SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

learn more… | top users | synonyms

3
votes
1answer
23 views

SELlinux security domains

I'm studying SELinux, but I can't find any clear definition for security domains. What is a security domain and what is its difference with security context?
0
votes
0answers
7 views

Are there any recommended SELinux policies for JBOSS?

I’m looking for tips about defining JBoss policies in SELinux. I saw that OWASP is planning to publish a document about this, but I need some guidance ASAP. Can someone please help?
0
votes
0answers
10 views

runuser best practice? [closed]

I'm using SELinux on RedHat. This environment uses "runuser" instead of "su". I know that I can limit “su” access by using specific PAM configuration. However, since "runuser" does exactly the same ...
1
vote
3answers
44 views

Configuring FTP server in redhat

I have installed vsftpd in redhat. Everything was file untill I fould that when I log into ftp server using: ftp localhost or fileZilla I get following errors: ERROR: - 500 OOPS: cannot change ...
0
votes
1answer
53 views

Samba local master browser cannot be found via broadcast

I have a Samba server (CentOS 6.5, Samba 3.6.9) that acts as a local master browser for a workgroup. I issued $ setenforce 0 $ service iptables stop to disable SELinux and get rid of the firewall. ...
1
vote
1answer
27 views

Httpd can't access file even after setting httpd_sys_content_t

I'm currently learning SELinux. I was following the instructions in SELinux doc of RedHat. I indeed succeded after typing the following commands: mkdir /mywebsite //add something to ...
1
vote
1answer
31 views

Is there a selinux, httpd, or PHP configuration that prevents reading mounted drives?

I'm moving a virtualized centos web server over that has an all-to-small hard drive to a new machine and I hooked up a bigger drive for hosting videos and downloads and stuff. W When I try to run a ...
0
votes
1answer
13 views

Applications running under SELinux that access NonPosix drives

I am looking to use either AppArmor or SELinux. Of what I've seen so far I think I prefer SELinux, but there is one thing that does concern me, that is accessing NonPosix partitions. Let us look at a ...
1
vote
0answers
16 views

How to do restorecon -f recursively?

I have tried both with a file and using standard input, and it seems it is impossible to get restorecon -r -f [file|-] to do anything at all. Is this possible?
2
votes
1answer
38 views

SELinux httpd write access to a directory

I am new to SELinux. came from debian. I want to give httpd access to a directory. SELinux Alert Browser suggests: # grep httpd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp ...
0
votes
1answer
138 views

Centos 6.5, openvpn port and SElinux

I am configuring an openvpn server on a new centos 6.5. But the main problem is that selinux is blocking openvpn to use the default port tcp 1194. The following is the sealert -a ...
1
vote
1answer
40 views

Why does the SELinux filesystem have it's own null device?

Looking through /sys/fs/selinux, I found this: # ls -l /sys/fs/selinux/null crw-rw-rw-. 1 root root 1, 3 Jan 24 02:47 /sys/fs/selinux/null Which is identical to /dev/null: # ls -l /dev/null ...
1
vote
1answer
26 views

Using passwordless ssh on CentOS 6

I have a fresh install of CentOS 6 that I am trying to connect to using ssh without a password. But each time I try to login, I am asked for the password. Here are the commands in order: ssh-keygen ...
1
vote
0answers
892 views

Issues with Fedora 20 and bumblebee

I'm experiencing several issues trying to use my Fedora 20 laptop NVIDIA Optimus technology. My system: ASUS N53S Fedora 20 x86-64 3.12.6-300.fc20.x86_64 Kernel Intel Core i7-2670QM NVIDIA Geforce ...
1
vote
1answer
44 views

SELinux and Trusted OS - can SELinux be confined to hardware level root?

I am exploring on SE Linux and while doing so i found it as an example of Trusted OS. Is it really an example of Trusted OS stack like TrouSerS ? SELinux as per my understanding modifies the Linux ...
1
vote
2answers
61 views

What is the difference between lhome and home, and is it causing my SSH key authentication to fail?

I have RHEL running on a system with my account having the root privilege. My home directory is in /lhome/myusername. If I try to add any user their home directory is created in /home/newuser. What ...
3
votes
2answers
73 views

Are there other LSM (Linux Security Modules) in addition to SELinux and AppArmor?

In researching this U&L Q&A titled: permission denied for ptrace under GDB, the question came up, "Is there other software similar to SELinux & AppArmor?". User @IwillnotexistIdonotexist ...
4
votes
1answer
115 views

Myth or reality: SELinux can confine the root user?

I read or heard somewhere (maybe in LinuxCBT's SELinux course; but I'm not sure) that there are online Linux servers, for which the password of the root user is also given. The Linux server is ...
3
votes
2answers
503 views

Running Viber as another user while using “mine” X Server's microphine and speakers

I run Fedora with GNOME and recently installed Viber for linux. It's very good and all is working just fine. As Viber is not open-source software, I decided to run it as another user to make sure ...
1
vote
5answers
128 views

Can I stop SElinux from working?

I suspect that SElinux is backdoor and I want to stop it from working on my system. I want to stop it and delete it from the system also if that is possible. Questions How can I delete it without ...
2
votes
1answer
328 views

MySQL permission denied error even after setting security context for SELinux on VM

I have MySQL installed on CentOS (detail versions given below). My OS is a VM machine and not a physical machine, the directory /data/mysql is a local disk (virtual). I suspect I might need to do some ...
0
votes
0answers
29 views

Fedora - SELinux - livecd-tools

I'm using livecd-tools to build an image and I am able to consistently build images now, but upon bootup and login, I get "no shell - permission denied". After reading about that error, I saw it is ...
3
votes
1answer
76 views

SELinux context of files mounted from a Solaris server

Something I'm attempting to run in RHEL6 fails as a result of SELinux. The problem is temporarily easily solved with "setenforce 0". However turning SELinux off entirely isn't an option in my case. ...
2
votes
1answer
405 views

openvpn[]: Options error: In [CMD-LINE]:1: Error opening configuration file

when trying to service openvpn start Oct 12 14:02:01 ccushing1 openvpn[9091]: Options error: In [CMD-LINE]:1: Error opening configuration file: devnet-client-vm.conf running openvpn ...
1
vote
1answer
76 views

Are there issues concerning trustworthyness of selinux? [closed]

Since selinux is/was? developed by the NSA, and with the current noise around privacy etc concerning said agency, should I be concerned about compromised security on my system?
7
votes
1answer
300 views

LXC containers as a sandbox environment

I am currently starting a project evaluating untrusted programs (student assignments) in a secure sandbox environment. Main idea is to create a web app for GlassFish and Java wrapper around lxc-utils ...
0
votes
0answers
115 views

What is “ /opt/google/chrome/nacl_helper_bootstrap ”mmap_zero“ access”

I am using Fedora 12 Linux (and, yes, it is soon to be updated), and got the message in the image. My question, please nicely, is what does it mean and what should I do about it? the full text of the ...
2
votes
2answers
122 views

SELinux: allow a process to create any file in a certain directory

I have a script that, when invoked, will cause the contents of dmesg to be written to a file, with the file's name basically being a timestamp. SELinux prevents this. Following the advice of ...
1
vote
1answer
120 views

SELinux policy to authorize some users to start / stop certain services

How can I give certain users authorization to start and stop certain services? I am asking specifically about Fedora 19 systems with SELinux installed. The utility to call for services administration ...
6
votes
1answer
344 views

SELinux re-labeling problem while attempting to run OpenVPN

I'm trying to run OpenVPN under Fedora 19 with selinux (selinux-policy-targeted) in enforcing mode, and I'm running into an AVC I'm not entirely sure how to handle. Starting OpenVPN from the command ...
7
votes
1answer
657 views

What is the safe way to allow Java 7 to run on SELinux

Short version: What is the most secure way to allow Java 7 to run on (with?) SELinux? Long version: Sorry in advance if I use incorrect terminology. I'm really just a Java developer with a meager ...
0
votes
1answer
110 views

Installing Domjudge in Fedora 19

I tried to install Domjudge in Fedora 19 (based on its documentation) and it installed successfully but when I try to start it in browser (localhost/domjudge) I get the following error: Forbidden ...
2
votes
0answers
149 views

SELinux: chcon to a type, ls -Z shows another one

When I do chcon -v -t httpd_sys_script_ro_t a_folder_at_home/ And then: ls -dZ I got: DACs user grp unconfined_u:object_r:httpd_sys_content_t:s0 a_folder_at_home/ In case of error I would ...
2
votes
2answers
372 views

scp to /home changes permissions?

This would be illustrated very nicely with an scheme. When I write "Test: OK" or "Test: FAIL" I am restarting apache server (httpd service). Basically, performing everything as root in the ...
2
votes
1answer
706 views

SELinux - allowing rsyslog open/read access to some files

So I've got three files I need rsyslog to open in order to forward the entries to another server. SELinux is preventing this with the following error: type=AVC msg=audit(1371186588.768:1324460): ...
2
votes
1answer
81 views

Configuring SELINUX to allow logging to a file that's outside /var/log

I have a daemon that uses syslog(3) to log to a file that is not a descendant of /var/log. Currently, this requires that SELINUX be disabled. How can I configure an enabled SELINUX to allow this ...
2
votes
1answer
125 views

Restrict applications to access certain hardware (webcam, microphone…)

If I tell applications like VLC or Audacity to record from my webcam or microphone, they just wake the hardware if sleeping and do their work without my interference. Although this is a good thing, ...
2
votes
2answers
436 views

Prevent creating directories but allow creating files

I have a directory shared through Samba. I want users to be able to create/modify/delete files but not create/erase directories. I haven't found a way to do it. Maybe with SELinux? But how?
1
vote
1answer
2k views

SELinux Write access for vsftpd and samba

This should be easy enough I think, but I'm new to SELinux. I have a CentOS 6 file server. I have some LVM file systems at /var/media and I want to use both Samba and FTP to share them with a Windows ...
0
votes
0answers
24 views

PID Grabbing Via LSM Hooks

I am grabbing the LSM hooks in my own created module and showing into the securityfs psuedo filesystem which is showing correctly. The path where these hooks are showing is ...
1
vote
0answers
158 views

403 Forbidden on Sub-Folders

I am a Linux newbie and decided to do a LAMP install to start getting more familiar with it (as our company is moving more towards nix these days). Everything went great and PHPMyAdmin, MySQL, ...
3
votes
2answers
1k views

SELinux: Can I disable copying of certain files?

Please excuse me if this is too basic and you're tempted to throw an RTFM at me. I want to prevent users from copying certain files while granting them read access to the same files. I thought this ...
1
vote
0answers
233 views

selinux, dovecot and sieve

I've just started learning to configure SELINUX and this morning on my CentOS 6.4 x64 system, with postfix/dovecot/mysql installed, I woke up to the following selinux issue found 1 alerts in ...
4
votes
0answers
932 views

Why setsebool command of SELINUX taking so long and slow?

Hi I am new to the SELINUX and I have noticed the command setsebool take longer time than other linux commands. Such as: setsebool -P ftp_home_dir ON Out of curiosity I want to know why "setsebool" ...
1
vote
1answer
729 views

How do I install SELinux's sandbox utility on Linux Mint Debian Edition?

I'm following the Debian SELinux setup guide with my Linux Mint Debian Edition system. I installed the necessary packages: sudo aptitude install selinux-basics selinux-policy-default selinux-utils ...
-1
votes
1answer
723 views

Why setsebool for httpd not working with -P parameter?

I'm trying to disable SELinux for httpd, but when I use the the setsebool command with -P parameter, it doesn't work: setsebool -P http_can_network_connect 1 Nothing happens when I do that ie, the ...
2
votes
1answer
267 views

GDM will not start on boot, unable to login into graphical interface

I am running RHEL 5.8 . SELinux is enabled but in permissive mode. Here are some snippets from /var/log/messages on boot. kernel: type=1400 audit(1360613500.551:6): avc: denied { write } for ...
7
votes
9answers
533 views

How to prevent a process from writing files

I want to run a command on Linux in a way that it cannot create or open any files to write. It should still be able to read files as normal (so an empty chroot is not an option), and still be able to ...
4
votes
1answer
988 views

Gnome terminal fails to start

After upgrading to Fedora 18, on certain occasions, gnome-terminal will fail to launch, requiring me to log out of the desktop and log in again. I tried tracing the error and found the following in ...
1
vote
0answers
186 views

How to set SELinux samba policy to enable dirs deletion/renaming?

I`m lost in trouble with SELinux once more link to my previous solved Q on Samba SELinux When share's users try to delete a dir on share they fail with SELinux advertisement to solve problem do ...