /var/log/messages while others goto /var/log/audit/audit.log

Thanks for all your advice, it has helped a lot.

Cliffe.
  

grep kwrite /var/log/messages | audit2allow >> kwrite.te