Q:

How to add exception in SELinux?

When SELinux is disabled, I have no issues,
but when it's Enforced then I'm facing this
[systemd] failed to get d-bus session: Failed to connect to socket /run/dbus/system_bus_socket: Permission denied

Audit.log
 sealert -a /var/log/audit/audit.log
100% done
found 2 alerts in /var/log/audit/audit.log
--------------------------------------------------------------------------------

SELinux is preventing /usr/sbin/zabbix_agentd from connectto access on the unix_stream_socket /run/dbus/system_bus_socket.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that zabbix_agentd should be allowed connectto access on the system_bus_socket unix_stream_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'zabbix_agentd' --raw | audit2allow -M my-zabbixagentd
# semodule -i my-zabbixagentd.pp

i created a policy as suggested above,restarted zabbix-agent, now from zabbix agent log getting
[systemd] failed to get d-bus session: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender="(null)" (inactive) interface="org.freedesktop.DBus" member="Hello" error name="(unset)" requested_reply="0" destination="org.freedesktop.DBus" (bus)

 sealert -a /var/log/audit/audit.log
 39% donetype=AVC msg=audit(1534885076.573:250): avc:  denied  { connectto } for  pid=10654 comm="zabbix_agentd" path="/run/dbus/system_bus_socket" scontext=system_u:system_r:zabbix_agent_t:s0 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=unix_stream_socket

**** Invalid AVC allowed in current policy ***

A:

Well, first you have to identify the denial you are getting from SELinux. The easiest (in my opinion) way to do that is via the sealert utility.
First install the setroubleshoot-server package with:
yum install setroubleshoot-server

Then run:
sealert -a /var/log/audit/audit.log

You will probably get a lot of output, look for your specific denial, and follow the recommendations. But be sure to NOT allow things that shouldn't be allowed!
Here is an exmple of a denial, and the suggested woraround from sealert (my emphasis):

SELinux is preventing /usr/libexec/postfix/qmgr from using the rlimitinh access on a process.

*****  Plugin catchall (100. confidence) suggests   **************************

you believe that qmgr should be allowed rlimitinh access on processes labeled postfix_qmgr_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'qmgr' --raw | audit2allow -M my-qmgr
# semodule -i my-qmgr.pp

Additional Information:
Source Context                system_u:system_r:postfix_master_t:s0
Target Context                system_u:system_r:postfix_qmgr_t:s0
Target Objects                Unknown [ process ]
Source                        qmgr
Source Path                   /usr/libexec/postfix/qmgr
Port                          
Host                          
Source RPM Packages           postfix-2.10.1-6.el7.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-102.el7_3.16.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     centos
Platform                      Linux centos 3.10.0-514.26.2.el7.x86_64 #1 SMP Tue
                              Jul 4 15:04:05 UTC 2017 x86_64 x86_64
Alert Count                   5
First Seen                    2018-04-18 18:02:32 CEST
Last Seen                     2018-08-22 09:11:22 CEST
Local ID                      855f168c-1e47-4c6b-8a1e-f8fddce5d426

The example above concerns Postfix, again; look for your denial, and insert a local policy.

