SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

learn more… | top users | synonyms

2
votes
1answer
5k views

SELinux Write access for vsftpd and samba

This should be easy enough I think, but I'm new to SELinux. I have a CentOS 6 file server. I have some LVM file systems at /var/media and I want to use both Samba and FTP to share them with a Windows ...
0
votes
0answers
9 views

How can I protect SELinux labels from being modified?

I'm running Fedora 23. I have SELinux enabled and enforced. I know that you can change a file's labels with restorecon and chcon (and possibly other programs). This is no doubt an avenue by which a ...
2
votes
0answers
27 views

Restrict /proc/mounts to avoid exposure of /run/user/

EDIT: Currently looking at this solution.. (namespaces), but still wouldn't mind any pointers for doing what I'm after another way. We have a custom SELinux policy on CentOS 7.2 which confines users ...
0
votes
1answer
2k views

chcon: failed to change context of `/etc/oddjobd.conf.d' to `unconfined_u:object_r:oddjob_t:s0': Permission denied

A friend of mine had trouble with SELinux. The server is configured with SELinux in enforcing mode, using the targeted policy. When using Puppet, restorecon or chcon, he had errors like this, even if ...
0
votes
0answers
11 views

How long does SELinux relabelling take? [closed]

I've got a 20 GB Fedora virtual machine running in VMware Workstation Player and it's been running for longer than an hour. How long does this take?
1
vote
1answer
23 views

Use SELinux to restrict a directory to a particular user

I have a couple of questions: (Sysadmins tasks) Here is what I asked to do Create user Tim and add him to the supplementary group Webdev (Create the group if it doesn't exist), also Set Tim's ...
0
votes
0answers
12 views

selinux blocking vsftpd directory listing

I am trying to get a better understanding of selinux and configuring a local ftp repository on Centos7. I installed vsftpd on my host. I created a repository on my host: /var/ftp/pub/centos7 EFI ...
0
votes
1answer
55 views

Failed to start PostgreSQL 9.5 with systemctl - SELinux

I've installed PG 9.5 (/usr/pgsql-9.5/) and when I start it manually with postgres -D it has no problems, but if I try to use systemctl I get an error. By looking to journalctl -xen output, I see: /...
1
vote
0answers
23 views

Cannot add group on RHEL desktop

[root@notebook ~]# groupadd testing groupadd: failure while writing changes to /etc/group [root@notebook ~]# grep testing /var/log/audit/audit.log type=ADD_GROUP msg=audit(1465386369.617:2553): pid=...
1
vote
1answer
316 views

chcon: can't apply partial context to unlabeled file '/usr/sbin/xrdp'

Sorry guys but I'm not a linux nerd (yet) and whenever I'm trying to execute this line to configure SELinux to install xrdp from this tutorial : https://www.l3pdu.com/2015/12/linux-for-my-son-how-to-...
0
votes
1answer
32 views

Restart a service through apache

I am using CentOS 6.6 I trying to call service command in PHP code exec("sudo -u kouser bash ./1.bash 2>&1",$output,$code); 1.bash #!/bin/bash sudo service httpd graceful The output of ...
1
vote
3answers
15k views

Redhat “httpd” can not start anymore. Showing “suEXEC” and “SELinux” notices

I'm on RHEL 6.5 and Apache 2.2.15. When I restart the httpd, I can not start that httpd anymore. Showing following things in the /var/log/httpd/error_log: [Fri Aug 01 18:31:48 2014] [notice] suEXEC ...
1
vote
0answers
18 views

How to work out why Apache is attempting “execmem”?

I'm getting audit messages from SELinux saying that it denied Apache doing execmem: type=AVC msg=audit(05/06/16 19:51:43.058:181060) : avc: denied { execmem } for pid=123456 comm=httpd scontext=...
1
vote
1answer
16 views

SELinux restorecon

I am trying to export a Samba share and changing its SELinux fcontext to 'samba_share_t'. However in the guide that I follow after changing the fcontext, I need to run 'restorecon' over the exported ...
4
votes
1answer
630 views

Configuring SELINUX to allow logging to a file that's outside /var/log

I have a daemon that uses syslog(3) to log to a file that is not a descendant of /var/log. Currently, this requires that SELINUX be disabled. How can I configure an enabled SELINUX to allow this ...
1
vote
0answers
28 views

SELINUX not installing on Hyper-V Debian Jessie VM

I'm currently trying to install SELINUX on Debian Jessie VM. I'm following the instructions on the Debian website here Once I've completed the installation, I make a change to /etc/default/rcS to ...
1
vote
0answers
18 views

selinux on squashfs with overlayfs

Is it possible to use SELinux on a system with a squashfs root with an overlayfs overlay for read-write operations? On funtoo (gentoo), I booted with SELinux enabled in permissive mode to see what ...
6
votes
1answer
777 views

How do I set up the SELinux sandbox in Debian?

I've installed SELinux in Debian sid in order to use the sandbox that locks down apps to a restricted enviroment, but I can't get it to work. If I try to use the sandbox command in permissive mode ...
8
votes
1answer
5k views

Why setsebool command of SELINUX taking so long and slow?

Hi I am new to the SELINUX and I have noticed the command setsebool take longer time than other linux commands. Such as: setsebool -P ftp_home_dir ON Out of curiosity I want to know why "setsebool" ...
-6
votes
1answer
26 views

Important files to be backup [closed]

I need to know what is the most important files to be backup in Linux server.
0
votes
0answers
22 views

Can SELinux filter system calls?

Let's say I want to restrict use of the system call shutdown to /sbin/mount or filter the arguments that get passed to the system call mount. Can SELinux policy be used to achieve this?
1
vote
0answers
286 views

403 Forbidden on Sub-Folders

I am a Linux newbie and decided to do a LAMP install to start getting more familiar with it (as our company is moving more towards nix these days). Everything went great and PHPMyAdmin, MySQL, Apache/...
4
votes
2answers
8k views

SELinux httpd write access to a directory

I am new to SELinux. came from debian. I want to give httpd access to a directory. SELinux Alert Browser suggests: # grep httpd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp ...
1
vote
1answer
12 views

Standard Package updates of selinux-policy-*

I am wondering if after installing an update of a selinux-policy-* package you are using, do you need to reset all the labels in the system (i.e. fixfiles onboot) in order to keep the policy effective?...
4
votes
2answers
13k views

PHP on centos 6 not working

I have installed PHP, MySQL, Apache on CentOS 6, now I have restarted the Apache and mysql, to test PHP I have created a index.php on /var/www/html/test/ now once I go to localhost/test/index.php then ...
0
votes
0answers
38 views

SELinux httpd CentOS

I'm having trouble with SELinux and Apache DokuWiki on my CentOS 7 box. First I was unable to read the html directory contents. I disabled SELinux to test and a test index.html that I placed there ...
0
votes
0answers
12 views

Samba share not working on second hard drive

I have a centos7 file server with a samba share on the main drive and this is working fine. However I have tried to add a share on a second drive with the same setting but machines on the network are ...
17
votes
3answers
46k views

How to disable SELinux without restart?

I need to disable SELinux but cannot restart the machine i followed this link where i get bellow command setenforce 0 But after running this command i checked for that sestatus SELinux status: ...
3
votes
1answer
40 views

How to read/change SELinux context on mounted ext4 image from non-SELinux system?

I have a Linux system (Arch Linux) without SELinux support. I would not like to configure such support on my system. Now, I have an ext4 volume image which is known to have some SELinux context set on ...
2
votes
0answers
34 views

Benchmarking under SELinux Sandbox with Phoronix Test Suite

I would like to run the Phoronix Test Suite 6.2.2 under the SELinux sandbox on Fedora 23, but I can't execute it using $ sandbox ./phoronix-test-suite. I probably don't have the correct SELinux type. ...
2
votes
2answers
34 views

SELinux, ProFTPd and the silent log

I need a FTP server on my machine, a Fedora 23. I want a simple setup, and I decided for ProFTPd and authentication with mod_auth_unix.c (this is just about my machine). I installed ProFTPd and ...
3
votes
4answers
5k views

openvpn[]: Options error: In [CMD-LINE]:1: Error opening configuration file

when trying to service openvpn start Oct 12 14:02:01 ccushing1 openvpn[9091]: Options error: In [CMD-LINE]:1: Error opening configuration file: devnet-client-vm.conf running openvpn devnet-client-...
1
vote
0answers
11 views

Adding fcontext to unconfined application

This feels like the most horrid twist of fate ever... A user is having me setup tomEE (apache-tomee-jaxrs-1.7.4). This is on a RHEL6 machine. I've installed from the tarball available from apache's ...
0
votes
2answers
442 views

autofs 'failed to mount autofs path' as service but not manually (selinux)

I'm on CentOS 6.6 and I'm having a strange problem with autofs. I'm trying to mount an smb share on /var/www/html/mysite/docfolder, so I created a docfolder inside the mysite folder, ran chmod 777 on ...
4
votes
1answer
311 views

Permission errors even though permissions are wide open

I installed anaconda on our new VM and I can't list its contents. I can change my directory to .../anaconda/ but when I type ls -l I get: ls: cannot open directory .: Permission denied However, ...
1
vote
0answers
7 views

Defining a group of ports for SELinux

At my organization, we use a piece of software for instrumenting and monitoring our servers. Since this piece of software neither supports SELinux nor SystemD, we are currently working on improving ...
1
vote
1answer
34 views

SELinux, MySQL, and shared memory

On an SELinux enabled Oracle Linux 6 host, I have a product using MySQL as its underlying database and, through the database, is trying to access /dev/shm. /dev/shm mounts with context tmpfs_t, by ...
0
votes
2answers
33 views

How to isolate my browser?

I want to protect my data against a browser exploit, by forbidding Firefox to access any file beside : ~/.mozilla/ ~/Downloads/ I tried to create another user account with which I would run ...
0
votes
1answer
117 views

Timeouts with authd on CentOS 7

I am currently trying to augment my mailsystem by allowing servers that received mails from me within the last ten seconds to perform ident lookups. While the needed iptables rules are working ...
0
votes
1answer
30 views

SELinux crashed data system

I wanted to change the type of some data for SELinux and I made a typo and sent the following command into the prompt as the root user: semanage fcontext -a -t openvpn _etc_t / Now my system (...
0
votes
0answers
20 views

what does policycoreutils-devel do with regards to SElinux in relation to rhcsa

I am studying for the RHCSA exam with multiple supporting materials along with an 'official' course. One of my supplemental materials references installing policycoreutils-devel with relation to the ...
3
votes
1answer
720 views

Permission denied when running logrotate with anacron

I am trying to figure out what is causing anacron to send me the following error message: /etc/cron.daily/logrotate: /var/log/mariadb/mariadb.log-20140710.gz: Permission denied error: error running ...
1
vote
0answers
7 views

SELinux forbits ACPI/udev hook to use sudo

I have a ThinkPad X220 Tablet which has a twistable display. The thinkpad-scripts collection which I wrote with a friend hooks into the hardware event (as root) and then runs a script. This is the ...
1
vote
0answers
16 views

SELinux prevents auto-umount of ecryptfs

I'm running SELinux and ecryptfs on a Debian machine. When a user logs out, unfortunately it's home directory is not unmounted, and I get the following error in audit.log: type=USER_AVC msg=audit(...
1
vote
1answer
20 views

Filebased SELinux booleans

I'm trying to get numba running on my Debian server in SELinux enforcing mode. Numba is build on LLVMs jit compiler. The problem is, LLVM insists on having memory, which is writeable and executable at ...
4
votes
1answer
43 views

Share host directory between multiple containers vs. SELinux

Sharing a host directory with a docker container usually is easy enough: $ docker create -v /path/to/hostdir:/path/inside/container --name conta ... Things get more complicated, if SELinux is ...
1
vote
0answers
32 views

Selinux inode security struct allocation

i'm trying to understand allocation of inode_security_struct in Selinux. I looked for a source code of selinux and there is only one allocation of this struct on line 230 in hooks.c file. This ...
3
votes
1answer
121 views

SELinux + MergerFS (fuse) not working well together

I have been trying now for several days to get my new server up and running. I am running CentOS with MergerFS to pool my drives and samba to host to my windows machines. All of this running in ...
0
votes
1answer
144 views

HOWTO: Fix “Cannot parse sensitivity level in s0” error when attempting to start a KVM VM after a major OS upgrade

I have a Lenovo ThinkPad T430 running Red Hat Enterprise Linux 6.7 with kernel 2.6.32-573.8.1.el6.x86_64. This is a work computer and my corporate policy states that I must keep my operating system up ...
2
votes
2answers
5k views

Httpd can't access file even after setting httpd_sys_content_t

I'm currently learning SELinux. I was following the instructions in SELinux doc of RedHat. I indeed succeded after typing the following commands: mkdir /mywebsite //add something to /mywebsite/...