SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

learn more… | top users | synonyms

1
vote
1answer
106 views

Are there issues concerning trustworthyness of selinux? [closed]

Since selinux is/was? developed by the NSA, and with the current noise around privacy etc concerning said agency, should I be concerned about compromised security on my system?
8
votes
2answers
2k views

LXC containers as a sandbox environment

I am currently starting a project evaluating untrusted programs (student assignments) in a secure sandbox environment. Main idea is to create a web app for GlassFish and Java wrapper around lxc-utils ...
3
votes
2answers
863 views

SELinux: allow a process to create any file in a certain directory

I have a script that, when invoked, will cause the contents of dmesg to be written to a file, with the file's name basically being a timestamp. SELinux prevents this. Following the advice of ...
1
vote
1answer
172 views

SELinux policy to authorize some users to start / stop certain services

How can I give certain users authorization to start and stop certain services? I am asking specifically about Fedora 19 systems with SELinux installed. The utility to call for services administration ...
7
votes
1answer
1k views

SELinux re-labeling problem while attempting to run OpenVPN

I'm trying to run OpenVPN under Fedora 19 with selinux (selinux-policy-targeted) in enforcing mode, and I'm running into an AVC I'm not entirely sure how to handle. Starting OpenVPN from the command ...
9
votes
1answer
4k views

What is the safe way to allow Java 7 to run on SELinux

Short version: What is the most secure way to allow Java 7 to run on (with?) SELinux? Long version: Sorry in advance if I use incorrect terminology. I'm really just a Java developer with a meager ...
0
votes
1answer
323 views

Installing Domjudge in Fedora 19

I tried to install Domjudge in Fedora 19 (based on its documentation) and it installed successfully but when I try to start it in browser (localhost/domjudge) I get the following error: Forbidden ...
3
votes
0answers
492 views

SELinux: chcon to a type, ls -Z shows another one

When I do chcon -v -t httpd_sys_script_ro_t a_folder_at_home/ And then: ls -dZ I got: DACs user grp unconfined_u:object_r:httpd_sys_content_t:s0 a_folder_at_home/ In case of error I would ...
2
votes
2answers
849 views

scp to /home changes permissions?

This would be illustrated very nicely with an scheme. When I write "Test: OK" or "Test: FAIL" I am restarting apache server (httpd service). Basically, performing everything as root in the ...
3
votes
1answer
3k views

SELinux - allowing rsyslog open/read access to some files

So I've got three files I need rsyslog to open in order to forward the entries to another server. SELinux is preventing this with the following error: type=AVC msg=audit(1371186588.768:1324460): ...
4
votes
1answer
584 views

Configuring SELINUX to allow logging to a file that's outside /var/log

I have a daemon that uses syslog(3) to log to a file that is not a descendant of /var/log. Currently, this requires that SELINUX be disabled. How can I configure an enabled SELINUX to allow this ...
2
votes
1answer
349 views

Restrict applications to access certain hardware (webcam, microphone…)

If I tell applications like VLC or Audacity to record from my webcam or microphone, they just wake the hardware if sleeping and do their work without my interference. Although this is a good thing, ...
4
votes
3answers
2k views

Prevent creating directories but allow creating files

I have a directory shared through Samba. I want users to be able to create/modify/delete files but not create/erase directories. I haven't found a way to do it. Maybe with SELinux? But how?
2
votes
1answer
5k views

SELinux Write access for vsftpd and samba

This should be easy enough I think, but I'm new to SELinux. I have a CentOS 6 file server. I have some LVM file systems at /var/media and I want to use both Samba and FTP to share them with a Windows ...
1
vote
0answers
282 views

403 Forbidden on Sub-Folders

I am a Linux newbie and decided to do a LAMP install to start getting more familiar with it (as our company is moving more towards nix these days). Everything went great and PHPMyAdmin, MySQL, ...
4
votes
2answers
3k views

SELinux: Can I disable copying of certain files?

Please excuse me if this is too basic and you're tempted to throw an RTFM at me. I want to prevent users from copying certain files while granting them read access to the same files. I thought this ...
4
votes
0answers
600 views

selinux, dovecot and sieve

I've just started learning to configure SELINUX and this morning on my CentOS 6.4 x64 system, with postfix/dovecot/mysql installed, I woke up to the following selinux issue found 1 alerts in ...
8
votes
1answer
5k views

Why setsebool command of SELINUX taking so long and slow?

Hi I am new to the SELINUX and I have noticed the command setsebool take longer time than other linux commands. Such as: setsebool -P ftp_home_dir ON Out of curiosity I want to know why "setsebool" ...
2
votes
1answer
2k views

How do I install SELinux's sandbox utility on Linux Mint Debian Edition?

I'm following the Debian SELinux setup guide with my Linux Mint Debian Edition system. I installed the necessary packages: sudo aptitude install selinux-basics selinux-policy-default selinux-utils ...
-1
votes
1answer
2k views

Why setsebool for httpd not working with -P parameter?

I'm trying to disable SELinux for httpd, but when I use the the setsebool command with -P parameter, it doesn't work: setsebool -P http_can_network_connect 1 Nothing happens when I do that ie, the ...
3
votes
1answer
689 views

GDM will not start on boot, unable to login into graphical interface

I am running RHEL 5.8 . SELinux is enabled but in permissive mode. Here are some snippets from /var/log/messages on boot. kernel: type=1400 audit(1360613500.551:6): avc: denied { write } for ...
9
votes
9answers
2k views

How to prevent a process from writing files

I want to run a command on Linux in a way that it cannot create or open any files to write. It should still be able to read files as normal (so an empty chroot is not an option), and still be able to ...
4
votes
1answer
3k views

Gnome terminal fails to start

After upgrading to Fedora 18, on certain occasions, gnome-terminal will fail to launch, requiring me to log out of the desktop and log in again. I tried tracing the error and found the following in ...
1
vote
0answers
328 views

How to set SELinux samba policy to enable dirs deletion/renaming?

I`m lost in trouble with SELinux once more link to my previous solved Q on Samba SELinux When share's users try to delete a dir on share they fail with SELinux advertisement to solve problem do ...
1
vote
3answers
644 views

How to get Wine to work with SELinux?

I want to run a .msi file on Fedora 17. After installing Wine Windows Program Loader on my Linux machine, it failed to run the file. A check on /var/log/messages shows the following line: Jan 11 ...
4
votes
1answer
1k views

SELinux interfering with host/guest file sharing using KVM

I'm running Fedora 17 with KVM and the virtual machine runs okay. I tried to follow this to get access to a file on the host system but SELinux prevents the VM from accessing any files other than ...
2
votes
1answer
1k views

SELinux and samba

I have to set SELinux setenforce Permissive in order to give access to my samba share. I wonder if there is proper way to configure SELinux policy for fedora 17 as good admins do.
2
votes
1answer
242 views

To check which resource is being accessed by which process

I have some process running on my system. I need to list out which of the process at a moment has acquired/is using one or more of these in my system: Ethernet Camera USB Bluetooth WiFi File System ...
0
votes
2answers
2k views

Disable SELinux in apache to stop warning

I keep getting this error when I restart httpd: DocumentRoot does not exist What else can I do besides disable editing /etc/sysconfig/selinux to fix it?
3
votes
1answer
351 views

SELinux - CentOSx86_64: User command limitation

SELinux - CentOSx86_64: User command limitation Is SELinux the right tool for this job? If so, what is the best way to do it? I would like to limit a particular user to only running some list of ...
2
votes
1answer
691 views

How to convert SELinux mypol.te file to semanage commands for a script

Have setup a special logging directory for MySQL logs. This required me to run the command grep mysqld /var/log/audit/audit.log | audit2allow -M mypol a number of times to authorize MySQL to ...
1
vote
1answer
397 views

How to generate SELinux policies based on logs?

Afaik there is a solution/software that can automatically generate SELinux policies based on logfiles. I just don't know the name of the software/method that can do this..
3
votes
1answer
2k views

How to configure SELinux using samba? Scientific Linux?

when I'm trying to mount a read-only samba share, then I get this messages on the samba server (and timeout on client side) Nov 5 18:45:49 localhost kernel: type=1400 audit(1352137549.469:17): avc: ...
7
votes
3answers
23k views

httpd cant write to folder/file because of selinux

Does anyone know which sebool it is to allow httpd write access to /home/user/html? When I disable selinux echo 0 > /selinux/enforce I can write, so definitely selinux. Just don't know which one is ...
1
vote
1answer
313 views

Scientific Linux 6.3 run evince in SELinux sandbox

I'm trying to run evince in the SELinux sandbox: sandbox -X /usr/bin/evince Unixforpoets.pdf but after waiting for minutes nothing happens, console doesn't outputs anything. So I collected the ...
1
vote
1answer
955 views

chcon fails to fix “cannot enable executable stack as shared object requires” err under RHEL6

I have an application I test at work, that has always failed installation on systems with SELinux enabled. Our published workaround involves issuing a chcon command for the library-file at the center ...
5
votes
1answer
2k views

Debian: unable to set up SELinux

I'm trying to set up SELinux on Debian 6 according to (the instructions reported on the Debian wiki). I've run this commands: apt-get install selinux-basics selinux-policy-default selinux-activate ...
3
votes
2answers
1k views

allow webalizer in selinux (centos)

I roughly followed these instructions: http://library.linode.com/web-applications/analytics/webalizer/centos-5 to install and configure webalizer to run on several VirtualHosts. Unfortunately when i ...
6
votes
1answer
2k views

How do I edit a file and preserve its access control list / SELinux security context?

I'm on CentOS 6.2, and have a file with the alternate access method character displayed as a dot. ls -l myfile -rwxr-x---. 1 me mygroup 172 Aug 13 10:03 myfile ^ This dot. ...
1
vote
1answer
1k views

Why does it take so much time to execute semodule -i mypol.pp?

Command semodule -i mypol.pp takes more than one minute to execute. Why?
5
votes
3answers
13k views

How to mount NFS 3 volumes on Fedora 17?

I installed the package nfs-utils and tried it via: # mount -t nfs server:/mnt /mnt mount.nfs: rpc.statd is not running but is required for remote locking. mount.nfs: Either use '-o nolock' to keep ...
1
vote
1answer
97 views

Can selinux log an application owner name?

So I've set up selinux to log all file access operations in a certain directory. Here's some sample log output when doing an ls from sftp: type=AVC msg=audit(1338465611.221:356): avc: granted { ...
4
votes
1answer
719 views

Why do SELinux policies require a system restart?

When changing SELinux policies, I've been reading that you're required to restart the system. What changes would require this? Are there certain policy changes that would not require a restart?
5
votes
1answer
771 views

How do I set up the SELinux sandbox in Debian?

I've installed SELinux in Debian sid in order to use the sandbox that locks down apps to a restricted enviroment, but I can't get it to work. If I try to use the sandbox command in permissive mode ...
2
votes
1answer
593 views

root can only login with bash restricted mode

I was implementing a series of recommendations to 'harden' my linux server, involving lots and lots of changes. Linux is CentOS 6.2, kernel 2.6.32-220.*. I'm currently using tty2..tty5 (no X/GUI etc) ...
2
votes
5answers
4k views

How to configure SELinux to print date and time in each entry in audit log?

I'm using CentOS 5.5 and by default my /var/log/audit/audit.log looks like this: type=USER_AUTH msg=audit(1331897657.359:8435): user pid=15610 uid=0 auid=4294967295 ...
6
votes
5answers
16k views

How to create Maildir directory with enough permissions for Postfix?

I have CentOS 5.5 with Postfix installed on it. I want to use local delivery agent with default setting, but I want it to store mail with Maildir directory style mailboxes. When I set the mailboxes ...
7
votes
1answer
1k views

What is the best way to learn SELinux?

I want to learn SELinux to a high level, being able to understand the intricacies of domains, types and switching. What is the best way to go about this? I considered starting with Fedora and a good ...
2
votes
1answer
151 views

Why does SELinux allow me to read this file?

I appear to be misunderstanding the security levels/categories within SELinux. I have attempted to configure a file that I have read access to (via DAC), but no read access to via SELinux categories. ...
2
votes
1answer
783 views

SELinux outbound access to other sites with restrictions

We have CentOS 6 configured with SELinux to host a number of websites. Unfortunately SELinux is preventing websites from accessing (outbound) sites, such as download.wordpress.com to update ...