SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

learn more… | top users | synonyms

2
votes
1answer
2k views

SELinux Write access for vsftpd and samba

This should be easy enough I think, but I'm new to SELinux. I have a CentOS 6 file server. I have some LVM file systems at /var/media and I want to use both Samba and FTP to share them with a Windows ...
3
votes
1answer
361 views

GDM will not start on boot, unable to login into graphical interface

I am running RHEL 5.8 . SELinux is enabled but in permissive mode. Here are some snippets from /var/log/messages on boot. kernel: type=1400 audit(1360613500.551:6): avc: denied { write } for ...
2
votes
1answer
116 views

/usr/sbin/sendmail: Permission denied

I am trying to setup the mail on my fedora 20. Every time I try to fire a test mail it tells me the permission is denied on /usr/sbin/sendmail. I checked the permissions and this is the output: ...
2
votes
1answer
19 views

Virtual Host only works when SELinux is set to permissive - why?

Wondering why my virtual hosts will only work when SELinux is set to "permissive". When SELinux is set to "enforce" my virtual hosts are ignored and default host is shown. Apache/2.2.15 (Unix) Here ...
3
votes
1answer
49 views

groupadd failure while writing changes to /etc/group

I have been following this guide on installing debian-kit on my Sony Xperia Tablet Z and the installation goes fine until I try to apt-get install andromize which fails with the error groupadd: ...
1
vote
0answers
38 views

Permission denied when running logrotate with anacron

I am trying to figure out what is causing anacron to send me the following error message: /etc/cron.daily/logrotate: /var/log/mariadb/mariadb.log-20140710.gz: Permission denied error: error running ...
3
votes
1answer
74 views

Why does the SELinux filesystem have it's own null device?

Looking through /sys/fs/selinux, I found this: # ls -l /sys/fs/selinux/null crw-rw-rw-. 1 root root 1, 3 Jan 24 02:47 /sys/fs/selinux/null Which is identical to /dev/null: # ls -l /dev/null ...
5
votes
4answers
1k views

Selinux is denying access to mysqld

I have a script that dumps a mysql database. It then compresses the file and this gets stored in my home folder by using cron. The problem is I seem to be getting an error message. mysqldump: ...
1
vote
3answers
416 views

How to get Wine to work with SELinux?

I want to run a .msi file on Fedora 17. After installing Wine Windows Program Loader on my Linux machine, it failed to run the file. A check on /var/log/messages shows the following line: Jan 11 ...
1
vote
1answer
41 views

Configure vsftpd allow access to mounted ISO file

I am having problems to allow anonymous FTP access to a directory that mounted a ISO file. No change to /etc/vsftpd/vsftpd.conf RHEL 6.5 DVD ISO file saved to /var/ftp/pub/ISO/rhel6_5.iso ...
2
votes
0answers
50 views

SSH AuthorizedKeysCommand and SELinux

I'm trying to use the SSH AuthorizedKeysCommand in a CentOS 6.5 machine, but I'm encountering an SELinux error. When I switch SELinux to permissive mode - using setenforce 0 - it works, but when I ...
1
vote
1answer
252 views

Scientific Linux 6.3 run evince in SELinux sandbox

I'm trying to run evince in the SELinux sandbox: sandbox -X /usr/bin/evince Unixforpoets.pdf but after waiting for minutes nothing happens, console doesn't outputs anything. So I collected the ...
3
votes
1answer
973 views

SELinux - allowing rsyslog open/read access to some files

So I've got three files I need rsyslog to open in order to forward the entries to another server. SELinux is preventing this with the following error: type=AVC msg=audit(1371186588.768:1324460): ...
2
votes
1answer
27 views

Create an RPM to distrubute custom SELinux policy

I have created two custom SELinux Policy modules to allow rsyslog to parse audit.log. Can I create an RPM of these two policies to distribute to 300+ clients? Is there a better way to go about this? ...
5
votes
0answers
49 views

Does Android's implementation of SELinux's M.A.C. inhibit root apps with root privileges from accessing app data?

Starting with Android 4.4 SELinux's MAC is enforced. Does this mean that if an app somehow can get installed and exploit the kernel to get root privileges, that MAC will still prevent that app with ...
7
votes
2answers
525 views

LXC containers as a sandbox environment

I am currently starting a project evaluating untrusted programs (student assignments) in a secure sandbox environment. Main idea is to create a web app for GlassFish and Java wrapper around lxc-utils ...
2
votes
0answers
65 views

After enabling SELinux (permissive mode) on Debian Wheezy, gdm3 does not finish loading

I recently enabled SELinux on my Debian Wheezy system, in permissive mode (I have confirmed that it is indeed operating in permissive mode). However, after the file labelling double-reboot, gdm3 ...
1
vote
0answers
53 views

What's missing with my SELinux installation?

According to Introduction to SELinux, section 14.4.2, SELinux support is built into the standard kernels provided by Debian. The core Unix tools support SELinux without any modifications. I have ...
1
vote
1answer
44 views

SELinux preventing ssh via public key

I have user $USER which is a system user account with an authorized users file. When I have SELinux enabled I am unable to ssh into the server using the public key. If I setenabled 0, $USER can now ...
0
votes
0answers
41 views

SElinux config file missing

Trying to set up mail I found out I have important file missing or it seems I do. First of all I have no selinux in /etc/sysconfig and in /etc/selinux there is folder mls and files restorecond.conf ...
2
votes
0answers
157 views

How does SELinux / SEAndroid prevent or allow pseudo terminal allocation?

I'm trying to resolve an SSH connection issue on an Android phone running SELinux in "Enforcing" mode. The problem is that any SSH connection that tries to allocate a pseudo-terminal (/dev/pts etc) is ...
4
votes
1answer
1k views

Why setsebool command of SELINUX taking so long and slow?

Hi I am new to the SELINUX and I have noticed the command setsebool take longer time than other linux commands. Such as: setsebool -P ftp_home_dir ON Out of curiosity I want to know why "setsebool" ...
6
votes
3answers
1k views

What roles do DAC (file permissions), ACL and MAC (SELinux) play in Linux file security?

I need some clarification/confirmation/elaboration on the different roles DAC, ACL and MAC play in Linux file security. After some research from the documentation, this is my understanding of the ...
3
votes
1answer
91 views

fail2ban permission denied on script

I've just upgraded from RHEL 5 to 6.5 and setup fail2ban anew. I can't seem to get my custom action to work now, supposedly because of a permission issue. I wan't to know what am I doing wrong, and ...
1
vote
1answer
86 views

Can selinux log an application owner name?

So I've set up selinux to log all file access operations in a certain directory. Here's some sample log output when doing an ls from sftp: type=AVC msg=audit(1338465611.221:356): avc: granted { ...
1
vote
0answers
217 views

How to set SELinux samba policy to enable dirs deletion/renaming?

I`m lost in trouble with SELinux once more link to my previous solved Q on Samba SELinux When share's users try to delete a dir on share they fail with SELinux advertisement to solve problem do ...
4
votes
3answers
662 views

Running Viber as another user while using “mine” X Server's microphine and speakers

I run Fedora with GNOME and recently installed Viber for linux. It's very good and all is working just fine. As Viber is not open-source software, I decided to run it as another user to make sure ...
3
votes
1answer
45 views

SELlinux security domains

I'm studying SELinux, but I can't find any clear definition for security domains. What is a security domain and what is its difference with security context?
0
votes
0answers
27 views

Are there any recommended SELinux policies for JBOSS?

I’m looking for tips about defining JBoss policies in SELinux. I saw that OWASP is planning to publish a document about this, but I need some guidance ASAP. Can someone please help?
1
vote
1answer
58 views

Is there a selinux, httpd, or PHP configuration that prevents reading mounted drives?

I'm moving a virtualized centos web server over that has an all-to-small hard drive to a new machine and I hooked up a bigger drive for hosting videos and downloads and stuff. W When I try to run a ...
0
votes
1answer
232 views

Samba local master browser cannot be found via broadcast

I have a Samba server (CentOS 6.5, Samba 3.6.9) that acts as a local master browser for a workgroup. I issued $ setenforce 0 $ service iptables stop to disable SELinux and get rid of the firewall. ...
1
vote
3answers
118 views

Configuring FTP server in redhat

I have installed vsftpd in redhat. Everything was file untill I fould that when I log into ftp server using: ftp localhost or fileZilla I get following errors: ERROR: - 500 OOPS: cannot change ...
1
vote
1answer
137 views

Httpd can't access file even after setting httpd_sys_content_t

I'm currently learning SELinux. I was following the instructions in SELinux doc of RedHat. I indeed succeded after typing the following commands: mkdir /mywebsite //add something to ...
0
votes
1answer
14 views

Applications running under SELinux that access NonPosix drives

I am looking to use either AppArmor or SELinux. Of what I've seen so far I think I prefer SELinux, but there is one thing that does concern me, that is accessing NonPosix partitions. Let us look at a ...
1
vote
0answers
38 views

How to do restorecon -f recursively?

I have tried both with a file and using standard input, and it seems it is impossible to get restorecon -r -f [file|-] to do anything at all. Is this possible?
3
votes
2answers
568 views

allow webalizer in selinux (centos)

I roughly followed these instructions: http://library.linode.com/web-applications/analytics/webalizer/centos-5 to install and configure webalizer to run on several VirtualHosts. Unfortunately when i ...
2
votes
1answer
83 views

SELinux httpd write access to a directory

I am new to SELinux. came from debian. I want to give httpd access to a directory. SELinux Alert Browser suggests: # grep httpd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp ...
0
votes
1answer
549 views

Centos 6.5, openvpn port and SElinux

I am configuring an openvpn server on a new centos 6.5. But the main problem is that selinux is blocking openvpn to use the default port tcp 1194. The following is the sealert -a ...
1
vote
1answer
35 views

Using passwordless ssh on CentOS 6

I have a fresh install of CentOS 6 that I am trying to connect to using ssh without a password. But each time I try to login, I am asked for the password. Here are the commands in order: ssh-keygen ...
1
vote
0answers
1k views

Issues with Fedora 20 and bumblebee

I'm experiencing several issues trying to use my Fedora 20 laptop NVIDIA Optimus technology. My system: ASUS N53S Fedora 20 x86-64 3.12.6-300.fc20.x86_64 Kernel Intel Core i7-2670QM NVIDIA Geforce ...
1
vote
2answers
78 views

What is the difference between lhome and home, and is it causing my SSH key authentication to fail?

I have RHEL running on a system with my account having the root privilege. My home directory is in /lhome/myusername. If I try to add any user their home directory is created in /home/newuser. What ...
1
vote
1answer
62 views

SELinux and Trusted OS - can SELinux be confined to hardware level root?

I am exploring on SE Linux and while doing so i found it as an example of Trusted OS. Is it really an example of Trusted OS stack like TrouSerS ? SELinux as per my understanding modifies the Linux ...
4
votes
1answer
176 views

Myth or reality: SELinux can confine the root user?

I read or heard somewhere (maybe in LinuxCBT's SELinux course; but I'm not sure) that there are online Linux servers, for which the password of the root user is also given. The Linux server is ...
17
votes
2answers
4k views

What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?

I am planning to go back to Linux as a Desktop machine. I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server. What would be a good, ...
2
votes
2answers
8k views

How to create Maildir directory with enough permissions for Postfix?

I have CentOS 5.5 with Postfix installed on it. I want to use local delivery agent with default setting, but I want it to store mail with Maildir directory style mailboxes. When I set the mailboxes ...
3
votes
2answers
118 views

Are there other LSM (Linux Security Modules) in addition to SELinux and AppArmor?

In researching this U&L Q&A titled: permission denied for ptrace under GDB, the question came up, "Is there other software similar to SELinux & AppArmor?". User @IwillnotexistIdonotexist ...
3
votes
1answer
767 views

Debian: unable to set up SELinux

I'm trying to set up SELinux on Debian 6 according to (the instructions reported on the Debian wiki). I've run this commands: apt-get install selinux-basics selinux-policy-default selinux-activate ...
1
vote
5answers
161 views

Can I stop SElinux from working?

I suspect that SElinux is backdoor and I want to stop it from working on my system. I want to stop it and delete it from the system also if that is possible. Questions How can I delete it without ...
2
votes
1answer
702 views

MySQL permission denied error even after setting security context for SELinux on VM

I have MySQL installed on CentOS (detail versions given below). My OS is a VM machine and not a physical machine, the directory /data/mysql is a local disk (virtual). I suspect I might need to do some ...
0
votes
0answers
41 views

Fedora - SELinux - livecd-tools

I'm using livecd-tools to build an image and I am able to consistently build images now, but upon bootup and login, I get "no shell - permission denied". After reading about that error, I saw it is ...