SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

learn more… | top users | synonyms

1
vote
2answers
93 views

What is the difference between lhome and home, and is it causing my SSH key authentication to fail?

I have RHEL running on a system with my account having the root privilege. My home directory is in /lhome/myusername. If I try to add any user their home directory is created in /home/newuser. What ...
3
votes
2answers
170 views

Are there other LSM (Linux Security Modules) in addition to SELinux and AppArmor?

In researching this U&L Q&A titled: permission denied for ptrace under GDB, the question came up, "Is there other software similar to SELinux & AppArmor?". User @IwillnotexistIdonotexist ...
4
votes
1answer
287 views

Myth or reality: SELinux can confine the root user?

I read or heard somewhere (maybe in LinuxCBT's SELinux course; but I'm not sure) that there are online Linux servers, for which the password of the root user is also given. The Linux server is ...
4
votes
3answers
824 views

Running Viber as another user while using “mine” X Server's microphine and speakers

I run Fedora with GNOME and recently installed Viber for linux. It's very good and all is working just fine. As Viber is not open-source software, I decided to run it as another user to make sure ...
1
vote
5answers
187 views

Can I stop SElinux from working?

I suspect that SElinux is backdoor and I want to stop it from working on my system. I want to stop it and delete it from the system also if that is possible. Questions How can I delete it without ...
2
votes
1answer
2k views

MySQL permission denied error even after setting security context for SELinux on VM

I have MySQL installed on CentOS (detail versions given below). My OS is a VM machine and not a physical machine, the directory /data/mysql is a local disk (virtual). I suspect I might need to do some ...
0
votes
0answers
70 views

Fedora - SELinux - livecd-tools

I'm using livecd-tools to build an image and I am able to consistently build images now, but upon bootup and login, I get "no shell - permission denied". After reading about that error, I saw it is ...
3
votes
1answer
302 views

SELinux context of files mounted from a Solaris server

Something I'm attempting to run in RHEL6 fails as a result of SELinux. The problem is temporarily easily solved with "setenforce 0". However turning SELinux off entirely isn't an option in my case. ...
2
votes
3answers
1k views

openvpn[]: Options error: In [CMD-LINE]:1: Error opening configuration file

when trying to service openvpn start Oct 12 14:02:01 ccushing1 openvpn[9091]: Options error: In [CMD-LINE]:1: Error opening configuration file: devnet-client-vm.conf running openvpn ...
1
vote
1answer
86 views

Are there issues concerning trustworthyness of selinux? [closed]

Since selinux is/was? developed by the NSA, and with the current noise around privacy etc concerning said agency, should I be concerned about compromised security on my system?
7
votes
2answers
819 views

LXC containers as a sandbox environment

I am currently starting a project evaluating untrusted programs (student assignments) in a secure sandbox environment. Main idea is to create a web app for GlassFish and Java wrapper around lxc-utils ...
3
votes
2answers
303 views

SELinux: allow a process to create any file in a certain directory

I have a script that, when invoked, will cause the contents of dmesg to be written to a file, with the file's name basically being a timestamp. SELinux prevents this. Following the advice of ...
1
vote
1answer
137 views

SELinux policy to authorize some users to start / stop certain services

How can I give certain users authorization to start and stop certain services? I am asking specifically about Fedora 19 systems with SELinux installed. The utility to call for services administration ...
6
votes
1answer
546 views

SELinux re-labeling problem while attempting to run OpenVPN

I'm trying to run OpenVPN under Fedora 19 with selinux (selinux-policy-targeted) in enforcing mode, and I'm running into an AVC I'm not entirely sure how to handle. Starting OpenVPN from the command ...
7
votes
1answer
2k views

What is the safe way to allow Java 7 to run on SELinux

Short version: What is the most secure way to allow Java 7 to run on (with?) SELinux? Long version: Sorry in advance if I use incorrect terminology. I'm really just a Java developer with a meager ...
0
votes
1answer
197 views

Installing Domjudge in Fedora 19

I tried to install Domjudge in Fedora 19 (based on its documentation) and it installed successfully but when I try to start it in browser (localhost/domjudge) I get the following error: Forbidden ...
2
votes
0answers
338 views

SELinux: chcon to a type, ls -Z shows another one

When I do chcon -v -t httpd_sys_script_ro_t a_folder_at_home/ And then: ls -dZ I got: DACs user grp unconfined_u:object_r:httpd_sys_content_t:s0 a_folder_at_home/ In case of error I would ...
2
votes
2answers
589 views

scp to /home changes permissions?

This would be illustrated very nicely with an scheme. When I write "Test: OK" or "Test: FAIL" I am restarting apache server (httpd service). Basically, performing everything as root in the ...
3
votes
1answer
1k views

SELinux - allowing rsyslog open/read access to some files

So I've got three files I need rsyslog to open in order to forward the entries to another server. SELinux is preventing this with the following error: type=AVC msg=audit(1371186588.768:1324460): ...
2
votes
1answer
156 views

Configuring SELINUX to allow logging to a file that's outside /var/log

I have a daemon that uses syslog(3) to log to a file that is not a descendant of /var/log. Currently, this requires that SELINUX be disabled. How can I configure an enabled SELINUX to allow this ...
2
votes
1answer
199 views

Restrict applications to access certain hardware (webcam, microphone…)

If I tell applications like VLC or Audacity to record from my webcam or microphone, they just wake the hardware if sleeping and do their work without my interference. Although this is a good thing, ...
2
votes
3answers
831 views

Prevent creating directories but allow creating files

I have a directory shared through Samba. I want users to be able to create/modify/delete files but not create/erase directories. I haven't found a way to do it. Maybe with SELinux? But how?
1
vote
1answer
3k views

SELinux Write access for vsftpd and samba

This should be easy enough I think, but I'm new to SELinux. I have a CentOS 6 file server. I have some LVM file systems at /var/media and I want to use both Samba and FTP to share them with a Windows ...
1
vote
0answers
213 views

403 Forbidden on Sub-Folders

I am a Linux newbie and decided to do a LAMP install to start getting more familiar with it (as our company is moving more towards nix these days). Everything went great and PHPMyAdmin, MySQL, ...
3
votes
2answers
2k views

SELinux: Can I disable copying of certain files?

Please excuse me if this is too basic and you're tempted to throw an RTFM at me. I want to prevent users from copying certain files while granting them read access to the same files. I thought this ...
1
vote
0answers
344 views

selinux, dovecot and sieve

I've just started learning to configure SELINUX and this morning on my CentOS 6.4 x64 system, with postfix/dovecot/mysql installed, I woke up to the following selinux issue found 1 alerts in ...
6
votes
1answer
2k views

Why setsebool command of SELINUX taking so long and slow?

Hi I am new to the SELINUX and I have noticed the command setsebool take longer time than other linux commands. Such as: setsebool -P ftp_home_dir ON Out of curiosity I want to know why "setsebool" ...
2
votes
1answer
1k views

How do I install SELinux's sandbox utility on Linux Mint Debian Edition?

I'm following the Debian SELinux setup guide with my Linux Mint Debian Edition system. I installed the necessary packages: sudo aptitude install selinux-basics selinux-policy-default selinux-utils ...
-1
votes
1answer
1k views

Why setsebool for httpd not working with -P parameter?

I'm trying to disable SELinux for httpd, but when I use the the setsebool command with -P parameter, it doesn't work: setsebool -P http_can_network_connect 1 Nothing happens when I do that ie, the ...
3
votes
1answer
471 views

GDM will not start on boot, unable to login into graphical interface

I am running RHEL 5.8 . SELinux is enabled but in permissive mode. Here are some snippets from /var/log/messages on boot. kernel: type=1400 audit(1360613500.551:6): avc: denied { write } for ...
7
votes
9answers
929 views

How to prevent a process from writing files

I want to run a command on Linux in a way that it cannot create or open any files to write. It should still be able to read files as normal (so an empty chroot is not an option), and still be able to ...
4
votes
1answer
2k views

Gnome terminal fails to start

After upgrading to Fedora 18, on certain occasions, gnome-terminal will fail to launch, requiring me to log out of the desktop and log in again. I tried tracing the error and found the following in ...
1
vote
0answers
255 views

How to set SELinux samba policy to enable dirs deletion/renaming?

I`m lost in trouble with SELinux once more link to my previous solved Q on Samba SELinux When share's users try to delete a dir on share they fail with SELinux advertisement to solve problem do ...
1
vote
3answers
474 views

How to get Wine to work with SELinux?

I want to run a .msi file on Fedora 17. After installing Wine Windows Program Loader on my Linux machine, it failed to run the file. A check on /var/log/messages shows the following line: Jan 11 ...
4
votes
1answer
561 views

SELinux interfering with host/guest file sharing using KVM

I'm running Fedora 17 with KVM and the virtual machine runs okay. I tried to follow this to get access to a file on the host system but SELinux prevents the VM from accessing any files other than ...
2
votes
1answer
1k views

SELinux and samba

I have to set SELinux setenforce Permissive in order to give access to my samba share. I wonder if there is proper way to configure SELinux policy for fedora 17 as good admins do.
2
votes
1answer
147 views

To check which resource is being accessed by which process

I have some process running on my system. I need to list out which of the process at a moment has acquired/is using one or more of these in my system: Ethernet Camera USB Bluetooth WiFi File System ...
0
votes
2answers
1k views

Disable SELinux in apache to stop warning

I keep getting this error when I restart httpd: DocumentRoot does not exist What else can I do besides disable editing /etc/sysconfig/selinux to fix it?
3
votes
1answer
288 views

SELinux - CentOSx86_64: User command limitation

SELinux - CentOSx86_64: User command limitation Is SELinux the right tool for this job? If so, what is the best way to do it? I would like to limit a particular user to only running some list of ...
2
votes
1answer
414 views

How to convert SELinux mypol.te file to semanage commands for a script

Have setup a special logging directory for MySQL logs. This required me to run the command grep mysqld /var/log/audit/audit.log | audit2allow -M mypol a number of times to authorize MySQL to ...
1
vote
1answer
263 views

How to generate SELinux policies based on logs?

Afaik there is a solution/software that can automatically generate SELinux policies based on logfiles. I just don't know the name of the software/method that can do this..
3
votes
1answer
1k views

How to configure SELinux using samba? Scientific Linux?

when I'm trying to mount a read-only samba share, then I get this messages on the samba server (and timeout on client side) Nov 5 18:45:49 localhost kernel: type=1400 audit(1352137549.469:17): avc: ...
3
votes
1answer
6k views

httpd cant write to folder/file because of selinux

Does anyone know which sebool it is to allow httpd write access to /home/user/html? When I disable selinux echo 0 > /selinux/enforce I can write, so definitely selinux. Just don't know which one is ...
1
vote
1answer
270 views

Scientific Linux 6.3 run evince in SELinux sandbox

I'm trying to run evince in the SELinux sandbox: sandbox -X /usr/bin/evince Unixforpoets.pdf but after waiting for minutes nothing happens, console doesn't outputs anything. So I collected the ...
1
vote
1answer
459 views

chcon fails to fix “cannot enable executable stack as shared object requires” err under RHEL6

I have an application I test at work, that has always failed installation on systems with SELinux enabled. Our published workaround involves issuing a chcon command for the library-file at the center ...
3
votes
1answer
1k views

Debian: unable to set up SELinux

I'm trying to set up SELinux on Debian 6 according to (the instructions reported on the Debian wiki). I've run this commands: apt-get install selinux-basics selinux-policy-default selinux-activate ...
3
votes
2answers
712 views

allow webalizer in selinux (centos)

I roughly followed these instructions: http://library.linode.com/web-applications/analytics/webalizer/centos-5 to install and configure webalizer to run on several VirtualHosts. Unfortunately when i ...
4
votes
1answer
1k views

How do I edit a file and preserve its access control list / SELinux security context?

I'm on CentOS 6.2, and have a file with the alternate access method character displayed as a dot. ls -l myfile -rwxr-x---. 1 me mygroup 172 Aug 13 10:03 myfile ^ This dot. ...
1
vote
1answer
591 views

Why does it take so much time to execute semodule -i mypol.pp?

Command semodule -i mypol.pp takes more than one minute to execute. Why?
5
votes
3answers
10k views

How to mount NFS 3 volumes on Fedora 17?

I installed the package nfs-utils and tried it via: # mount -t nfs server:/mnt /mnt mount.nfs: rpc.statd is not running but is required for remote locking. mount.nfs: Either use '-o nolock' to keep ...