SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

learn more… | top users | synonyms

5
votes
2answers
421 views

Myth or reality: SELinux can confine the root user?

I read or heard somewhere (maybe in LinuxCBT's SELinux course; but I'm not sure) that there are online Linux servers, for which the password of the root user is also given. The Linux server is ...
0
votes
0answers
12 views

SELinux context on CentOS 7

I installed CentOS 7 on my server and tried to deploy phpBB. I realized that SELinux was on when the directories were 'Unwritable'. I setenforce to 0 and completed the installation. However I'd like ...
1
vote
1answer
4k views

SELinux Write access for vsftpd and samba

This should be easy enough I think, but I'm new to SELinux. I have a CentOS 6 file server. I have some LVM file systems at /var/media and I want to use both Samba and FTP to share them with a Windows ...
3
votes
1answer
2k views

SELinux - allowing rsyslog open/read access to some files

So I've got three files I need rsyslog to open in order to forward the entries to another server. SELinux is preventing this with the following error: type=AVC msg=audit(1371186588.768:1324460): ...
4
votes
2answers
3k views

How can I configure SELinux when the semanage command isn't found?

I'm having a very hard time configuring SELinux to allow Sending mail. Looking into selinux documentation I've found I can manage ports via the semanage command, but the command can't be found. Is ...
1
vote
0answers
13 views

Cannot execute semanage fcontext --add under Fedora 21 using policy targeted

I cannot add a file contexts to the running SELinux policy using semanage under Fedora 21. When executing the semanage fcontext --add command, I receive an OSError: mf@vienna ~ % sudo semanage ...
3
votes
1answer
517 views

GDM will not start on boot, unable to login into graphical interface

I am running RHEL 5.8 . SELinux is enabled but in permissive mode. Here are some snippets from /var/log/messages on boot. kernel: type=1400 audit(1360613500.551:6): avc: denied { write } for ...
0
votes
0answers
22 views

How do I troubleshoot these SELinux AVC errors?

Background: I have a CentOS 6 LAMP server. Recently the server has started to become unresponsive every few days. Originally, mysqld would throw a nagios alert and I would be unable to even ssh into ...
2
votes
1answer
27 views

SELinux “training” ( permissive mode logs )

Alright I've been skimming various articles and videos. They all say the same basic thing: start with the default policy, run in permissive to see what needs to be fixed. Then modify your policies to ...
5
votes
1answer
2k views

How do I edit a file and preserve its access control list / SELinux security context?

I'm on CentOS 6.2, and have a file with the alternate access method character displayed as a dot. ls -l myfile -rwxr-x---. 1 me mygroup 172 Aug 13 10:03 myfile ^ This dot. ...
0
votes
2answers
66 views

How to protect against data leak?

We have a few workstations that have access to a network share with all our company files. This is correct, because users may need to use them. However our boss is concerned that someone (upon ...
1
vote
0answers
22 views

SELinux log on Debian Wheezy

I'm currently playing around with SELinux on a Debian Wheezy VM. I've seen a video by a RedHat employee talking about how easy SELinux is to use and that everything will be logged into ...
0
votes
1answer
13 views

kernel security and IDS Firewall + AV together or not?

I try to hardening my server. For doing so, I got a general question: Should I install kernel security patches like selinux and an Anti-Virus with Intrusion Detection Firewall? Does it make sense to ...
1
vote
1answer
71 views

SELinux + logrotate + prerotate = Permission Denied

I have what (should) be a fairly straightforward task: Migrate a set of custom log files to a database at night. I use logrotate (cron.daily) with a simple prerotate task /var/log/myapplog/*.log { ...
3
votes
2answers
2k views

How to permamently disable SELinux?

We run a site with big traffic surges and, because of that, SELinux usually thinks that the traffic is a SYN flood attack. We have this same problem on many different CentOS servers. Despite ...
1
vote
0answers
25 views

What is SELinux's regex type?

I'm trying to locate all files on my system matching an SELinux file context (fcontext). These contexts are specified using some regex, and I'd like to use find -regex ... to the same effect. However, ...
6
votes
2answers
632 views

groupadd failure while writing changes to /etc/group

I have been following this guide on installing debian-kit on my Sony Xperia Tablet Z and the installation goes fine until I try to apt-get install andromize which fails with the error groupadd: ...
0
votes
1answer
55 views

How to put dracut to initframs?

I try to make SElinux permissive. I changed the config from disabled to permissive. However, I guess it does not recognize that change. In the red hat web site, It says : If the system was ...
1
vote
2answers
160 views

Restarting OpenVPN on SELinux by a cronjob

I have a server with some OpenVPN instances (one server, several clients) running on Debian with enforcing SELinux. The connections to some of the VPN servers my machine is connecting to are somewhat ...
1
vote
0answers
32 views

How can I enable ufw automatically on boot?

sudo ufw enable Firewall is active and enabled on system startup sudo ufw status Status: active But after I restart the system and run sudo ufw status, I get the message: Status: inactive How ...
1
vote
3answers
517 views

How to get Wine to work with SELinux?

I want to run a .msi file on Fedora 17. After installing Wine Windows Program Loader on my Linux machine, it failed to run the file. A check on /var/log/messages shows the following line: Jan 11 ...
1
vote
1answer
2k views

“SELinux is preventing /usr/sbin/openvpn from name_bind access on the tcp_socket”

I am configuring an openvpn server on a new centos 6.5. But the main problem is that selinux is blocking openvpn to use the default port tcp 1194. The following is the sealert -a ...
-1
votes
1answer
68 views

Tech expert says you are much safer using Windows than Fedora. [closed]

A tech expert at Michigan State University said today in his talk on campus that with Windows at least you can install ZoneAlarm. Fedora on the other hand has a firewall that is too complex to figure ...
0
votes
0answers
20 views

SELinux: bin_t type socket-application can access http_port_t ports

I am trying to compromising my application (myapp) to use limited ports. For that, I have decided to assign httpd_t type to myapp. So, myapp could use only http_port_t typed ports & I could ...
2
votes
1answer
30 views

SELinux Enforcing is preventing logging into another user account?

I am using Debian 6 with SELinux enabled. After enabling "enforcing" mode in SElinux, I have tried to login into another user account by 'login' command. But, I have been restricted by selinux. ...
1
vote
0answers
32 views

SELinux: 'chcon' is not reflected in another user account

I am using Debian 6 with SELinux enabled. For testing, I have tried to block access to date command for users. Now, I have mapped 'Test_Unix_User' account to 'user_u' SELinux account. 'user_r' can ...
3
votes
2answers
2k views

SELinux httpd write access to a directory

I am new to SELinux. came from debian. I want to give httpd access to a directory. SELinux Alert Browser suggests: # grep httpd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp ...
4
votes
4answers
11k views

How to create Maildir directory with enough permissions for Postfix?

I have CentOS 5.5 with Postfix installed on it. I want to use local delivery agent with default setting, but I want it to store mail with Maildir directory style mailboxes. When I set the mailboxes ...
1
vote
0answers
51 views

how do i build / apply an selinux policy file, on redhat 7?

I'm trying to install RabbitMQ on Redhat Linux 7 (RHEL7). I followed the instructions on the RabbitMQ site, and it installed fine. However, it won't run because SELinux is preventing Erlang from ...
0
votes
2answers
5k views

Redhat “httpd” can not start anymore. Showing “suEXEC” and “SELinux” notices

I'm on RHEL 6.5 and Apache 2.2.15. When I restart the httpd, I can not start that httpd anymore. Showing following things in the /var/log/httpd/error_log: [Fri Aug 01 18:31:48 2014] [notice] suEXEC ...
1
vote
1answer
149 views

Problem running “selinux sandbox” with java

I am trying to sandbox a java application using selinux sandbox. System details: Redhat 6 | x86_64 | no x server install | jdk7 from oracle tar.gz version | cgred and cgconfig are stop The cmd ...
0
votes
0answers
49 views

How to recompile ImageMagick to detect the DELEGATES

I am using Imagemagick(6.4.3.6-7.18.x86_64) in SLES11 SP2 Using it like bellow.. import -window $wid $jpg and getting this error import: DelegateLibrarySupportNotBuiltIn `' (X11) @ ...
1
vote
1answer
37 views

SELinux ignoring configuration?

I'm using Vagrant and VirtualBox to run a CentOS 6.5 VM. In /etc/sysconfig/selinux I have set SELINUX=permissive. However, everytime I restart the VM, sudo getenforce shows SELinux as Enforcing. ...
1
vote
1answer
44 views

SELinux Sandbox Usage

What am I doing wrong in the following, from the man file and internet it looks like this is right. $ echo "hello world" 1> test $ sandbox -i test cat test /usr/bin/cat: test: Permission denied
4
votes
1answer
69 views

How to transition into another domain when invoking sudo?

I have a daemon (collectd) that executes a script for data collection (via smartctl). The exec-plugin of collectd mandates that external scripts are executed under a user != root. The plan is to set ...
1
vote
1answer
32 views

How do I find/list all files on filesystem with a certain SELinux “fcontext”

I'm having trouble finding information on what command, presumably from setools, I should use to find all the files on my filesystem that are labeled by SELinux with a certain file-context (fcontext). ...
1
vote
0answers
38 views

Can't modify or delete SELinux user

I was playing around with user_u in the targeted policy on RHEL 6.5. I'm logged in as root in the unconfined context, so I have full ability to change anything I want. I've also switched to ...
0
votes
0answers
34 views

SELinux error when yum updated pcre package

When doing a yum update, I got the following errors: Updating : pcre-8.33-7.fc20.i686 82/164 libsepol.module_package_read_offsets: module package header ...
2
votes
3answers
1k views

Prevent creating directories but allow creating files

I have a directory shared through Samba. I want users to be able to create/modify/delete files but not create/erase directories. I haven't found a way to do it. Maybe with SELinux? But how?
1
vote
0answers
44 views

Acpid event denied by SELinux, how can I savely allow the event without opening security holes?

I installed Fedora (3.17.2-200.fc20.x86_64) on my new Notebook (Lenovo Yoga Pad) and wanted to add this script to trigger whenever I flip over my screen. The script triggered whith the event is ...
1
vote
0answers
49 views

How to get SELinux to prevent Apache/HTTPD from reading specific files

What am I missing with SELinux? I thought it was supposed to be another layer of security but I built a web page vulnerable to command injection and it can basically traverse most of my file system. ...
1
vote
0answers
31 views

SELinux. Prevent Apache/HTTPD from reading specific files.

What am I missing with SELinux, i thought it was suppose to be another layer of security but i built a vulnerable web page vulnerable to command injection and it can basically traverse most of my file ...
2
votes
1answer
168 views

SELinux and OpenVPN?

Having Fedora 20 64-bit installed, I have this old problem of conflicting OpenVPN and SELinux. Obviously SELinux prevents openvpn from launching. The OpenVPN has been set through Network Connection ...
1
vote
2answers
57 views

Enabling SELinux on RHEL

I am using RHEL 6.5 and I need to enable SELinux. I have tried following commands, but it is of no help: $ setenforce 1 $ echo 1 > /selinux/enforce Note: I also tried editing ...
3
votes
3answers
2k views

openvpn[]: Options error: In [CMD-LINE]:1: Error opening configuration file

when trying to service openvpn start Oct 12 14:02:01 ccushing1 openvpn[9091]: Options error: In [CMD-LINE]:1: Error opening configuration file: devnet-client-vm.conf running openvpn ...
1
vote
2answers
68 views

is there any use for /selinux folder, when I don't use selinux?

I'm using Debian Wheezy, and by default a folder /selinux exists on my filesystem, even though I'm not (knowingly) using any SELinux infrastructure. I know that SELinux is intertwined with some ...
0
votes
0answers
103 views

Cannot label F2FS (SELinux)

I'm running Arch Linux [testing] x86_64 For some reasons, I can't relabel my root file system (F2FS) with SELinux (custom kernel compiled, using refpolicy) Kernel ver $ uname -a ...
1
vote
1answer
128 views

SELinux disabled, net.ipv4.tcp_syncookies and nfs

OS is RHEL 6.2. I appear to be having an issue with SELinux. I've disabled it in /etc/sysconfig/selinux, however, when my host starts the command sestatus show that I'm in permissive mode. Searches ...
3
votes
1answer
110 views

How do I remedy SELinux not allowing legit programs in use access to my system?

I have a system where some programs are getting access denied in SELinux when performing their duties. These programs are ClamAV, fail2ban and Logwatch. I think I've managed to allow all the access ...
1
vote
1answer
68 views

Accidental modified SELinux context on root account to staff_u

I logged in as a normal account(test) on my CentOS 6.5 VM and sudo su - root and run usermod -Z staff_u test but looks like it changed my root account to staff_u as well, now I am stuck, could not ...