SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

learn more… | top users | synonyms

2
votes
2answers
1k views

openvpn[]: Options error: In [CMD-LINE]:1: Error opening configuration file

when trying to service openvpn start Oct 12 14:02:01 ccushing1 openvpn[9091]: Options error: In [CMD-LINE]:1: Error opening configuration file: devnet-client-vm.conf running openvpn ...
1
vote
2answers
35 views

is there any use for /selinux folder, when I don't use selinux?

I'm using Debian Wheezy, and by default a folder /selinux exists on my filesystem, even though I'm not (knowingly) using any SELinux infrastructure. I know that SELinux is intertwined with some ...
0
votes
0answers
22 views

Cannot label F2FS (SELinux)

I'm running Arch Linux [testing] x86_64 For some reasons, I can't relabel my root file system (F2FS) with SELinux (custom kernel compiled, using refpolicy) Kernel ver $ uname -a ...
2
votes
1answer
3k views

SELinux Write access for vsftpd and samba

This should be easy enough I think, but I'm new to SELinux. I have a CentOS 6 file server. I have some LVM file systems at /var/media and I want to use both Samba and FTP to share them with a Windows ...
2
votes
3answers
9k views

How to create Maildir directory with enough permissions for Postfix?

I have CentOS 5.5 with Postfix installed on it. I want to use local delivery agent with default setting, but I want it to store mail with Maildir directory style mailboxes. When I set the mailboxes ...
3
votes
1answer
435 views

GDM will not start on boot, unable to login into graphical interface

I am running RHEL 5.8 . SELinux is enabled but in permissive mode. Here are some snippets from /var/log/messages on boot. kernel: type=1400 audit(1360613500.551:6): avc: denied { write } for ...
3
votes
1answer
1k views

SELinux - allowing rsyslog open/read access to some files

So I've got three files I need rsyslog to open in order to forward the entries to another server. SELinux is preventing this with the following error: type=AVC msg=audit(1371186588.768:1324460): ...
1
vote
3answers
455 views

How to get Wine to work with SELinux?

I want to run a .msi file on Fedora 17. After installing Wine Windows Program Loader on my Linux machine, it failed to run the file. A check on /var/log/messages shows the following line: Jan 11 ...
1
vote
1answer
40 views

SELinux disabled, net.ipv4.tcp_syncookies and nfs

OS is RHEL 6.2. I appear to be having an issue with SELinux. I've disabled it in /etc/sysconfig/selinux, however, when my host starts the command sestatus show that I'm in permissive mode. Searches ...
3
votes
1answer
58 views

How do I remedy SELinux not allowing legit programs in use access to my system?

I have a system where some programs are getting access denied in SELinux when performing their duties. These programs are ClamAV, fail2ban and Logwatch. I think I've managed to allow all the access ...
1
vote
1answer
27 views

Accidental modified SELinux context on root account to staff_u

I logged in as a normal account(test) on my CentOS 6.5 VM and sudo su - root and run usermod -Z staff_u test but looks like it changed my root account to staff_u as well, now I am stuck, could not ...
1
vote
1answer
32 views

Altermime and SELINUX

I've setup an application called altermime (http://www.pldaniels.com/altermime/) for postfix (SMTP server) which alters emails midstream. I'm injecting a "X-ListUnsubscribe" header into every email ...
0
votes
1answer
61 views

Compiling Awesome from source on CentOS: cannot find libraries

I am trying to install awesome (v3.5.5) on CentOS7. Since I could not find a repository that carries it, I am compiling it from source. However, I am getting this error on running make: -- checking ...
3
votes
2answers
79 views

Cannot delete File on Fedora

I have a file with following permission: -rwSr-s---. 1 1634630331 1818884080 118784 Jun 29 1970 DailyUpdateClass.class If I try to delete this file with root login, I get error. rm: cannot remove ...
0
votes
1answer
75 views

What should be the security context of these cron files?

I am running Fedora 20 and I am having some issues when running logrotate and anacron which I suspect may be related to SELinux: Failed to determine timestamp: Cannot assign requested address chgrp: ...
1
vote
2answers
50 views

How to disable SELinux without restart?

I need to disable SELinux but cannot restart the machine i followed this link where i get bellow command setenforce 0 But agter running this command i checked for that sestatus SELinux status: ...
0
votes
1answer
1k views

Redhat “httpd” can not start anymore. Showing “suEXEC” and “SELinux” notices

I'm on RHEL 6.5 and Apache 2.2.15. When I restart the httpd, I can not start that httpd anymore. Showing following things in the /var/log/httpd/error_log: [Fri Aug 01 18:31:48 2014] [notice] suEXEC ...
11
votes
2answers
2k views

Does SELinux provide enough extra security to be worth the hassle of learning/setting it up?

I recently installed Fedora 14 on my home pc and have been working on setting up different server related features such as apache, mysql, ftp, vpn, ssh, etc. I ran extremely quickly in to a barrier ...
-4
votes
1answer
75 views

Why does Linux come with SELinux?

If SELinux was created by NSA and published by United States Department of Defence then why the hell does it come with the barebone Linux kernel? Isn’t Linux all about security and privacy? Also, is ...
1
vote
1answer
267 views

Scientific Linux 6.3 run evince in SELinux sandbox

I'm trying to run evince in the SELinux sandbox: sandbox -X /usr/bin/evince Unixforpoets.pdf but after waiting for minutes nothing happens, console doesn't outputs anything. So I collected the ...
2
votes
1answer
309 views

/usr/sbin/sendmail: Permission denied

I am trying to setup the mail on my fedora 20. Every time I try to fire a test mail it tells me the permission is denied on /usr/sbin/sendmail. I checked the permissions and this is the output: ...
2
votes
1answer
97 views

Virtual Host only works when SELinux is set to permissive - why?

Wondering why my virtual hosts will only work when SELinux is set to "permissive". When SELinux is set to "enforce" my virtual hosts are ignored and default host is shown. Apache/2.2.15 (Unix) Here ...
3
votes
1answer
213 views

groupadd failure while writing changes to /etc/group

I have been following this guide on installing debian-kit on my Sony Xperia Tablet Z and the installation goes fine until I try to apt-get install andromize which fails with the error groupadd: ...
1
vote
0answers
172 views

Permission denied when running logrotate with anacron

I am trying to figure out what is causing anacron to send me the following error message: /etc/cron.daily/logrotate: /var/log/mariadb/mariadb.log-20140710.gz: Permission denied error: error running ...
3
votes
1answer
109 views

Why does the SELinux filesystem have it's own null device?

Looking through /sys/fs/selinux, I found this: # ls -l /sys/fs/selinux/null crw-rw-rw-. 1 root root 1, 3 Jan 24 02:47 /sys/fs/selinux/null Which is identical to /dev/null: # ls -l /dev/null ...
5
votes
4answers
1k views

Selinux is denying access to mysqld

I have a script that dumps a mysql database. It then compresses the file and this gets stored in my home folder by using cron. The problem is I seem to be getting an error message. mysqldump: ...
1
vote
1answer
126 views

Configure vsftpd allow access to mounted ISO file

I am having problems to allow anonymous FTP access to a directory that mounted a ISO file. No change to /etc/vsftpd/vsftpd.conf RHEL 6.5 DVD ISO file saved to /var/ftp/pub/ISO/rhel6_5.iso ...
3
votes
0answers
207 views

SSH AuthorizedKeysCommand and SELinux

I'm trying to use the SSH AuthorizedKeysCommand in a CentOS 6.5 machine, but I'm encountering an SELinux error. When I switch SELinux to permissive mode - using setenforce 0 - it works, but when I ...
2
votes
1answer
42 views

Create an RPM to distrubute custom SELinux policy

I have created two custom SELinux Policy modules to allow rsyslog to parse audit.log. Can I create an RPM of these two policies to distribute to 300+ clients? Is there a better way to go about this? ...
5
votes
0answers
73 views

Does Android's implementation of SELinux's M.A.C. inhibit root apps with root privileges from accessing app data? [closed]

Starting with Android 4.4 SELinux's MAC is enforced. Does this mean that if an app somehow can get installed and exploit the kernel to get root privileges, that MAC will still prevent that app with ...
7
votes
2answers
702 views

LXC containers as a sandbox environment

I am currently starting a project evaluating untrusted programs (student assignments) in a secure sandbox environment. Main idea is to create a web app for GlassFish and Java wrapper around lxc-utils ...
2
votes
0answers
170 views

After enabling SELinux (permissive mode) on Debian Wheezy, gdm3 does not finish loading

I recently enabled SELinux on my Debian Wheezy system, in permissive mode (I have confirmed that it is indeed operating in permissive mode). However, after the file labelling double-reboot, gdm3 ...
1
vote
0answers
214 views

What's missing with my SELinux installation?

According to Introduction to SELinux, section 14.4.2, SELinux support is built into the standard kernels provided by Debian. The core Unix tools support SELinux without any modifications. I have ...
1
vote
1answer
107 views

SELinux preventing ssh via public key

I have user $USER which is a system user account with an authorized users file. When I have SELinux enabled I am unable to ssh into the server using the public key. If I setenabled 0, $USER can now ...
0
votes
0answers
115 views

SElinux config file missing

Trying to set up mail I found out I have important file missing or it seems I do. First of all I have no selinux in /etc/sysconfig and in /etc/selinux there is folder mls and files restorecond.conf ...
2
votes
0answers
231 views

How does SELinux / SEAndroid prevent or allow pseudo terminal allocation?

I'm trying to resolve an SSH connection issue on an Android phone running SELinux in "Enforcing" mode. The problem is that any SSH connection that tries to allocate a pseudo-terminal (/dev/pts etc) is ...
4
votes
1answer
2k views

Why setsebool command of SELINUX taking so long and slow?

Hi I am new to the SELINUX and I have noticed the command setsebool take longer time than other linux commands. Such as: setsebool -P ftp_home_dir ON Out of curiosity I want to know why "setsebool" ...
6
votes
3answers
2k views

What roles do DAC (file permissions), ACL and MAC (SELinux) play in Linux file security?

I need some clarification/confirmation/elaboration on the different roles DAC, ACL and MAC play in Linux file security. After some research from the documentation, this is my understanding of the ...
3
votes
1answer
263 views

fail2ban permission denied on script

I've just upgraded from RHEL 5 to 6.5 and setup fail2ban anew. I can't seem to get my custom action to work now, supposedly because of a permission issue. I wan't to know what am I doing wrong, and ...
1
vote
1answer
86 views

Can selinux log an application owner name?

So I've set up selinux to log all file access operations in a certain directory. Here's some sample log output when doing an ls from sftp: type=AVC msg=audit(1338465611.221:356): avc: granted { ...
1
vote
0answers
235 views

How to set SELinux samba policy to enable dirs deletion/renaming?

I`m lost in trouble with SELinux once more link to my previous solved Q on Samba SELinux When share's users try to delete a dir on share they fail with SELinux advertisement to solve problem do ...
4
votes
3answers
756 views

Running Viber as another user while using “mine” X Server's microphine and speakers

I run Fedora with GNOME and recently installed Viber for linux. It's very good and all is working just fine. As Viber is not open-source software, I decided to run it as another user to make sure ...
3
votes
1answer
73 views

SELlinux security domains

I'm studying SELinux, but I can't find any clear definition for security domains. What is a security domain and what is its difference with security context?
0
votes
0answers
58 views

Are there any recommended SELinux policies for JBOSS?

I’m looking for tips about defining JBoss policies in SELinux. I saw that OWASP is planning to publish a document about this, but I need some guidance ASAP. Can someone please help?
1
vote
1answer
87 views

Is there a selinux, httpd, or PHP configuration that prevents reading mounted drives?

I'm moving a virtualized centos web server over that has an all-to-small hard drive to a new machine and I hooked up a bigger drive for hosting videos and downloads and stuff. W When I try to run a ...
0
votes
1answer
491 views

Samba local master browser cannot be found via broadcast

I have a Samba server (CentOS 6.5, Samba 3.6.9) that acts as a local master browser for a workgroup. I issued $ setenforce 0 $ service iptables stop to disable SELinux and get rid of the firewall. ...
1
vote
3answers
247 views

Configuring FTP server in redhat

I have installed vsftpd in redhat. Everything was file untill I fould that when I log into ftp server using: ftp localhost or fileZilla I get following errors: ERROR: - 500 OOPS: cannot change ...
1
vote
1answer
430 views

Httpd can't access file even after setting httpd_sys_content_t

I'm currently learning SELinux. I was following the instructions in SELinux doc of RedHat. I indeed succeded after typing the following commands: mkdir /mywebsite //add something to ...
0
votes
1answer
15 views

Applications running under SELinux that access NonPosix drives

I am looking to use either AppArmor or SELinux. Of what I've seen so far I think I prefer SELinux, but there is one thing that does concern me, that is accessing NonPosix partitions. Let us look at a ...
1
vote
0answers
60 views

How to do restorecon -f recursively?

I have tried both with a file and using standard input, and it seems it is impossible to get restorecon -r -f [file|-] to do anything at all. Is this possible?