diff --git a/test-tool/libguestfs-test-tool.pod b/test-tool/libguestfs-test-tool.pod
index 71468956d..9f5a045f8 100644
--- a/test-tool/libguestfs-test-tool.pod
+++ b/test-tool/libguestfs-test-tool.pod
@@ -114,10 +114,14 @@ this command as root:
  setenforce Permissive
 
 If this makes a difference, look in the audit logs for recent
-failures:
+failures ("AVCs"):
 
  ausearch -m avc -ts recent
 
+You can convert AVCs into suggested SELinux policy rules using tools
+like L<audit2allow(1)>.  For more information, see the "Security
+Enhanced Linux User Guide".
+
 To reenable SELinux and sVirt, do:
 
  setenforce Enforcing