How do I figure out on what file dac_override is attempted?

[Göran Uddeborg]

Daniel J Walsh:
> If you use ausearch -m avc to look for this avc, is there some info
> setroubleshoot might have dropped?

It didn't miss anything.  It just gave exactly the same info as in the
end of the SETroubleshoot message.

(But looking at that and the surrounding events, I realised these
AVC:s happen when the machine goes down, not when it comes back up as
I first thought.  That could be one more clue.  I'll keep searching.)