SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

learn more… | top users | synonyms

-1
votes
0answers
20 views

SELinux policies [closed]

I am new to SELinux policies. I am looking for a good tutorial on SELinux policies, how it works, how to define properties, labels, types, how to allow/deny permissions, etc. Any pointer and help ...
0
votes
1answer
32 views

autofs 'failed to mount autofs path' as service but not manually (selinux)

I'm on CentOS 6.6 and I'm having a strange problem with autofs. I'm trying to mount an smb share on /var/www/html/mysite/docfolder, so I created a docfolder inside the mysite folder, ran chmod 777 on ...
4
votes
1answer
138 views

Permission errors even permissions are wide open

I installed anaconda on our new VM and I can't list it's contents. I can change my directory to .../anaconda/ but when I type ls -l I get: ls: cannot open directory .: Permission denied However, ...
3
votes
0answers
47 views

What SELinux context shall the script have to be ran by pam_exec?

I just installed Fedora 22 on my VPS and tried to make trivial thing -- run my informer script on every ssh login via pam_exec. But I was confronted with unexpected difficulties: pam_exec failed with ...
5
votes
1answer
147 views

SELinux is preventing /opt/google/chrome/nacl_helper from getattr access on the file /etc/passwd

Is this a bug or a real security concern? It appears to have been discussed but I still don't understand why this is happening and what is being done to address the root cause (I am not going to ...
1
vote
0answers
51 views

How to understand the security context in “ls -Z”?

After referring "man ls", it shows "ls -Z" can display the security context: -Z, --context Display security context so it fits on most displays. Displays only mode, user, group, security ...
1
vote
1answer
51 views

linux commandline can connect but webserver (or php) can't connect

We can connect to a specific url with linux (centos 6) commandline (curl, wget,...) But we can't connect to it by webserver (apache) or php. I did 'setenforce 0' command, after that webserver and ...
1
vote
0answers
59 views

Where to put the SElinux policy to allow acpid shutdown the system?

I'm using Centos7 minimal. I've installed acpid and the daemon is running. When I hit the power button, I get the following in /var/log/messages May 2 18:52:53 localhost systemd-logind: Power key ...
3
votes
1answer
242 views

SELinux is preventing /opt/google/chrome/chrome-sandbox from write access on which file?

I keep getting the following error ever since upgrading to Chrome google-chrome-stable-42.0.2311.90-1.x86_64. SELinux is preventing /opt/google/chrome/chrome-sandbox from write access on the ...
1
vote
1answer
73 views

Fedora 21 shutdown and reboot error

Recently I have been using Fedora 21 and I have an issue where sometimes I shut down and reboot and the system just hangs at the fedora logo and never actually boots. I noticed the issue after ...
0
votes
1answer
177 views

chcon: failed to change context of `/etc/oddjobd.conf.d' to `unconfined_u:object_r:oddjob_t:s0': Permission denied

A friend of mine had trouble with SELinux. The server is configured with SELinux in enforcing mode, using the targeted policy. When using Puppet, restorecon or chcon, he had errors like this, even if ...
0
votes
0answers
34 views

SELinux context on CentOS 7

I installed CentOS 7 on my server and tried to deploy phpBB. I realized that SELinux was on when the directories were 'Unwritable'. I setenforce to 0 and completed the installation. However I'd like ...
1
vote
0answers
60 views

Cannot execute semanage fcontext --add under Fedora 21 using policy targeted

I cannot add a file contexts to the running SELinux policy using semanage under Fedora 21. When executing the semanage fcontext --add command, I receive an OSError: mf@vienna ~ % sudo semanage ...
1
vote
1answer
70 views

How do I troubleshoot these SELinux AVC errors?

Background: I have a CentOS 6 LAMP server. Recently the server has started to become unresponsive every few days. Originally, mysqld would throw a nagios alert and I would be unable to even ssh into ...
2
votes
1answer
43 views

SELinux “training” ( permissive mode logs )

Alright I've been skimming various articles and videos. They all say the same basic thing: start with the default policy, run in permissive to see what needs to be fixed. Then modify your policies to ...
1
vote
2answers
73 views

How to protect against data leak?

We have a few workstations that have access to a network share with all our company files. This is correct, because users may need to use them. However our boss is concerned that someone (upon ...
1
vote
0answers
29 views

SELinux log on Debian Wheezy

I'm currently playing around with SELinux on a Debian Wheezy VM. I've seen a video by a RedHat employee talking about how easy SELinux is to use and that everything will be logged into ...
1
vote
0answers
29 views

What is SELinux's regex type?

I'm trying to locate all files on my system matching an SELinux file context (fcontext). These contexts are specified using some regex, and I'd like to use find -regex ... to the same effect. However, ...
1
vote
1answer
177 views

SELinux + logrotate + prerotate = Permission Denied

I have what (should) be a fairly straightforward task: Migrate a set of custom log files to a database at night. I use logrotate (cron.daily) with a simple prerotate task /var/log/myapplog/*.log { ...
1
vote
0answers
49 views

How can I enable ufw automatically on boot?

sudo ufw enable Firewall is active and enabled on system startup sudo ufw status Status: active But after I restart the system and run sudo ufw status, I get the message: Status: inactive How ...
1
vote
2answers
225 views

Restarting OpenVPN on SELinux by a cronjob

I have a server with some OpenVPN instances (one server, several clients) running on Debian with enforcing SELinux. The connections to some of the VPN servers my machine is connecting to are somewhat ...
-1
votes
1answer
76 views

Tech expert says you are much safer using Windows than Fedora. [closed]

A tech expert at Michigan State University said today in his talk on campus that with Windows at least you can install ZoneAlarm. Fedora on the other hand has a firewall that is too complex to figure ...
0
votes
0answers
30 views

SELinux: bin_t type socket-application can access http_port_t ports

I am trying to compromising my application (myapp) to use limited ports. For that, I have decided to assign httpd_t type to myapp. So, myapp could use only http_port_t typed ports & I could ...
0
votes
1answer
18 views

kernel security and IDS Firewall + AV together or not?

I try to hardening my server. For doing so, I got a general question: Should I install kernel security patches like selinux and an Anti-Virus with Intrusion Detection Firewall? Does it make sense to ...
2
votes
1answer
45 views

SELinux Enforcing is preventing logging into another user account?

I am using Debian 6 with SELinux enabled. After enabling "enforcing" mode in SElinux, I have tried to login into another user account by 'login' command. But, I have been restricted by selinux. ...
1
vote
0answers
58 views

SELinux: 'chcon' is not reflected in another user account

I am using Debian 6 with SELinux enabled. For testing, I have tried to block access to date command for users. Now, I have mapped 'Test_Unix_User' account to 'user_u' SELinux account. 'user_r' can ...
0
votes
1answer
77 views

How to put dracut to initframs?

I try to make SElinux permissive. I changed the config from disabled to permissive. However, I guess it does not recognize that change. In the red hat web site, It says : If the system was ...
1
vote
0answers
70 views

how do i build / apply an selinux policy file, on redhat 7?

I'm trying to install RabbitMQ on Redhat Linux 7 (RHEL7). I followed the instructions on the RabbitMQ site, and it installed fine. However, it won't run because SELinux is preventing Erlang from ...
0
votes
0answers
76 views

How to recompile ImageMagick to detect the DELEGATES

I am using Imagemagick(6.4.3.6-7.18.x86_64) in SLES11 SP2 Using it like bellow.. import -window $wid $jpg and getting this error import: DelegateLibrarySupportNotBuiltIn `' (X11) @ ...
1
vote
1answer
205 views

Problem running “selinux sandbox” with java

I am trying to sandbox a java application using selinux sandbox. System details: Redhat 6 | x86_64 | no x server install | jdk7 from oracle tar.gz version | cgred and cgconfig are stop The cmd ...
1
vote
1answer
44 views

SELinux ignoring configuration?

I'm using Vagrant and VirtualBox to run a CentOS 6.5 VM. In /etc/sysconfig/selinux I have set SELINUX=permissive. However, everytime I restart the VM, sudo getenforce shows SELinux as Enforcing. ...
4
votes
1answer
101 views

How to transition into another domain when invoking sudo?

I have a daemon (collectd) that executes a script for data collection (via smartctl). The exec-plugin of collectd mandates that external scripts are executed under a user != root. The plan is to set ...
1
vote
1answer
37 views

How do I find/list all files on filesystem with a certain SELinux “fcontext”

I'm having trouble finding information on what command, presumably from setools, I should use to find all the files on my filesystem that are labeled by SELinux with a certain file-context (fcontext). ...
1
vote
0answers
50 views

Can't modify or delete SELinux user

I was playing around with user_u in the targeted policy on RHEL 6.5. I'm logged in as root in the unconfined context, so I have full ability to change anything I want. I've also switched to ...
1
vote
1answer
45 views

SELinux Sandbox Usage

What am I doing wrong in the following, from the man file and internet it looks like this is right. $ echo "hello world" 1> test $ sandbox -i test cat test /usr/bin/cat: test: Permission denied
0
votes
0answers
44 views

SELinux error when yum updated pcre package

When doing a yum update, I got the following errors: Updating : pcre-8.33-7.fc20.i686 82/164 libsepol.module_package_read_offsets: module package header ...
2
votes
0answers
61 views

Acpid event denied by SELinux, how can I savely allow the event without opening security holes?

I installed Fedora (3.17.2-200.fc20.x86_64) on my new Notebook (Lenovo Yoga Pad) and wanted to add this script to trigger whenever I flip over my screen. The script triggered whith the event is ...
1
vote
0answers
64 views

How to get SELinux to prevent Apache/HTTPD from reading specific files

What am I missing with SELinux? I thought it was supposed to be another layer of security but I built a web page vulnerable to command injection and it can basically traverse most of my file system. ...
1
vote
0answers
37 views

SELinux. Prevent Apache/HTTPD from reading specific files.

What am I missing with SELinux, i thought it was suppose to be another layer of security but i built a vulnerable web page vulnerable to command injection and it can basically traverse most of my file ...
2
votes
1answer
339 views

SELinux and OpenVPN?

Having Fedora 20 64-bit installed, I have this old problem of conflicting OpenVPN and SELinux. Obviously SELinux prevents openvpn from launching. The OpenVPN has been set through Network Connection ...
1
vote
2answers
72 views

Enabling SELinux on RHEL

I am using RHEL 6.5 and I need to enable SELinux. I have tried following commands, but it is of no help: $ setenforce 1 $ echo 1 > /selinux/enforce Note: I also tried editing ...
1
vote
2answers
79 views

is there any use for /selinux folder, when I don't use selinux?

I'm using Debian Wheezy, and by default a folder /selinux exists on my filesystem, even though I'm not (knowingly) using any SELinux infrastructure. I know that SELinux is intertwined with some ...
0
votes
0answers
129 views

Cannot label F2FS (SELinux)

I'm running Arch Linux [testing] x86_64 For some reasons, I can't relabel my root file system (F2FS) with SELinux (custom kernel compiled, using refpolicy) Kernel ver $ uname -a ...
1
vote
1answer
150 views

SELinux disabled, net.ipv4.tcp_syncookies and nfs

OS is RHEL 6.2. I appear to be having an issue with SELinux. I've disabled it in /etc/sysconfig/selinux, however, when my host starts the command sestatus show that I'm in permissive mode. Searches ...
3
votes
1answer
136 views

How do I remedy SELinux not allowing legit programs in use access to my system?

I have a system where some programs are getting access denied in SELinux when performing their duties. These programs are ClamAV, fail2ban and Logwatch. I think I've managed to allow all the access ...
1
vote
1answer
76 views

Accidental modified SELinux context on root account to staff_u

I logged in as a normal account(test) on my CentOS 6.5 VM and sudo su - root and run usermod -Z staff_u test but looks like it changed my root account to staff_u as well, now I am stuck, could not ...
1
vote
1answer
123 views

Altermime and SELINUX

I've setup an application called altermime (http://www.pldaniels.com/altermime/) for postfix (SMTP server) which alters emails midstream. I'm injecting a "X-ListUnsubscribe" header into every email ...
0
votes
1answer
295 views

Compiling Awesome from source on CentOS: cannot find libraries

I am trying to install awesome (v3.5.5) on CentOS7. Since I could not find a repository that carries it, I am compiling it from source. However, I am getting this error on running make: -- checking ...
3
votes
2answers
500 views

Cannot delete File on Fedora

I have a file with following permission: -rwSr-s---. 1 1634630331 1818884080 118784 Jun 29 1970 DailyUpdateClass.class If I try to delete this file with root login, I get error. rm: cannot remove ...
0
votes
1answer
415 views

What should be the security context of these cron files?

I am running Fedora 20 and I am having some issues when running logrotate and anacron which I suspect may be related to SELinux: Failed to determine timestamp: Cannot assign requested address chgrp: ...