SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

learn more… | top users | synonyms

1
vote
1answer
17 views

Ubuntu SELinux - why different types for files var_t vs file_t

I have Ubuntu 14.04 running on two vm's. I have have permissive SELinux enabled on both. On system1, all of my files + linked directories in /var/www/html are marked as var_t and the symbolic linked ...
0
votes
0answers
18 views

Use sudo in apache with SELinux

I am using CentOS 6.5. using Apache, I want to use sudo in exec. It works when SELinux stopped. how to configure SELinux to permit it. The php script <?php exec('sudo -u newuser ls /',$output); ...
0
votes
2answers
40 views

autofs 'failed to mount autofs path' as service but not manually (selinux)

I'm on CentOS 6.6 and I'm having a strange problem with autofs. I'm trying to mount an smb share on /var/www/html/mysite/docfolder, so I created a docfolder inside the mysite folder, ran chmod 777 on ...
1
vote
1answer
4k views

SELinux Write access for vsftpd and samba

This should be easy enough I think, but I'm new to SELinux. I have a CentOS 6 file server. I have some LVM file systems at /var/media and I want to use both Samba and FTP to share them with a Windows ...
3
votes
1answer
565 views

GDM will not start on boot, unable to login into graphical interface

I am running RHEL 5.8 . SELinux is enabled but in permissive mode. Here are some snippets from /var/log/messages on boot. kernel: type=1400 audit(1360613500.551:6): avc: denied { write } for ...
1
vote
1answer
75 views

How do I troubleshoot these SELinux AVC errors?

Background: I have a CentOS 6 LAMP server. Recently the server has started to become unresponsive every few days. Originally, mysqld would throw a nagios alert and I would be unable to even ssh into ...
5
votes
1answer
172 views

SELinux is preventing /opt/google/chrome/nacl_helper from getattr access on the file /etc/passwd

Is this a bug or a real security concern? It appears to have been discussed but I still don't understand why this is happening and what is being done to address the root cause (I am not going to ...
4
votes
1answer
142 views

Permission errors even permissions are wide open

I installed anaconda on our new VM and I can't list it's contents. I can change my directory to .../anaconda/ but when I type ls -l I get: ls: cannot open directory .: Permission denied However, ...
3
votes
0answers
52 views

What SELinux context shall the script have to be ran by pam_exec?

I just installed Fedora 22 on my VPS and tried to make trivial thing -- run my informer script on every ssh login via pam_exec. But I was confronted with unexpected difficulties: pam_exec failed with ...
3
votes
1answer
251 views

SELinux is preventing /opt/google/chrome/chrome-sandbox from write access on which file?

I keep getting the following error ever since upgrading to Chrome google-chrome-stable-42.0.2311.90-1.x86_64. SELinux is preventing /opt/google/chrome/chrome-sandbox from write access on the ...
1
vote
0answers
58 views

How to understand the security context in “ls -Z”?

After referring "man ls", it shows "ls -Z" can display the security context: -Z, --context Display security context so it fits on most displays. Displays only mode, user, group, security ...
1
vote
1answer
55 views

linux commandline can connect but webserver (or php) can't connect

We can connect to a specific url with linux (centos 6) commandline (curl, wget,...) But we can't connect to it by webserver (apache) or php. I did 'setenforce 0' command, after that webserver and ...
1
vote
0answers
65 views

Where to put the SElinux policy to allow acpid shutdown the system?

I'm using Centos7 minimal. I've installed acpid and the daemon is running. When I hit the power button, I get the following in /var/log/messages May 2 18:52:53 localhost systemd-logind: Power key ...
3
votes
2answers
11k views

httpd cant write to folder/file because of selinux

Does anyone know which sebool it is to allow httpd write access to /home/user/html? When I disable selinux echo 0 > /selinux/enforce I can write, so definitely selinux. Just don't know which one is ...
1
vote
1answer
77 views

Fedora 21 shutdown and reboot error

Recently I have been using Fedora 21 and I have an issue where sometimes I shut down and reboot and the system just hangs at the fedora logo and never actually boots. I noticed the issue after ...
0
votes
1answer
198 views

chcon: failed to change context of `/etc/oddjobd.conf.d' to `unconfined_u:object_r:oddjob_t:s0': Permission denied

A friend of mine had trouble with SELinux. The server is configured with SELinux in enforcing mode, using the targeted policy. When using Puppet, restorecon or chcon, he had errors like this, even if ...
7
votes
2answers
505 views

Myth or reality: SELinux can confine the root user?

I read or heard somewhere (maybe in LinuxCBT's SELinux course; but I'm not sure) that there are online Linux servers, for which the password of the root user is also given. The Linux server is ...
0
votes
0answers
38 views

SELinux context on CentOS 7

I installed CentOS 7 on my server and tried to deploy phpBB. I realized that SELinux was on when the directories were 'Unwritable'. I setenforce to 0 and completed the installation. However I'd like ...
3
votes
1answer
2k views

SELinux - allowing rsyslog open/read access to some files

So I've got three files I need rsyslog to open in order to forward the entries to another server. SELinux is preventing this with the following error: type=AVC msg=audit(1371186588.768:1324460): ...
4
votes
2answers
3k views

How can I configure SELinux when the semanage command isn't found?

I'm having a very hard time configuring SELinux to allow Sending mail. Looking into selinux documentation I've found I can manage ports via the semanage command, but the command can't be found. Is ...
1
vote
0answers
66 views

Cannot execute semanage fcontext --add under Fedora 21 using policy targeted

I cannot add a file contexts to the running SELinux policy using semanage under Fedora 21. When executing the semanage fcontext --add command, I receive an OSError: mf@vienna ~ % sudo semanage ...
2
votes
1answer
45 views

SELinux “training” ( permissive mode logs )

Alright I've been skimming various articles and videos. They all say the same basic thing: start with the default policy, run in permissive to see what needs to be fixed. Then modify your policies to ...
5
votes
1answer
2k views

How do I edit a file and preserve its access control list / SELinux security context?

I'm on CentOS 6.2, and have a file with the alternate access method character displayed as a dot. ls -l myfile -rwxr-x---. 1 me mygroup 172 Aug 13 10:03 myfile ^ This dot. ...
1
vote
2answers
74 views

How to protect against data leak?

We have a few workstations that have access to a network share with all our company files. This is correct, because users may need to use them. However our boss is concerned that someone (upon ...
1
vote
0answers
31 views

SELinux log on Debian Wheezy

I'm currently playing around with SELinux on a Debian Wheezy VM. I've seen a video by a RedHat employee talking about how easy SELinux is to use and that everything will be logged into ...
0
votes
1answer
19 views

kernel security and IDS Firewall + AV together or not?

I try to hardening my server. For doing so, I got a general question: Should I install kernel security patches like selinux and an Anti-Virus with Intrusion Detection Firewall? Does it make sense to ...
1
vote
1answer
186 views

SELinux + logrotate + prerotate = Permission Denied

I have what (should) be a fairly straightforward task: Migrate a set of custom log files to a database at night. I use logrotate (cron.daily) with a simple prerotate task /var/log/myapplog/*.log { ...
3
votes
2answers
2k views

How to permamently disable SELinux?

We run a site with big traffic surges and, because of that, SELinux usually thinks that the traffic is a SYN flood attack. We have this same problem on many different CentOS servers. Despite ...
1
vote
0answers
30 views

What is SELinux's regex type?

I'm trying to locate all files on my system matching an SELinux file context (fcontext). These contexts are specified using some regex, and I'd like to use find -regex ... to the same effect. However, ...
6
votes
2answers
781 views

groupadd failure while writing changes to /etc/group

I have been following this guide on installing debian-kit on my Sony Xperia Tablet Z and the installation goes fine until I try to apt-get install andromize which fails with the error groupadd: ...
0
votes
1answer
77 views

How to put dracut to initframs?

I try to make SElinux permissive. I changed the config from disabled to permissive. However, I guess it does not recognize that change. In the red hat web site, It says : If the system was ...
1
vote
2answers
233 views

Restarting OpenVPN on SELinux by a cronjob

I have a server with some OpenVPN instances (one server, several clients) running on Debian with enforcing SELinux. The connections to some of the VPN servers my machine is connecting to are somewhat ...
1
vote
0answers
51 views

How can I enable ufw automatically on boot?

sudo ufw enable Firewall is active and enabled on system startup sudo ufw status Status: active But after I restart the system and run sudo ufw status, I get the message: Status: inactive How ...
1
vote
3answers
541 views

How to get Wine to work with SELinux?

I want to run a .msi file on Fedora 17. After installing Wine Windows Program Loader on my Linux machine, it failed to run the file. A check on /var/log/messages shows the following line: Jan 11 ...
1
vote
1answer
2k views

“SELinux is preventing /usr/sbin/openvpn from name_bind access on the tcp_socket”

I am configuring an openvpn server on a new centos 6.5. But the main problem is that selinux is blocking openvpn to use the default port tcp 1194. The following is the sealert -a ...
-1
votes
1answer
76 views

Tech expert says you are much safer using Windows than Fedora. [closed]

A tech expert at Michigan State University said today in his talk on campus that with Windows at least you can install ZoneAlarm. Fedora on the other hand has a firewall that is too complex to figure ...
0
votes
0answers
30 views

SELinux: bin_t type socket-application can access http_port_t ports

I am trying to compromising my application (myapp) to use limited ports. For that, I have decided to assign httpd_t type to myapp. So, myapp could use only http_port_t typed ports & I could ...
2
votes
1answer
45 views

SELinux Enforcing is preventing logging into another user account?

I am using Debian 6 with SELinux enabled. After enabling "enforcing" mode in SElinux, I have tried to login into another user account by 'login' command. But, I have been restricted by selinux. ...
1
vote
0answers
59 views

SELinux: 'chcon' is not reflected in another user account

I am using Debian 6 with SELinux enabled. For testing, I have tried to block access to date command for users. Now, I have mapped 'Test_Unix_User' account to 'user_u' SELinux account. 'user_r' can ...
3
votes
2answers
3k views

SELinux httpd write access to a directory

I am new to SELinux. came from debian. I want to give httpd access to a directory. SELinux Alert Browser suggests: # grep httpd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp ...
4
votes
4answers
12k views

How to create Maildir directory with enough permissions for Postfix?

I have CentOS 5.5 with Postfix installed on it. I want to use local delivery agent with default setting, but I want it to store mail with Maildir directory style mailboxes. When I set the mailboxes ...
1
vote
0answers
74 views

how do i build / apply an selinux policy file, on redhat 7?

I'm trying to install RabbitMQ on Redhat Linux 7 (RHEL7). I followed the instructions on the RabbitMQ site, and it installed fine. However, it won't run because SELinux is preventing Erlang from ...
0
votes
2answers
6k views

Redhat “httpd” can not start anymore. Showing “suEXEC” and “SELinux” notices

I'm on RHEL 6.5 and Apache 2.2.15. When I restart the httpd, I can not start that httpd anymore. Showing following things in the /var/log/httpd/error_log: [Fri Aug 01 18:31:48 2014] [notice] suEXEC ...
1
vote
1answer
207 views

Problem running “selinux sandbox” with java

I am trying to sandbox a java application using selinux sandbox. System details: Redhat 6 | x86_64 | no x server install | jdk7 from oracle tar.gz version | cgred and cgconfig are stop The cmd ...
0
votes
0answers
81 views

How to recompile ImageMagick to detect the DELEGATES

I am using Imagemagick(6.4.3.6-7.18.x86_64) in SLES11 SP2 Using it like bellow.. import -window $wid $jpg and getting this error import: DelegateLibrarySupportNotBuiltIn `' (X11) @ ...
1
vote
1answer
44 views

SELinux ignoring configuration?

I'm using Vagrant and VirtualBox to run a CentOS 6.5 VM. In /etc/sysconfig/selinux I have set SELINUX=permissive. However, everytime I restart the VM, sudo getenforce shows SELinux as Enforcing. ...
1
vote
1answer
45 views

SELinux Sandbox Usage

What am I doing wrong in the following, from the man file and internet it looks like this is right. $ echo "hello world" 1> test $ sandbox -i test cat test /usr/bin/cat: test: Permission denied
4
votes
1answer
103 views

How to transition into another domain when invoking sudo?

I have a daemon (collectd) that executes a script for data collection (via smartctl). The exec-plugin of collectd mandates that external scripts are executed under a user != root. The plan is to set ...
1
vote
1answer
37 views

How do I find/list all files on filesystem with a certain SELinux “fcontext”

I'm having trouble finding information on what command, presumably from setools, I should use to find all the files on my filesystem that are labeled by SELinux with a certain file-context (fcontext). ...
1
vote
0answers
50 views

Can't modify or delete SELinux user

I was playing around with user_u in the targeted policy on RHEL 6.5. I'm logged in as root in the unconfined context, so I have full ability to change anything I want. I've also switched to ...