SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.
0
votes
1answer
25 views
SELinux Write access for vsftpd and samba
This should be easy enough I think, but I'm new to SELinux.
I have a CentOS 6 file server. I have some LVM file systems at /var/media and I want to use both Samba and FTP to share them with a Windows ...
3
votes
1answer
171 views
SELinux interfering with host/guest file sharing using KVM
I'm running Fedora 17 with KVM and the virtual machine runs okay. I tried to follow this to get access to a file on the host system but SELinux prevents the VM from accessing any files other than ...
4
votes
2answers
862 views
Selinux is denying access to mysqld
I have a script that dumps a mysql database. It then compresses the file and this gets stored in my home folder by using cron. The problem is I seem to be getting an error message.
mysqldump: ...
1
vote
1answer
174 views
Scientific Linux 6.3 run evince in SELinux sandbox
I'm trying to run evince in the SELinux sandbox:
sandbox -X /usr/bin/evince Unixforpoets.pdf
but after waiting for minutes nothing happens, console doesn't outputs anything. So I collected the ...
0
votes
1answer
123 views
GDM will not start on boot, unable to login into graphical interface
I am running RHEL 5.8 .
SELinux is enabled but in permissive mode. Here are some snippets from /var/log/messages on boot.
kernel: type=1400 audit(1360613500.551:6): avc: denied { write } for ...
0
votes
0answers
16 views
PID Grabbing Via LSM Hooks
I am grabbing the LSM hooks in my own created module and showing into the securityfs psuedo filesystem which is showing correctly.
The path where these hooks are showing is
...
5
votes
2answers
655 views
What roles do DAC (file permissions), ACL and MAC (SELinux) play in Linux file security?
I need some clarification/confirmation/elaboration on the different roles DAC, ACL and MAC play in Linux file security.
After some research from the documentation, this is my understanding of the ...
1
vote
0answers
52 views
403 Forbidden on Sub-Folders
I am a Linux newbie and decided to do a LAMP install to start getting more familiar with it (as our company is moving more towards nix these days). Everything went great and PHPMyAdmin, MySQL, ...
1
vote
2answers
243 views
SELinux: Can I disable copying of certain files?
Please excuse me if this is too basic and you're tempted to throw an RTFM at me.
I want to prevent users from copying certain files while granting them read access to the same files. I thought this ...
1
vote
0answers
102 views
selinux, dovecot and sieve
I've just started learning to configure SELINUX and this morning on my CentOS 6.4 x64 system, with postfix/dovecot/mysql installed, I woke up to the following selinux issue
found 1 alerts in ...
1
vote
0answers
143 views
Why setsebool command of SELINUX taking so long and slow?
Hi I am new to the SELINUX and I have noticed the command setsebool take longer time than other linux commands. Such as:
setsebool -P ftp_home_dir ON
Out of curiosity I want to know why "setsebool" ...
1
vote
1answer
176 views
How do I install SELinux's sandbox utility on Linux Mint Debian Edition?
I'm following the Debian SELinux setup guide with my Linux Mint Debian Edition system. I installed the necessary packages:
sudo aptitude install selinux-basics selinux-policy-default selinux-utils ...
6
votes
2answers
156 views
Make all SELinux contexts permanent
I've done a lot of chcon-ing lately,but if I understand it correctly, these will be erased on the next relabel. Is there any way to make the current contexts (preferably just under a certain ...
5
votes
9answers
257 views
How to prevent a process from writing files
I want to run a command on Linux in a way that it cannot create or open any files to write. It should still be able to read files as normal (so an empty chroot is not an option), and still be able to ...
-1
votes
1answer
66 views
Why setsebool for httpd not working with -P parameter?
I'm trying to disable SELinux for httpd, but when I use the the setsebool command with -P parameter, it doesn't work:
setsebool -P http_can_network_connect 1
Nothing happens when I do that ie, the ...
1
vote
0answers
90 views
How to set SELinux samba policy to enable dirs deletion/renaming?
I`m lost in trouble with SELinux once more link to my previous solved Q on Samba SELinux
When share's users try to delete a dir on share they fail with SELinux advertisement
to solve problem do ...
4
votes
1answer
429 views
Gnome terminal fails to start
After upgrading to Fedora 18, on certain occasions, gnome-terminal will fail to launch, requiring me to log out of the desktop and log in again. I tried tracing the error and found the following in ...
2
votes
1answer
168 views
SELinux - CentOSx86_64: User command limitation
SELinux - CentOSx86_64: User command limitation
Is SELinux the right tool for this job? If so, what is the best way to do it?
I would like to limit a particular user to only running some list of ...
1
vote
0answers
165 views
How to get Wine to work with SELinux?
I want to run a .msi file on Fedora 17. After installing Wine Windows Program Loader on my Linux machine, it failed to run the file. A check on /var/log/messages shows the following line:
Jan 11 ...
6
votes
1answer
124 views
deny any writing to given app and its children
So I have a Python app (which spawns other processes) which I want to deny any writing. It seems like a job for SELinux. Could you describe the steps needed to accomplish this, or perhaps direct me to ...
1
vote
1answer
222 views
SELinux and samba
I have to set SELinux setenforce Permissive in order to give access to my samba share. I wonder if there is proper way to configure SELinux policy for fedora 17 as good admins do.
1
vote
1answer
71 views
How to generate SELinux policies based on logs?
Afaik there is a solution/software that can automatically generate SELinux policies based on logfiles. I just don't know the name of the software/method that can do this..
2
votes
0answers
264 views
Debian: unable to setup SELinux
I'm trying to setup SELinux on Debian 6 according to (the instructions reported on the Debian wiki).
I've run this commands:
apt-get install selinux-basics selinux-policy-default
selinux-activate
...
2
votes
1answer
71 views
To check which resource is being accessed by which process
I have some process running on my system. I need to list out which of the process at a moment has acquired/is using one or more of these in my system:
Ethernet
Camera
USB
Bluetooth
WiFi
File System
...
0
votes
2answers
291 views
Disable SELinux in apache to stop warning
I keep getting this error when I restart httpd:
DocumentRoot does not exist
What else can I do besides disable editing /etc/sysconfig/selinux to fix it?
-4
votes
2answers
206 views
Warning: DocumentRoot does not exist
If I use this code where docroot is my new root for subdomain
$ ls -la --context /var/www/html
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t .
$ chcon -R ...
4
votes
3answers
6k views
How to mount NFS 3 volumes on Fedora 17?
I installed the package nfs-utils and tried it via:
# mount -t nfs server:/mnt /mnt
mount.nfs: rpc.statd is not running but is required for remote locking.
mount.nfs: Either use '-o nolock' to keep ...
2
votes
1answer
134 views
How to convert SELinux mypol.te file to semanage commands for a script
Have setup a special logging directory for MySQL logs. This required me to run the command
grep mysqld /var/log/audit/audit.log | audit2allow -M mypol
a number of times to authorize MySQL to ...
2
votes
1answer
410 views
How to configure SELinux using samba? Scientific Linux?
when I'm trying to mount a read-only samba share, then I get this messages on the samba server (and timeout on client side)
Nov 5 18:45:49 localhost kernel: type=1400 audit(1352137549.469:17): avc: ...
11
votes
3answers
340 views
Prompt user on Linux security denial
Is it possible to make a Linux security module (eg. AppArmor, SELinux etc.) prompt the user, when an application wants to access classified files or folders (digital signatures, SSH keys, credit card ...
1
vote
1answer
731 views
httpd cant write to folder/file because of selinux
Does anyone know which sebool it is to allow httpd write access to /home/user/html?
When I disable selinux echo 0 > /selinux/enforce I can write, so definitely selinux. Just don't know which one is ...
1
vote
1answer
149 views
chcon fails to fix “cannot enable executable stack as shared object requires” err under RHEL6
I have an application I test at work, that has always failed installation on systems with SELinux enabled. Our published workaround involves issuing a chcon command for the library-file at the center ...
3
votes
1answer
285 views
allow webalizer in selinux (centos)
I roughly followed these instructions: http://library.linode.com/web-applications/analytics/webalizer/centos-5 to install and configure webalizer to run on several VirtualHosts. Unfortunately when i ...
3
votes
1answer
360 views
How do I edit a file and preserve its access control list / SELinux security context?
I'm on CentOS 6.2, and have a file with the alternate access method character displayed as a dot.
ls -l myfile
-rwxr-x---. 1 me mygroup 172 Aug 13 10:03 myfile
^
This dot.
...
5
votes
2answers
1k views
Hide processes from other users based on groups (under Linux)?
Is it possible to configure process hiding for certain user groups under a linux system?
For example: Users from group X should not see processes owned by users from group Y in ps/top or under /proc.
...
3
votes
5answers
7k views
Apache won't start on Fedora 15
I can't get Apache to start on Fedora 15. I downloaded a project into /var/www/html and changed myself to the owner (recursively), though I don't think I changed any SELinux contexts or anything like ...
0
votes
1answer
197 views
Why does it take so much time to execute semodule -i mypol.pp?
Command semodule -i mypol.pp takes more than one minute to execute. Why?
2
votes
1answer
322 views
root can only login with bash restricted mode
I was implementing a series of recommendations to 'harden' my linux server, involving lots and lots of changes. Linux is CentOS 6.2, kernel 2.6.32-220.*.
I'm currently using tty2..tty5 (no X/GUI etc) ...
1
vote
0answers
68 views
Can selinux log an application owner name?
So I've set up selinux to log all file access operations in a certain directory. Here's some sample log output when doing an ls from sftp:
type=AVC msg=audit(1338465611.221:356): avc: granted { ...
3
votes
1answer
297 views
SELinux outbound access to other sites with restrictions
We have CentOS 6 configured with SELinux to host a number of websites.
Unfortunately SELinux is preventing websites from accessing (outbound) sites, such as download.wordpress.com to update ...
3
votes
1answer
142 views
Why do SELinux policies require a system restart?
When changing SELinux policies, I've been reading that you're required to restart the system. What changes would require this? Are there certain policy changes that would not require a restart?
2
votes
0answers
286 views
How do I set up the SELinux sandbox in Debian?
I've installed SELinux in Debian sid in order to use the sandbox that locks down apps to a restricted enviroment, but I can't get it to work. If I try to use the sandbox command in permissive mode ...
2
votes
2answers
855 views
How to permamently disable SELinux?
We run a site with big traffic surges and, because of that, SELinux usually thinks that the traffic is a SYN flood attack. We have this same problem on many different CentOS servers.
Despite ...
1
vote
3answers
749 views
How to configure SELinux to print date and time in each entry in audit log?
I'm using CentOS 5.5 and by default my /var/log/audit/audit.log looks like this:
type=USER_AUTH msg=audit(1331897657.359:8435): user pid=15610 uid=0 auid=4294967295 ...
2
votes
1answer
4k views
How to create Maildir directory with enough permissions for Postfix?
I have CentOS 5.5 with Postfix installed on it.
I want to use local delivery agent with default setting, but I want it to store mail with Maildir directory style mailboxes.
When I set the mailboxes ...
6
votes
1answer
343 views
What is the best way to learn SELinux?
I want to learn SELinux to a high level, being able to understand the intricacies of domains, types and switching.
What is the best way to go about this? I considered starting with Fedora and a good ...
1
vote
1answer
97 views
Why does SELinux allow me to read this file?
I appear to be misunderstanding the security levels/categories within SELinux. I have attempted to configure a file that I have read access to (via DAC), but no read access to via SELinux categories.
...
4
votes
2answers
372 views
SELinux denied access
I keep receiving this message from SELinux in a bug report. I am new to Linux, running Fedora 13 and I am learning as I go. Any advice on what this might be would be appreciated.
Summary:
SELinux is ...
3
votes
0answers
186 views
fsarchiver error
I'm running the following fsarchiver command:
$ fsarchiver restfs /tmp/backup/c0d0p2.fsa id=0,dest=/dev/cciss/c0d0p2
I get the following error:
[errno=22, Invalid argument]: ...
3
votes
2answers
162 views
Backup selinux system running strict
I have a cron job that is backing up a SELinux system running in strict mode. The problem is that SELinux wants to deny access to to the backup script since it wants access to every single file on the ...
