SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

learn more… | top users | synonyms

1
vote
1answer
32 views

Do I need to create a module for a new program or just use an existing one?

We have been developing a program at work to be run on a CentOS image. This program is very critical for us, so we need it to run in a very secure context. So, I was thinking of using SELinux to ...
1
vote
0answers
87 views

Unable to emerge SystemD on Hardened/SELinux

I'm on the hardened/linux/amd64/selinux profile on a recent Stage 3 of Gentoo amd64. I'm trying to install SystemD, and I see the following: > emerge -aq sys-apps/ The following mask changes are ...
0
votes
0answers
44 views

Where does samba_share_t come from

I have samba installed, selinux in enforcing mode, samba shares works fine. But I am not sure where samba_share_t is defined? semanage fcontext -l | grep samba_share_t does not return anything. ...
0
votes
1answer
83 views

crontab and selinux

I have Drupal 7 on RHEL 7 and it looks like SELinux blocks crontab. aureport -a showes 90. 11/27/2015 01:32:35 httpd system_u:system_r:httpd_t:s0 87 file unlink system_u:object_r:httpd_log_t:s0 ...
5
votes
1answer
33 views

What are SELinux “.lst” files under /usr/share/selinux/targeted on CentOS 7?

I can see several ".lst" file under /usr/share/selinux/targeted on CentOS 7: base.lst modules-base.lst modules-contrib.lst nonbasemodules.lst ".lst" files contain a list of SELinux policy ...
0
votes
1answer
146 views

HOWTO: Fix “Cannot parse sensitivity level in s0” error when attempting to start a KVM VM after a major OS upgrade

I have a Lenovo ThinkPad T430 running Red Hat Enterprise Linux 6.7 with kernel 2.6.32-573.8.1.el6.x86_64. This is a work computer and my corporate policy states that I must keep my operating system up ...
3
votes
1answer
58 views

Benchmarking With SELinux

I've been performing some benchmarking tasks on freshly installed CentOS machines with SELinux enabled and disabled. The tasks include copying files of various sizes, sending variable amounts of data ...
0
votes
0answers
49 views

Need help deciphering a particular SELinux/AVC error

As a SELinux newbie this avc error ( as generated by ausearch ) has me confused. time->Fri Nov 13 16:04:49 2015 type=PROCTITLE msg=audit(1447452289.136:242): proctitle="/opt/firefox/firefox" type=...
0
votes
2answers
211 views

why isn't .htaccess redirecting requests on CentOS 7?

A web app running on CentOS 7 with Apache 2.4 recently changed its domain name from olddomain.com to newdomain.com. The structure of the app at the newdomain.com is different than on the olddomain....
5
votes
1answer
337 views

how to remove SELinux label?

I added the SELinux label svirt_sandbox_file_t to /home chcon -Rt svirt_sandbox_file_t /home The label is shown using: [user@localhost ~]$ ls -Z unconfined_u:object_r:svirt_sandbox_file_t:s0 ...
3
votes
0answers
133 views

How to create an SELinux exception for individual files

I use a monitoring tool and on one of my systems that is checked remotely, it calls up a script, which in turn runs systemctl to check the status of a service. This was not working until I put SELinux ...
2
votes
0answers
19 views

RHEL / SELinux - Apache unable to write to a directory it can write to [duplicate]

I have a RHEL 7 machine running an Apache web server with multiple virtual hosts on it. I've recently run into an issue where I am unable to upload media, e.g. images / pictures / video, to my machine ...
4
votes
2answers
110 views

How to change service type of well defined ports in SElinux (centOS 6.5)

I need to be able to run SSH on port 23 instead of 22 on CentOS 6.5. SElinux won't allow that, as it has it as tcp/23 defined in policy. Any steps on how can I go about changing service type from ...
3
votes
1answer
316 views

SELinux and chroot system call

TL; DR: This is a question about the final step, in a portable, developer-oriented rooting process, that works across all Android machines. It is not based on any exploit - it is something that we are ...
2
votes
1answer
457 views

Listing and editing the content of /sepolicy

I am in a position to create my own boot image for my Android tablet - which means I can in theory modify the /sepolicy file to, for example, give the shell account that is used by adb shell sessions, ...
4
votes
0answers
116 views

Relocation in a docker volume: svirt_sandbox_file_t and texrel_shlib_t

I run a Docker container with a volume that contains a executable and shared library which requires relocation. I get: error while loading shared libraries: /opt/J9/bin/libj9thr24.so: cannot restore ...
0
votes
0answers
27 views

SELinux policy for ifplugd and udev in Raspbian

I've recently enabled SELinux on my RaspberryPi and recieved some AVCs denials. I'm reading SEL documentation and have resolved a few of them. But I'm not sure if I did it right. So please review my ...
2
votes
2answers
106 views

Does it make sense to use SELinux inside a chroot jail?

Does it make sense to use SELinux inside a chroot jail? I am thinking that since in the chroot jail there should only be the bare minimum, not much else could be compromised. Is there still a benefit ...
0
votes
0answers
22 views

Error while building libxcrypt

I am building the libxcrypt package on my OBS and I am getting the following error: [ 37s] crypt_util.c:268:1: error: type defaults to 'int' in type name [-Werror=implicit-int] [ 37s] crypt_util....
3
votes
0answers
84 views

Sandboxing a binary on linux

I am trying to understand various options I have to restrict/sandbox a binary in Linux. I see that I can use namespaces and cgroups like docker does. I could use SELinux like this link suggests. Which ...
0
votes
1answer
98 views

Executing command in a script as other user takes 10-15 seconds before execution

I start a bash script (synchronously from java as a glassfish user) which starts a command as another user (let's say myUser): #!/bin/bash echo myPassword | su -c "command" myUser & When I ...
2
votes
1answer
81 views

How to use chcon without selinux?

On my system I don't have selinux set up, but I have a removeable disk containing an EXT4 filesystem from a machine that does use selinux. I need to change a file's context on that filesystem. chcon ...
1
vote
2answers
75 views

Ubuntu SELinux - why different types for files var_t vs file_t

I have Ubuntu 14.04 running on two vm's. I have have permissive SELinux enabled on both. On system1, all of my files + linked directories in /var/www/html are marked as var_t and the symbolic linked ...
0
votes
0answers
194 views

Use sudo in apache with SELinux

I am using CentOS 6.5. using Apache, I want to use sudo in exec. It works when SELinux stopped. how to configure SELinux to permit it. The php script <?php exec('sudo -u newuser ls /',$output); ...
0
votes
2answers
444 views

autofs 'failed to mount autofs path' as service but not manually (selinux)

I'm on CentOS 6.6 and I'm having a strange problem with autofs. I'm trying to mount an smb share on /var/www/html/mysite/docfolder, so I created a docfolder inside the mysite folder, ran chmod 777 on ...
4
votes
1answer
314 views

Permission errors even though permissions are wide open

I installed anaconda on our new VM and I can't list its contents. I can change my directory to .../anaconda/ but when I type ls -l I get: ls: cannot open directory .: Permission denied However, ...
4
votes
0answers
241 views

What SELinux context shall the script have to be ran by pam_exec?

I just installed Fedora 22 on my VPS and tried to make trivial thing -- run my informer script on every ssh login via pam_exec. But I was confronted with unexpected difficulties: pam_exec failed with ...
5
votes
1answer
1k views

SELinux is preventing /opt/google/chrome/nacl_helper from getattr access on the file /etc/passwd

Is this a bug or a real security concern? It appears to have been discussed but I still don't understand why this is happening and what is being done to address the root cause (I am not going to ...
4
votes
0answers
403 views

How to understand the security context in “ls -Z”?

After referring "man ls", it shows "ls -Z" can display the security context: -Z, --context Display security context so it fits on most displays. Displays only mode, user, group, security ...
1
vote
1answer
432 views

linux commandline can connect but webserver (or php) can't connect

We can connect to a specific url with linux (centos 6) commandline (curl, wget,...) But we can't connect to it by webserver (apache) or php. I did 'setenforce 0' command, after that webserver and ...
2
votes
0answers
266 views

Where to put the SElinux policy to allow acpid shutdown the system?

I'm using Centos7 minimal. I've installed acpid and the daemon is running. When I hit the power button, I get the following in /var/log/messages May 2 18:52:53 localhost systemd-logind: Power key ...
4
votes
2answers
681 views

SELinux is preventing /opt/google/chrome/chrome-sandbox from write access on which file?

I keep getting the following error ever since upgrading to Chrome google-chrome-stable-42.0.2311.90-1.x86_64. SELinux is preventing /opt/google/chrome/chrome-sandbox from write access on the ...
1
vote
1answer
236 views

Fedora 21 shutdown and reboot error

Recently I have been using Fedora 21 and I have an issue where sometimes I shut down and reboot and the system just hangs at the fedora logo and never actually boots. I noticed the issue after ...
0
votes
1answer
2k views

chcon: failed to change context of `/etc/oddjobd.conf.d' to `unconfined_u:object_r:oddjob_t:s0': Permission denied

A friend of mine had trouble with SELinux. The server is configured with SELinux in enforcing mode, using the targeted policy. When using Puppet, restorecon or chcon, he had errors like this, even if ...
1
vote
0answers
208 views

Cannot execute semanage fcontext --add under Fedora 21 using policy targeted

I cannot add a file contexts to the running SELinux policy using semanage under Fedora 21. When executing the semanage fcontext --add command, I receive an OSError: mf@vienna ~ % sudo semanage ...
1
vote
1answer
693 views

How do I troubleshoot these SELinux AVC errors?

Background: I have a CentOS 6 LAMP server. Recently the server has started to become unresponsive every few days. Originally, mysqld would throw a nagios alert and I would be unable to even ssh into ...
3
votes
1answer
181 views

SELinux “training” ( permissive mode logs )

Alright I've been skimming various articles and videos. They all say the same basic thing: start with the default policy, run in permissive to see what needs to be fixed. Then modify your policies to ...
1
vote
2answers
93 views

How to protect against data leak?

We have a few workstations that have access to a network share with all our company files. This is correct, because users may need to use them. However our boss is concerned that someone (upon ...
1
vote
0answers
62 views

SELinux log on Debian Wheezy

I'm currently playing around with SELinux on a Debian Wheezy VM. I've seen a video by a RedHat employee talking about how easy SELinux is to use and that everything will be logged into /var/log/...
1
vote
0answers
64 views

What is SELinux's regex type?

I'm trying to locate all files on my system matching an SELinux file context (fcontext). These contexts are specified using some regex, and I'd like to use find -regex ... to the same effect. However, ...
2
votes
1answer
892 views

SELinux + logrotate + prerotate = Permission Denied

I have what (should) be a fairly straightforward task: Migrate a set of custom log files to a database at night. I use logrotate (cron.daily) with a simple prerotate task /var/log/myapplog/*.log { ...
1
vote
2answers
450 views

Restarting OpenVPN on SELinux by a cronjob

I have a server with some OpenVPN instances (one server, several clients) running on Debian with enforcing SELinux. The connections to some of the VPN servers my machine is connecting to are somewhat ...
-1
votes
1answer
102 views

Tech expert says you are much safer using Windows than Fedora. [closed]

A tech expert at Michigan State University said today in his talk on campus that with Windows at least you can install ZoneAlarm. Fedora on the other hand has a firewall that is too complex to figure ...
0
votes
1answer
50 views

kernel security and IDS Firewall + AV together or not?

I try to hardening my server. For doing so, I got a general question: Should I install kernel security patches like selinux and an Anti-Virus with Intrusion Detection Firewall? Does it make sense to ...
2
votes
1answer
125 views

SELinux Enforcing is preventing logging into another user account?

I am using Debian 6 with SELinux enabled. After enabling "enforcing" mode in SElinux, I have tried to login into another user account by 'login' command. But, I have been restricted by selinux. ...
1
vote
0answers
151 views

SELinux: 'chcon' is not reflected in another user account

I am using Debian 6 with SELinux enabled. For testing, I have tried to block access to date command for users. Now, I have mapped 'Test_Unix_User' account to 'user_u' SELinux account. 'user_r' can ...
0
votes
1answer
145 views

How to put dracut to initframs?

I try to make SElinux permissive. I changed the config from disabled to permissive. However, I guess it does not recognize that change. In the red hat web site, It says : If the system was ...
1
vote
0answers
146 views

how do i build / apply an selinux policy file, on redhat 7?

I'm trying to install RabbitMQ on Redhat Linux 7 (RHEL7). I followed the instructions on the RabbitMQ site, and it installed fine. However, it won't run because SELinux is preventing Erlang from ...
1
vote
1answer
455 views

Problem running “selinux sandbox” with java

I am trying to sandbox a java application using selinux sandbox. System details: Redhat 6 | x86_64 | no x server install | jdk7 from oracle tar.gz version | cgred and cgconfig are stop The cmd ...
1
vote
1answer
62 views

SELinux ignoring configuration?

I'm using Vagrant and VirtualBox to run a CentOS 6.5 VM. In /etc/sysconfig/selinux I have set SELINUX=permissive. However, everytime I restart the VM, sudo getenforce shows SELinux as Enforcing. Here'...