Simulating a hacker attack

Hi, im having problems with the audit of denail messages with the
targeted policy

Im using runcon with a shell script to simulate what would happen if a
hacker was successfull hacking the web server, so i execute the next
command:  runcon -u system_u -r system_r -t httpd_t /bin/bash

I can only get this to work in permissive mode because if i execute it
in enforcing mode i get an error (execvp: Permission denied)
When i execute the command in permissive mode and im running in the
new "httpd-shell", i execute 'id -Z' and get this:
"system_u:system_r:httpd_t", so i think i running in the correct web
server security context.

The problem is that i dont recieve any error message in the
/var/log/messages when i try to do not-alloweds operations (like to
delete a  file under /etc)

(I have enabled all-auditing with make enableaudit;makeload under policy src)

thanks in advance