SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

learn more… | top users | synonyms

1
vote
0answers
369 views

How to get Wine to work with SELinux?

I want to run a .msi file on Fedora 17. After installing Wine Windows Program Loader on my Linux machine, it failed to run the file. A check on /var/log/messages shows the following line: Jan 11 ...
4
votes
1answer
350 views

SELinux interfering with host/guest file sharing using KVM

I'm running Fedora 17 with KVM and the virtual machine runs okay. I tried to follow this to get access to a file on the host system but SELinux prevents the VM from accessing any files other than ...
1
vote
1answer
660 views

SELinux and samba

I have to set SELinux setenforce Permissive in order to give access to my samba share. I wonder if there is proper way to configure SELinux policy for fedora 17 as good admins do.
2
votes
1answer
119 views

To check which resource is being accessed by which process

I have some process running on my system. I need to list out which of the process at a moment has acquired/is using one or more of these in my system: Ethernet Camera USB Bluetooth WiFi File System ...
0
votes
2answers
781 views

Disable SELinux in apache to stop warning

I keep getting this error when I restart httpd: DocumentRoot does not exist What else can I do besides disable editing /etc/sysconfig/selinux to fix it?
2
votes
1answer
242 views

SELinux - CentOSx86_64: User command limitation

SELinux - CentOSx86_64: User command limitation Is SELinux the right tool for this job? If so, what is the best way to do it? I would like to limit a particular user to only running some list of ...
2
votes
1answer
286 views

How to convert SELinux mypol.te file to semanage commands for a script

Have setup a special logging directory for MySQL logs. This required me to run the command grep mysqld /var/log/audit/audit.log | audit2allow -M mypol a number of times to authorize MySQL to ...
1
vote
1answer
188 views

How to generate SELinux policies based on logs?

Afaik there is a solution/software that can automatically generate SELinux policies based on logfiles. I just don't know the name of the software/method that can do this..
2
votes
1answer
853 views

How to configure SELinux using samba? Scientific Linux?

when I'm trying to mount a read-only samba share, then I get this messages on the samba server (and timeout on client side) Nov 5 18:45:49 localhost kernel: type=1400 audit(1352137549.469:17): avc: ...
2
votes
1answer
2k views

httpd cant write to folder/file because of selinux

Does anyone know which sebool it is to allow httpd write access to /home/user/html? When I disable selinux echo 0 > /selinux/enforce I can write, so definitely selinux. Just don't know which one is ...
1
vote
1answer
236 views

Scientific Linux 6.3 run evince in SELinux sandbox

I'm trying to run evince in the SELinux sandbox: sandbox -X /usr/bin/evince Unixforpoets.pdf but after waiting for minutes nothing happens, console doesn't outputs anything. So I collected the ...
1
vote
1answer
276 views

chcon fails to fix “cannot enable executable stack as shared object requires” err under RHEL6

I have an application I test at work, that has always failed installation on systems with SELinux enabled. Our published workaround involves issuing a chcon command for the library-file at the center ...
3
votes
1answer
553 views

Debian: unable to set up SELinux

I'm trying to set up SELinux on Debian 6 according to (the instructions reported on the Debian wiki). I've run this commands: apt-get install selinux-basics selinux-policy-default selinux-activate ...
3
votes
2answers
500 views

allow webalizer in selinux (centos)

I roughly followed these instructions: http://library.linode.com/web-applications/analytics/webalizer/centos-5 to install and configure webalizer to run on several VirtualHosts. Unfortunately when i ...
4
votes
1answer
868 views

How do I edit a file and preserve its access control list / SELinux security context?

I'm on CentOS 6.2, and have a file with the alternate access method character displayed as a dot. ls -l myfile -rwxr-x---. 1 me mygroup 172 Aug 13 10:03 myfile ^ This dot. ...
0
votes
1answer
418 views

Why does it take so much time to execute semodule -i mypol.pp?

Command semodule -i mypol.pp takes more than one minute to execute. Why?
5
votes
3answers
9k views

How to mount NFS 3 volumes on Fedora 17?

I installed the package nfs-utils and tried it via: # mount -t nfs server:/mnt /mnt mount.nfs: rpc.statd is not running but is required for remote locking. mount.nfs: Either use '-o nolock' to keep ...
1
vote
0answers
76 views

Can selinux log an application owner name?

So I've set up selinux to log all file access operations in a certain directory. Here's some sample log output when doing an ls from sftp: type=AVC msg=audit(1338465611.221:356): avc: granted { ...
3
votes
1answer
292 views

Why do SELinux policies require a system restart?

When changing SELinux policies, I've been reading that you're required to restart the system. What changes would require this? Are there certain policy changes that would not require a restart?
3
votes
0answers
468 views

How do I set up the SELinux sandbox in Debian?

I've installed SELinux in Debian sid in order to use the sandbox that locks down apps to a restricted enviroment, but I can't get it to work. If I try to use the sandbox command in permissive mode ...
2
votes
1answer
461 views

root can only login with bash restricted mode

I was implementing a series of recommendations to 'harden' my linux server, involving lots and lots of changes. Linux is CentOS 6.2, kernel 2.6.32-220.*. I'm currently using tty2..tty5 (no X/GUI etc) ...
1
vote
3answers
1k views

How to configure SELinux to print date and time in each entry in audit log?

I'm using CentOS 5.5 and by default my /var/log/audit/audit.log looks like this: type=USER_AUTH msg=audit(1331897657.359:8435): user pid=15610 uid=0 auid=4294967295 ...
2
votes
2answers
7k views

How to create Maildir directory with enough permissions for Postfix?

I have CentOS 5.5 with Postfix installed on it. I want to use local delivery agent with default setting, but I want it to store mail with Maildir directory style mailboxes. When I set the mailboxes ...
6
votes
1answer
641 views

What is the best way to learn SELinux?

I want to learn SELinux to a high level, being able to understand the intricacies of domains, types and switching. What is the best way to go about this? I considered starting with Fedora and a good ...
1
vote
1answer
117 views

Why does SELinux allow me to read this file?

I appear to be misunderstanding the security levels/categories within SELinux. I have attempted to configure a file that I have read access to (via DAC), but no read access to via SELinux categories. ...
3
votes
1answer
408 views

SELinux outbound access to other sites with restrictions

We have CentOS 6 configured with SELinux to host a number of websites. Unfortunately SELinux is preventing websites from accessing (outbound) sites, such as download.wordpress.com to update ...
2
votes
2answers
1k views

How to permamently disable SELinux?

We run a site with big traffic surges and, because of that, SELinux usually thinks that the traffic is a SYN flood attack. We have this same problem on many different CentOS servers. Despite ...
6
votes
2answers
299 views

Make all SELinux contexts permanent

I've done a lot of chcon-ing lately,but if I understand it correctly, these will be erased on the next relabel. Is there any way to make the current contexts (preferably just under a certain ...
3
votes
2answers
205 views

Backup selinux system running strict

I have a cron job that is backing up a SELinux system running in strict mode. The problem is that SELinux wants to deny access to to the backup script since it wants access to every single file on the ...
11
votes
3answers
349 views

Prompt user on Linux security denial

Is it possible to make a Linux security module (eg. AppArmor, SELinux etc.) prompt the user, when an application wants to access classified files or folders (digital signatures, SSH keys, credit card ...
4
votes
1answer
6k views

chcon: can't apply partial context to unlabeled file while installing nagios with SELinux

I'm setting up Nagios core on CentOS with SELINUX=enforcing. I try to run chcon -R -t httpd_sys_content_t /usr/local/nagios/sbin/ as suggested in the manual, but I get this error messages: chcon: ...
6
votes
1answer
130 views

deny any writing to given app and its children

So I have a Python app (which spawns other processes) which I want to deny any writing. It seems like a job for SELinux. Could you describe the steps needed to accomplish this, or perhaps direct me to ...
3
votes
2answers
3k views

SELinux stops Google Chrome from executing

I can no longer start Google Chrome on Fedora 14 (using GNOME). strace strace google-chrome ... readlink("/proc/self/exe", "/opt/google/chrome/chrome"..., 4096) = 25 socketpair(PF_FILE, ...
4
votes
4answers
1k views

Selinux is denying access to mysqld

I have a script that dumps a mysql database. It then compresses the file and this gets stored in my home folder by using cron. The problem is I seem to be getting an error message. mysqldump: ...
6
votes
2answers
1k views

What roles do DAC (file permissions), ACL and MAC (SELinux) play in Linux file security?

I need some clarification/confirmation/elaboration on the different roles DAC, ACL and MAC play in Linux file security. After some research from the documentation, this is my understanding of the ...
7
votes
1answer
1k views

What is the proper way to set SELinux context in an RPM .spec?

I am trying to build an RPM that targets RHEL4 and 5. Right now I call chcon from %post but multiple Google entries say "that's not how you are supposed to do it" with very limited help on the right ...
3
votes
3answers
338 views

Output compiler options from SSH

How can I list the configuration options that ssh/sshd was compiled with? I'm attempting to troubleshoot a SELinux configuration issue, and want to make sure that SSH was compiled with ...
5
votes
2answers
770 views

Fedora 15 :Twitter on Google Chrome

It's been almost 15 days since I installed Fedora 15 on my laptop. And since day 1, Twitter seems to be having some issue opening up. Whenever I try to load twitter.com, it loads an "Aw Snap" page. ...
1
vote
1answer
340 views

Which process/program create/write the file which I/O is redirected to?

When learning SELinux, I executed semanage fcontext -l > fcontext.txt under /root directory to dump massive fcontext information to a file. The funny result is: fcontext.txt was created, but the ...
3
votes
5answers
8k views

Apache won't start on Fedora 15

I can't get Apache to start on Fedora 15. I downloaded a project into /var/www/html and changed myself to the owner (recursively), though I don't think I changed any SELinux contexts or anything like ...
11
votes
2answers
2k views

Does SELinux provide enough extra security to be worth the hassle of learning/setting it up?

I recently installed Fedora 14 on my home pc and have been working on setting up different server related features such as apache, mysql, ftp, vpn, ssh, etc. I ran extremely quickly in to a barrier ...
3
votes
1answer
2k views

How can I configure SELinux when the semanage command isn't found?

I'm having a very hard time configuring SELinux to allow Sending mail. Looking into selinux documentation I've found I can manage ports via the semanage command, but the command can't be found. Is ...
3
votes
1answer
2k views

How do I configure SELinux to allow outbound connections from a CGI script?

I'm migrating to a new webserver which has SELinux set up (running Centos 5.5). I've got it set up so that it can execute CGI scripts with no problem, but some of the older Perl based scripts are ...
3
votes
0answers
205 views

fsarchiver error

I'm running the following fsarchiver command: $ fsarchiver restfs /tmp/backup/c0d0p2.fsa id=0,dest=/dev/cciss/c0d0p2 I get the following error: [errno=22, Invalid argument]: ...
16
votes
2answers
3k views

What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?

I am planning to go back to Linux as a Desktop machine. I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server. What would be a good, ...
4
votes
2answers
414 views

SELinux denied access

I keep receiving this message from SELinux in a bug report. I am new to Linux, running Fedora 13 and I am learning as I go. Any advice on what this might be would be appreciated. Summary: SELinux is ...
0
votes
1answer
391 views

Vlc Media Problem in Fedora!

I am using Fedora 13 and my VLC media player is showing this problem for the past one week. How do i rectify this error. Summary: SELinux is preventing /usr/bin/vlc from loading ...
5
votes
2answers
2k views

Hide processes from other users based on groups (under Linux)?

Is it possible to configure process hiding for certain user groups under a linux system? For example: Users from group X should not see processes owned by users from group Y in ps/top or under /proc. ...