SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

learn more… | top users | synonyms

2
votes
1answer
22 views

How to read/change SELinux context on mounted ext4 image from non-SELinux system?

I have a Linux system (Arch Linux) without SELinux support. I would not like to configure such support on my system. Now, I have an ext4 volume image which is known to have some SELinux context set on ...
2
votes
0answers
19 views

Benchmarking under SELinux Sandbox with Phoronix Test Suite

I would like to run the Phoronix Test Suite 6.2.2 under the SELinux sandbox on Fedora 23, but I can't execute it using $ sandbox ./phoronix-test-suite. I probably don't have the correct SELinux type. ...
2
votes
2answers
27 views

SELinux, ProFTPd and the silent log

I need a FTP server on my machine, a Fedora 23. I want a simple setup, and I decided for ProFTPd and authentication with mod_auth_unix.c (this is just about my machine). I installed ProFTPd and ...
3
votes
4answers
5k views

openvpn[]: Options error: In [CMD-LINE]:1: Error opening configuration file

when trying to service openvpn start Oct 12 14:02:01 ccushing1 openvpn[9091]: Options error: In [CMD-LINE]:1: Error opening configuration file: devnet-client-vm.conf running openvpn ...
1
vote
0answers
8 views

Adding fcontext to unconfined application

This feels like the most horrid twist of fate ever... A user is having me setup tomEE (apache-tomee-jaxrs-1.7.4). This is on a RHEL6 machine. I've installed from the tarball available from apache's ...
0
votes
2answers
385 views

autofs 'failed to mount autofs path' as service but not manually (selinux)

I'm on CentOS 6.6 and I'm having a strange problem with autofs. I'm trying to mount an smb share on /var/www/html/mysite/docfolder, so I created a docfolder inside the mysite folder, ran chmod 777 on ...
1
vote
0answers
281 views

403 Forbidden on Sub-Folders

I am a Linux newbie and decided to do a LAMP install to start getting more familiar with it (as our company is moving more towards nix these days). Everything went great and PHPMyAdmin, MySQL, ...
4
votes
1answer
263 views

Permission errors even though permissions are wide open

I installed anaconda on our new VM and I can't list its contents. I can change my directory to .../anaconda/ but when I type ls -l I get: ls: cannot open directory .: Permission denied However, ...
1
vote
0answers
6 views

Defining a group of ports for SELinux

At my organization, we use a piece of software for instrumenting and monitoring our servers. Since this piece of software neither supports SELinux nor SystemD, we are currently working on improving ...
5
votes
1answer
764 views

How do I set up the SELinux sandbox in Debian?

I've installed SELinux in Debian sid in order to use the sandbox that locks down apps to a restricted enviroment, but I can't get it to work. If I try to use the sandbox command in permissive mode ...
2
votes
1answer
5k views

SELinux Write access for vsftpd and samba

This should be easy enough I think, but I'm new to SELinux. I have a CentOS 6 file server. I have some LVM file systems at /var/media and I want to use both Samba and FTP to share them with a Windows ...
1
vote
1answer
27 views

SELinux, MySQL, and shared memory

On an SELinux enabled Oracle Linux 6 host, I have a product using MySQL as its underlying database and, through the database, is trying to access /dev/shm. /dev/shm mounts with context tmpfs_t, by ...
0
votes
1answer
2k views

chcon: failed to change context of `/etc/oddjobd.conf.d' to `unconfined_u:object_r:oddjob_t:s0': Permission denied

A friend of mine had trouble with SELinux. The server is configured with SELinux in enforcing mode, using the targeted policy. When using Puppet, restorecon or chcon, he had errors like this, even if ...
0
votes
2answers
30 views

How to isolate my browser?

I want to protect my data against a browser exploit, by forbidding Firefox to access any file beside : ~/.mozilla/ ~/Downloads/ I tried to create another user account with which I would run ...
0
votes
1answer
78 views

Timeouts with authd on CentOS 7

I am currently trying to augment my mailsystem by allowing servers that received mails from me within the last ten seconds to perform ident lookups. While the needed iptables rules are working ...
0
votes
1answer
26 views

SELinux crashed data system

I wanted to change the type of some data for SELinux and I made a typo and sent the following command into the prompt as the root user: semanage fcontext -a -t openvpn _etc_t / Now my system ...
1
vote
1answer
50 views

chcon: can't apply partial context to unlabeled file '/usr/sbin/xrdp'

Sorry guys but I'm not a linux nerd (yet) and whenever I'm trying to execute this line to configure SELinux to install xrdp from this tutorial : ...
0
votes
0answers
20 views

SELinux httpd CentOS

I'm having trouble with SELinux and Apache DokuWiki on my CentOS 7 box. First I was unable to read the html directory contents. I disabled SELinux to test and a test index.html that I placed there ...
0
votes
0answers
16 views

what does policycoreutils-devel do with regards to SElinux in relation to rhcsa

I am studying for the RHCSA exam with multiple supporting materials along with an 'official' course. One of my supplemental materials references installing policycoreutils-devel with relation to the ...
2
votes
1answer
679 views

Permission denied when running logrotate with anacron

I am trying to figure out what is causing anacron to send me the following error message: /etc/cron.daily/logrotate: /var/log/mariadb/mariadb.log-20140710.gz: Permission denied error: error running ...
1
vote
0answers
4 views

SELinux forbits ACPI/udev hook to use sudo

I have a ThinkPad X220 Tablet which has a twistable display. The thinkpad-scripts collection which I wrote with a friend hooks into the hardware event (as root) and then runs a script. This is the ...
1
vote
0answers
12 views

SELinux prevents auto-umount of ecryptfs

I'm running SELinux and ecryptfs on a Debian machine. When a user logs out, unfortunately it's home directory is not unmounted, and I get the following error in audit.log: type=USER_AVC ...
1
vote
1answer
16 views

Filebased SELinux booleans

I'm trying to get numba running on my Debian server in SELinux enforcing mode. Numba is build on LLVMs jit compiler. The problem is, LLVM insists on having memory, which is writeable and executable at ...
4
votes
1answer
33 views

Share host directory between multiple containers vs. SELinux

Sharing a host directory with a docker container usually is easy enough: $ docker create -v /path/to/hostdir:/path/inside/container --name conta ... Things get more complicated, if SELinux is ...
1
vote
0answers
22 views

Selinux inode security struct allocation

i'm trying to understand allocation of inode_security_struct in Selinux. I looked for a source code of selinux and there is only one allocation of this struct on line 230 in hooks.c file. This ...
3
votes
1answer
85 views

SELinux + MergerFS (fuse) not working well together

I have been trying now for several days to get my new server up and running. I am running CentOS with MergerFS to pool my drives and samba to host to my windows machines. All of this running in ...
0
votes
1answer
113 views

HOWTO: Fix “Cannot parse sensitivity level in s0” error when attempting to start a KVM VM after a major OS upgrade

I have a Lenovo ThinkPad T430 running Red Hat Enterprise Linux 6.7 with kernel 2.6.32-573.8.1.el6.x86_64. This is a work computer and my corporate policy states that I must keep my operating system up ...
1
vote
3answers
13k views

Redhat “httpd” can not start anymore. Showing “suEXEC” and “SELinux” notices

I'm on RHEL 6.5 and Apache 2.2.15. When I restart the httpd, I can not start that httpd anymore. Showing following things in the /var/log/httpd/error_log: [Fri Aug 01 18:31:48 2014] [notice] suEXEC ...
1
vote
2answers
4k views

Httpd can't access file even after setting httpd_sys_content_t

I'm currently learning SELinux. I was following the instructions in SELinux doc of RedHat. I indeed succeded after typing the following commands: mkdir /mywebsite //add something to ...
3
votes
1answer
41 views

SELinux not allowing read files on ~/.cert

I'm new to Fedora 23 and SELinux. I use an OpenVPN client through NetworkManager. I stored all the files I needed OpenVPN to access (certificate, CA and private key) inside ~/.cert and ran updatecon ...
5
votes
5answers
15k views

How to create Maildir directory with enough permissions for Postfix?

I have CentOS 5.5 with Postfix installed on it. I want to use local delivery agent with default setting, but I want it to store mail with Maildir directory style mailboxes. When I set the mailboxes ...
0
votes
1answer
238 views

Nvidia drivers not loading correctly on Fedora 23

I just installed the nvidia drivers on fedora 23 (kernels 4.2.3 and 4.3.5), and it worked fine for 1 or 2 restarts, but during my last few reboots, cinnamon has crashed and started in fallback mode ...
3
votes
1answer
105 views

Can using chcon to essentially bypass selinux be less secure than setting selinux to permissive?

I was wondering if it is possible to make a CentOS 7 server less secure by using chcon than it would be if SELinux were in Permissive mode. I am essentially trying to set up Phusion Passenger with ...
10
votes
3answers
4k views

What roles do DAC (file permissions), ACL and MAC (SELinux) play in Linux file security?

I need some clarification/confirmation/elaboration on the different roles DAC, ACL and MAC play in Linux file security. After some research from the documentation, this is my understanding of the ...
0
votes
1answer
28 views

selinux allow port 8332 porttype

selinux is blocking port 8332. Now I want to unlock it. But what porttype do I have to use for an rpc connection? This is the message I get: SELinux is preventing /usr/sbin/php-fpm from name_connect ...
0
votes
0answers
48 views

'syntax error' at token '' on line 6:

I'm quite new to Linux and I need to build a local policy SElinux module. I'm compiling with audit2allow from a file containing the following lines : module lockx11vnc 1.1; require { class ...
1
vote
0answers
15 views

Recreating local selinux contexts after OS Reinstallation

We have added a few specific contexts to our SELinux via the "semanage fcontext ..." command. The patterns are stored in /etc/selinux/targetd/contexts/files/file_contexts.local. Assuming that we ...
1
vote
0answers
26 views

apply proper security labels during filesystem restore

When restoring a filesystem on a separate system (i.e., possibly a different system than the one where the filesystem was originally mounted and in use), I would like to apply the correct security ...
5
votes
1answer
24 views

What are SELinux “.lst” files under /usr/share/selinux/targeted on CentOS 7?

I can see several ".lst" file under /usr/share/selinux/targeted on CentOS 7: base.lst modules-base.lst modules-contrib.lst nonbasemodules.lst ".lst" files contain a list of SELinux policy ...
1
vote
1answer
50 views

SELinux is not logging anywhere

I have SELinux in permissive mode enabled on CentOS7 system. But it doesn't seem to produce any logs. No new files in /var/log/audit, grep -i selinux /var/log/messages* finds nothing. sestatus ...
3
votes
1answer
680 views

GDM will not start on boot, unable to login into graphical interface

I am running RHEL 5.8 . SELinux is enabled but in permissive mode. Here are some snippets from /var/log/messages on boot. kernel: type=1400 audit(1360613500.551:6): avc: denied { write } for ...
2
votes
1answer
48 views

User cron jobs are not being executed any more (perhaps SELinux)

I have the following output as a user running crontab -l: #Ansible: backup-external chaos */20 * * * * flock --nonblock /home/mu/.cache/backup-external.lock backup-external chaos */20 * * * * ...
2
votes
5answers
4k views

How to configure SELinux to print date and time in each entry in audit log?

I'm using CentOS 5.5 and by default my /var/log/audit/audit.log looks like this: type=USER_AUTH msg=audit(1331897657.359:8435): user pid=15610 uid=0 auid=4294967295 ...
1
vote
5answers
271 views

Can I stop SElinux from working?

I suspect that SElinux is backdoor and I want to stop it from working on my system. I want to stop it and delete it from the system also if that is possible. Questions How can I delete it without ...
0
votes
1answer
68 views

no iptables, no selinux, port 81 in virtualhost still not working

I try to open port 81 as a virtualhost. after setting apache, I can CURL localhost:81 from local machine and get response(yes it was listening port 81). However, when visit the same address from ...
0
votes
0answers
51 views

nginx server never resolves

I have set up an nginx server which is a proxy for port 80 to http://127.0.0.1:3000, but the request never gets through. It just infinitely loads. I have tried sudo /sbin/iptables -I INPUT -p tcp -m ...
0
votes
0answers
34 views

Cannot access server outside of server`

I have a node server listening on port 80. If I send a request to it like this: request('http://127.0.0.1:80',function(err,res,data) {console.log(data)}) It works. It returns what I would expect. ...
3
votes
1answer
83 views

Why does audit2why have nothing to do?

I know I have an issue with SElinux. So I am following a tutorial that will help me understand the nature of the file access problems I am having. That was I can still have SElinux enforce as supposed ...
4
votes
0answers
54 views

Wrong role and type on login

I'm on an Ubuntu 14.04 derivative, elementary OS Freya. I have installed and configured SELinux using the selinux-policy-default package, which contains a lot of modules. I've also added my user to ...
0
votes
1answer
126 views

Suitable permissions for owncloud /data directory using nginx under centos

Having the following software: nginx web server centos 7.1 OS owncloud 8 Application https Web Browsing Protocol PHP-FPM After resolving the issue of /config directory permissions, we reached ...