SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

learn more… | top users | synonyms

4
votes
1answer
346 views

How to transition into another domain when invoking sudo?

I have a daemon (collectd) that executes a script for data collection (via smartctl). The exec-plugin of collectd mandates that external scripts are executed under a user != root. The plan is to set ...
1
vote
2answers
84 views

How do I find/list all files on filesystem with a certain SELinux “fcontext”

I'm having trouble finding information on what command, presumably from setools, I should use to find all the files on my filesystem that are labeled by SELinux with a certain file-context (fcontext). ...
1
vote
0answers
143 views

Can't modify or delete SELinux user

I was playing around with user_u in the targeted policy on RHEL 6.5. I'm logged in as root in the unconfined context, so I have full ability to change anything I want. I've also switched to ...
1
vote
1answer
49 views

SELinux Sandbox Usage

What am I doing wrong in the following, from the man file and internet it looks like this is right. $ echo "hello world" 1> test $ sandbox -i test cat test /usr/bin/cat: test: Permission denied
2
votes
0answers
117 views

Acpid event denied by SELinux, how can I savely allow the event without opening security holes?

I installed Fedora (3.17.2-200.fc20.x86_64) on my new Notebook (Lenovo Yoga Pad) and wanted to add this script to trigger whenever I flip over my screen. The script triggered whith the event is ...
1
vote
0answers
117 views

How to get SELinux to prevent Apache/HTTPD from reading specific files

What am I missing with SELinux? I thought it was supposed to be another layer of security but I built a web page vulnerable to command injection and it can basically traverse most of my file system. ...
1
vote
0answers
52 views

SELinux. Prevent Apache/HTTPD from reading specific files.

What am I missing with SELinux, i thought it was suppose to be another layer of security but i built a vulnerable web page vulnerable to command injection and it can basically traverse most of my file ...
2
votes
1answer
2k views

SELinux and OpenVPN?

Having Fedora 20 64-bit installed, I have this old problem of conflicting OpenVPN and SELinux. Obviously SELinux prevents openvpn from launching. The OpenVPN has been set through Network Connection ...
1
vote
2answers
124 views

Enabling SELinux on RHEL

I am using RHEL 6.5 and I need to enable SELinux. I have tried following commands, but it is of no help: $ setenforce 1 $ echo 1 > /selinux/enforce Note: I also tried editing /etc/selinux/config,...
1
vote
2answers
111 views

is there any use for /selinux folder, when I don't use selinux?

I'm using Debian Wheezy, and by default a folder /selinux exists on my filesystem, even though I'm not (knowingly) using any SELinux infrastructure. I know that SELinux is intertwined with some ...
0
votes
0answers
263 views

Cannot label F2FS (SELinux)

I'm running Arch Linux [testing] x86_64 For some reasons, I can't relabel my root file system (F2FS) with SELinux (custom kernel compiled, using refpolicy) Kernel ver $ uname -a ...
1
vote
1answer
238 views

SELinux disabled, net.ipv4.tcp_syncookies and nfs

OS is RHEL 6.2. I appear to be having an issue with SELinux. I've disabled it in /etc/sysconfig/selinux, however, when my host starts the command sestatus show that I'm in permissive mode. Searches ...
3
votes
2answers
245 views

How do I remedy SELinux not allowing legit programs in use access to my system?

I have a system where some programs are getting access denied in SELinux when performing their duties. These programs are ClamAV, fail2ban and Logwatch. I think I've managed to allow all the access ...
1
vote
1answer
149 views

Accidental modified SELinux context on root account to staff_u

I logged in as a normal account(test) on my CentOS 6.5 VM and sudo su - root and run usermod -Z staff_u test but looks like it changed my root account to staff_u as well, now I am stuck, could not ...
1
vote
1answer
245 views

Altermime and SELINUX

I've setup an application called altermime (http://www.pldaniels.com/altermime/) for postfix (SMTP server) which alters emails midstream. I'm injecting a "X-ListUnsubscribe" header into every email ...
1
vote
1answer
536 views

Compiling Awesome from source on CentOS: cannot find libraries

I am trying to install awesome (v3.5.5) on CentOS7. Since I could not find a repository that carries it, I am compiling it from source. However, I am getting this error on running make: -- checking ...
3
votes
2answers
823 views

Cannot delete File on Fedora

I have a file with following permission: -rwSr-s---. 1 1634630331 1818884080 118784 Jun 29 1970 DailyUpdateClass.class If I try to delete this file with root login, I get error. rm: cannot remove ‘...
0
votes
1answer
1k views

What should be the security context of these cron files?

I am running Fedora 20 and I am having some issues when running logrotate and anacron which I suspect may be related to SELinux: Failed to determine timestamp: Cannot assign requested address chgrp: ...
17
votes
3answers
46k views

How to disable SELinux without restart?

I need to disable SELinux but cannot restart the machine i followed this link where i get bellow command setenforce 0 But after running this command i checked for that sestatus SELinux status: ...
-2
votes
1answer
129 views

Why does Linux come with SELinux?

If SELinux was created by NSA and published by United States Department of Defence then why the hell does it come with the barebone Linux kernel? Isn’t Linux all about security and privacy? Also, is ...
1
vote
3answers
15k views

Redhat “httpd” can not start anymore. Showing “suEXEC” and “SELinux” notices

I'm on RHEL 6.5 and Apache 2.2.15. When I restart the httpd, I can not start that httpd anymore. Showing following things in the /var/log/httpd/error_log: [Fri Aug 01 18:31:48 2014] [notice] suEXEC ...
2
votes
1answer
1k views

Virtual Host only works when SELinux is set to permissive - why?

Wondering why my virtual hosts will only work when SELinux is set to "permissive". When SELinux is set to "enforce" my virtual hosts are ignored and default host is shown. Apache/2.2.15 (Unix) Here ...
6
votes
2answers
1k views

groupadd failure while writing changes to /etc/group

I have been following this guide on installing debian-kit on my Sony Xperia Tablet Z and the installation goes fine until I try to apt-get install andromize which fails with the error groupadd: ...
2
votes
1answer
1k views

/usr/sbin/sendmail: Permission denied

I am trying to setup the mail on my fedora 20. Every time I try to fire a test mail it tells me the permission is denied on /usr/sbin/sendmail. I checked the permissions and this is the output: [...
3
votes
1answer
720 views

Permission denied when running logrotate with anacron

I am trying to figure out what is causing anacron to send me the following error message: /etc/cron.daily/logrotate: /var/log/mariadb/mariadb.log-20140710.gz: Permission denied error: error running ...
2
votes
2answers
700 views

Configure vsftpd allow access to mounted ISO file

I am having problems to allow anonymous FTP access to a directory that mounted a ISO file. No change to /etc/vsftpd/vsftpd.conf RHEL 6.5 DVD ISO file saved to /var/ftp/pub/ISO/rhel6_5.iso ...
4
votes
0answers
797 views

SSH AuthorizedKeysCommand and SELinux

I'm trying to use the SSH AuthorizedKeysCommand in a CentOS 6.5 machine, but I'm encountering an SELinux error. When I switch SELinux to permissive mode - using setenforce 0 - it works, but when I ...
2
votes
1answer
80 views

Create an RPM to distribute a custom SELinux policy

I have created two custom SELinux Policy modules to allow rsyslog to parse audit.log. Can I create an RPM of these two policies to distribute to 300+ clients? Is there a better way to go about this? ...
5
votes
0answers
124 views

Does Android's implementation of SELinux's M.A.C. inhibit root apps with root privileges from accessing app data? [closed]

Starting with Android 4.4 SELinux's MAC is enforced. Does this mean that if an app somehow can get installed and exploit the kernel to get root privileges, that MAC will still prevent that app with ...
2
votes
0answers
460 views

After enabling SELinux (permissive mode) on Debian Wheezy, gdm3 does not finish loading

I recently enabled SELinux on my Debian Wheezy system, in permissive mode (I have confirmed that it is indeed operating in permissive mode). However, after the file labelling double-reboot, gdm3 doesn'...
2
votes
0answers
3k views

What's missing with my SELinux installation?

According to Introduction to SELinux, section 14.4.2, SELinux support is built into the standard kernels provided by Debian. The core Unix tools support SELinux without any modifications. I have ...
2
votes
1answer
3k views

SELinux preventing ssh via public key

I have user $USER which is a system user account with an authorized users file. When I have SELinux enabled I am unable to ssh into the server using the public key. If I setenabled 0, $USER can now ...
0
votes
0answers
1k views

SElinux config file missing

Trying to set up mail I found out I have important file missing or it seems I do. First of all I have no selinux in /etc/sysconfig and in /etc/selinux there is folder mls and files restorecond.conf ...
2
votes
0answers
601 views

How does SELinux / SEAndroid prevent or allow pseudo terminal allocation?

I'm trying to resolve an SSH connection issue on an Android phone running SELinux in "Enforcing" mode. The problem is that any SSH connection that tries to allocate a pseudo-terminal (/dev/pts etc) is ...
4
votes
2answers
13k views

PHP on centos 6 not working

I have installed PHP, MySQL, Apache on CentOS 6, now I have restarted the Apache and mysql, to test PHP I have created a index.php on /var/www/html/test/ now once I go to localhost/test/index.php then ...
3
votes
1answer
668 views

fail2ban permission denied on script

I've just upgraded from RHEL 5 to 6.5 and setup fail2ban anew. I can't seem to get my custom action to work now, supposedly because of a permission issue. I wan't to know what am I doing wrong, and ...
3
votes
1answer
229 views

SELlinux security domains

I'm studying SELinux, but I can't find any clear definition for security domains. What is a security domain and what is its difference with security context?
1
vote
3answers
2k views

Configuring FTP server in redhat

I have installed vsftpd in redhat. Everything was file untill I fould that when I log into ftp server using: ftp localhost or fileZilla I get following errors: ERROR: - 500 OOPS: cannot change ...
0
votes
1answer
1k views

Samba local master browser cannot be found via broadcast

I have a Samba server (CentOS 6.5, Samba 3.6.9) that acts as a local master browser for a workgroup. I issued $ setenforce 0 $ service iptables stop to disable SELinux and get rid of the firewall. ...
2
votes
2answers
5k views

Httpd can't access file even after setting httpd_sys_content_t

I'm currently learning SELinux. I was following the instructions in SELinux doc of RedHat. I indeed succeded after typing the following commands: mkdir /mywebsite //add something to /mywebsite/...
1
vote
1answer
351 views

Is there a selinux, httpd, or PHP configuration that prevents reading mounted drives?

I'm moving a virtualized centos web server over that has an all-to-small hard drive to a new machine and I hooked up a bigger drive for hosting videos and downloads and stuff. W When I try to run a ...
0
votes
1answer
21 views

Applications running under SELinux that access NonPosix drives

I am looking to use either AppArmor or SELinux. Of what I've seen so far I think I prefer SELinux, but there is one thing that does concern me, that is accessing NonPosix partitions. Let us look at a ...
1
vote
0answers
259 views

How to do restorecon -f recursively?

I have tried both with a file and using standard input, and it seems it is impossible to get restorecon -r -f [file|-] to do anything at all. Is this possible?
4
votes
2answers
8k views

SELinux httpd write access to a directory

I am new to SELinux. came from debian. I want to give httpd access to a directory. SELinux Alert Browser suggests: # grep httpd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp ...
1
vote
1answer
2k views

“SELinux is preventing /usr/sbin/openvpn from name_bind access on the tcp_socket”

I am configuring an openvpn server on a new centos 6.5. But the main problem is that selinux is blocking openvpn to use the default port tcp 1194. The following is the sealert -a /var/log/audit/audit....
3
votes
1answer
389 views

Why does the SELinux filesystem have it's own null device?

Looking through /sys/fs/selinux, I found this: # ls -l /sys/fs/selinux/null crw-rw-rw-. 1 root root 1, 3 Jan 24 02:47 /sys/fs/selinux/null Which is identical to /dev/null: # ls -l /dev/null crw-rw-...
1
vote
1answer
86 views

Using passwordless ssh on CentOS 6

I have a fresh install of CentOS 6 that I am trying to connect to using ssh without a password. But each time I try to login, I am asked for the password. Here are the commands in order: ssh-keygen ...
1
vote
0answers
2k views

Issues with Fedora 20 and bumblebee

I'm experiencing several issues trying to use my Fedora 20 laptop NVIDIA Optimus technology. My system: ASUS N53S Fedora 20 x86-64 3.12.6-300.fc20.x86_64 Kernel Intel Core i7-2670QM NVIDIA Geforce ...
1
vote
1answer
166 views

SELinux and Trusted OS - can SELinux be confined to hardware level root?

I am exploring on SE Linux and while doing so i found it as an example of Trusted OS. Is it really an example of Trusted OS stack like TrouSerS ? SELinux as per my understanding modifies the Linux ...
1
vote
3answers
172 views

What is the difference between lhome and home, and is it causing my SSH key authentication to fail?

I have RHEL running on a system with my account having the root privilege. My home directory is in /lhome/myusername. If I try to add any user their home directory is created in /home/newuser. What ...