.The `strace` utility can now display mismatches between the actual SELinux contexts and the definitions extracted from the SELinux context database An existing `--secontext` option of `strace` has been extended with the `mismatch` parameter. This parameter enables to print the expected context along with the actual one upon mismatch only. The output is separated by double exclamation marks (`!!`), first the actual context, then the expected one. In the examples below, the `full,mismatch` parameters print the expected full context along with the actual one because the user part of the contexts mismatches. However, when using a solitary `mismatch`, it only checks the type part of the context. The expected context is not printed because the type part of the contexts matches. ---- [...] $ strace --secontext=full,mismatch -e statx stat /home/user/file statx(AT_FDCWD, "/home/user/file" [system_u:object_r:user_home_t:s0!!unconfined_u:object_r:user_home_t:s0], ... $ strace --secontext=mismatch -e statx stat /home/user/file statx(AT_FDCWD, "/home/user/file" [user_home_t:s0], ... ---- SELinux context mismatches often cause access control issues associated with SELinux. The mismatches printed in the system call traces can significantly expedite the checks of SELinux context correctness. The system call traces can also explain specific kernel behavior with respect to access control checks.