SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

learn more… | top users | synonyms

1
vote
1answer
32 views

SELinux Sandbox Usage

What am I doing wrong in the following, from the man file and internet it looks like this is right. $ echo "hello world" 1> test $ sandbox -i test cat test /usr/bin/cat: test: Permission denied
4
votes
1answer
18 views

How to transition into another domain when invoking sudo?

I have a daemon (collectd) that executes a script for data collection (via smartctl). The exec-plugin of collectd mandates that external scripts are executed under a user != root. The plan is to set ...
3
votes
1answer
471 views

GDM will not start on boot, unable to login into graphical interface

I am running RHEL 5.8 . SELinux is enabled but in permissive mode. Here are some snippets from /var/log/messages on boot. kernel: type=1400 audit(1360613500.551:6): avc: denied { write } for ...
1
vote
1answer
20 views

How do I find/list all files on filesystem with a certain SELinux “fcontext”

I'm having trouble finding information on what command, presumably from setools, I should use to find all the files on my filesystem that are labeled by SELinux with a certain file-context (fcontext). ...
1
vote
1answer
3k views

SELinux Write access for vsftpd and samba

This should be easy enough I think, but I'm new to SELinux. I have a CentOS 6 file server. I have some LVM file systems at /var/media and I want to use both Samba and FTP to share them with a Windows ...
1
vote
0answers
14 views

Can't modify or delete SELinux user

I was playing around with user_u in the targeted policy on RHEL 6.5. I'm logged in as root in the unconfined context, so I have full ability to change anything I want. I've also switched to ...
3
votes
1answer
1k views

SELinux - allowing rsyslog open/read access to some files

So I've got three files I need rsyslog to open in order to forward the entries to another server. SELinux is preventing this with the following error: type=AVC msg=audit(1371186588.768:1324460): ...
1
vote
3answers
474 views

How to get Wine to work with SELinux?

I want to run a .msi file on Fedora 17. After installing Wine Windows Program Loader on my Linux machine, it failed to run the file. A check on /var/log/messages shows the following line: Jan 11 ...
0
votes
0answers
16 views

SELinux error when yum updated pcre package

When doing a yum update, I got the following errors: Updating : pcre-8.33-7.fc20.i686 82/164 libsepol.module_package_read_offsets: module package header ...
2
votes
3answers
831 views

Prevent creating directories but allow creating files

I have a directory shared through Samba. I want users to be able to create/modify/delete files but not create/erase directories. I haven't found a way to do it. Maybe with SELinux? But how?
1
vote
0answers
17 views

Acpid event denied by SELinux, how can I savely allow the event without opening security holes?

I installed Fedora (3.17.2-200.fc20.x86_64) on my new Notebook (Lenovo Yoga Pad) and wanted to add this script to trigger whenever I flip over my screen. The script triggered whith the event is ...
1
vote
0answers
22 views

How to get SELinux to prevent Apache/HTTPD from reading specific files

What am I missing with SELinux? I thought it was supposed to be another layer of security but I built a web page vulnerable to command injection and it can basically traverse most of my file system. ...
1
vote
0answers
14 views

SELinux. Prevent Apache/HTTPD from reading specific files.

What am I missing with SELinux, i thought it was suppose to be another layer of security but i built a vulnerable web page vulnerable to command injection and it can basically traverse most of my file ...
2
votes
1answer
21 views

SELinux and OpenVPN?

Having Fedora 20 64-bit installed, I have this old problem of conflicting OpenVPN and SELinux. Obviously SELinux prevents openvpn from launching. The OpenVPN has been set through Network Connection ...
1
vote
2answers
42 views

Enabling SELinux on RHEL

I am using RHEL 6.5 and I need to enable SELinux. I have tried following commands, but it is of no help: $ setenforce 1 $ echo 1 > /selinux/enforce Note: I also tried editing ...
2
votes
3answers
1k views

openvpn[]: Options error: In [CMD-LINE]:1: Error opening configuration file

when trying to service openvpn start Oct 12 14:02:01 ccushing1 openvpn[9091]: Options error: In [CMD-LINE]:1: Error opening configuration file: devnet-client-vm.conf running openvpn ...
1
vote
2answers
46 views

is there any use for /selinux folder, when I don't use selinux?

I'm using Debian Wheezy, and by default a folder /selinux exists on my filesystem, even though I'm not (knowingly) using any SELinux infrastructure. I know that SELinux is intertwined with some ...
0
votes
0answers
56 views

Cannot label F2FS (SELinux)

I'm running Arch Linux [testing] x86_64 For some reasons, I can't relabel my root file system (F2FS) with SELinux (custom kernel compiled, using refpolicy) Kernel ver $ uname -a ...
2
votes
3answers
10k views

How to create Maildir directory with enough permissions for Postfix?

I have CentOS 5.5 with Postfix installed on it. I want to use local delivery agent with default setting, but I want it to store mail with Maildir directory style mailboxes. When I set the mailboxes ...
1
vote
1answer
85 views

SELinux disabled, net.ipv4.tcp_syncookies and nfs

OS is RHEL 6.2. I appear to be having an issue with SELinux. I've disabled it in /etc/sysconfig/selinux, however, when my host starts the command sestatus show that I'm in permissive mode. Searches ...
3
votes
1answer
81 views

How do I remedy SELinux not allowing legit programs in use access to my system?

I have a system where some programs are getting access denied in SELinux when performing their duties. These programs are ClamAV, fail2ban and Logwatch. I think I've managed to allow all the access ...
1
vote
1answer
46 views

Accidental modified SELinux context on root account to staff_u

I logged in as a normal account(test) on my CentOS 6.5 VM and sudo su - root and run usermod -Z staff_u test but looks like it changed my root account to staff_u as well, now I am stuck, could not ...
1
vote
1answer
62 views

Altermime and SELINUX

I've setup an application called altermime (http://www.pldaniels.com/altermime/) for postfix (SMTP server) which alters emails midstream. I'm injecting a "X-ListUnsubscribe" header into every email ...
0
votes
1answer
141 views

Compiling Awesome from source on CentOS: cannot find libraries

I am trying to install awesome (v3.5.5) on CentOS7. Since I could not find a repository that carries it, I am compiling it from source. However, I am getting this error on running make: -- checking ...
3
votes
2answers
167 views

Cannot delete File on Fedora

I have a file with following permission: -rwSr-s---. 1 1634630331 1818884080 118784 Jun 29 1970 DailyUpdateClass.class If I try to delete this file with root login, I get error. rm: cannot remove ...
0
votes
1answer
124 views

What should be the security context of these cron files?

I am running Fedora 20 and I am having some issues when running logrotate and anacron which I suspect may be related to SELinux: Failed to determine timestamp: Cannot assign requested address chgrp: ...
1
vote
2answers
79 views

How to disable SELinux without restart?

I need to disable SELinux but cannot restart the machine i followed this link where i get bellow command setenforce 0 But agter running this command i checked for that sestatus SELinux status: ...
0
votes
1answer
2k views

Redhat “httpd” can not start anymore. Showing “suEXEC” and “SELinux” notices

I'm on RHEL 6.5 and Apache 2.2.15. When I restart the httpd, I can not start that httpd anymore. Showing following things in the /var/log/httpd/error_log: [Fri Aug 01 18:31:48 2014] [notice] suEXEC ...
11
votes
2answers
2k views

Does SELinux provide enough extra security to be worth the hassle of learning/setting it up?

I recently installed Fedora 14 on my home pc and have been working on setting up different server related features such as apache, mysql, ftp, vpn, ssh, etc. I ran extremely quickly in to a barrier ...
-3
votes
1answer
88 views

Why does Linux come with SELinux?

If SELinux was created by NSA and published by United States Department of Defence then why the hell does it come with the barebone Linux kernel? Isn’t Linux all about security and privacy? Also, is ...
1
vote
1answer
270 views

Scientific Linux 6.3 run evince in SELinux sandbox

I'm trying to run evince in the SELinux sandbox: sandbox -X /usr/bin/evince Unixforpoets.pdf but after waiting for minutes nothing happens, console doesn't outputs anything. So I collected the ...
2
votes
1answer
444 views

/usr/sbin/sendmail: Permission denied

I am trying to setup the mail on my fedora 20. Every time I try to fire a test mail it tells me the permission is denied on /usr/sbin/sendmail. I checked the permissions and this is the output: ...
2
votes
1answer
220 views

Virtual Host only works when SELinux is set to permissive - why?

Wondering why my virtual hosts will only work when SELinux is set to "permissive". When SELinux is set to "enforce" my virtual hosts are ignored and default host is shown. Apache/2.2.15 (Unix) Here ...
3
votes
1answer
359 views

groupadd failure while writing changes to /etc/group

I have been following this guide on installing debian-kit on my Sony Xperia Tablet Z and the installation goes fine until I try to apt-get install andromize which fails with the error groupadd: ...
1
vote
0answers
221 views

Permission denied when running logrotate with anacron

I am trying to figure out what is causing anacron to send me the following error message: /etc/cron.daily/logrotate: /var/log/mariadb/mariadb.log-20140710.gz: Permission denied error: error running ...
3
votes
1answer
146 views

Why does the SELinux filesystem have it's own null device?

Looking through /sys/fs/selinux, I found this: # ls -l /sys/fs/selinux/null crw-rw-rw-. 1 root root 1, 3 Jan 24 02:47 /sys/fs/selinux/null Which is identical to /dev/null: # ls -l /dev/null ...
5
votes
4answers
1k views

Selinux is denying access to mysqld

I have a script that dumps a mysql database. It then compresses the file and this gets stored in my home folder by using cron. The problem is I seem to be getting an error message. mysqldump: ...
1
vote
1answer
179 views

Configure vsftpd allow access to mounted ISO file

I am having problems to allow anonymous FTP access to a directory that mounted a ISO file. No change to /etc/vsftpd/vsftpd.conf RHEL 6.5 DVD ISO file saved to /var/ftp/pub/ISO/rhel6_5.iso ...
3
votes
0answers
267 views

SSH AuthorizedKeysCommand and SELinux

I'm trying to use the SSH AuthorizedKeysCommand in a CentOS 6.5 machine, but I'm encountering an SELinux error. When I switch SELinux to permissive mode - using setenforce 0 - it works, but when I ...
2
votes
1answer
43 views

Create an RPM to distrubute custom SELinux policy

I have created two custom SELinux Policy modules to allow rsyslog to parse audit.log. Can I create an RPM of these two policies to distribute to 300+ clients? Is there a better way to go about this? ...
5
votes
0answers
77 views

Does Android's implementation of SELinux's M.A.C. inhibit root apps with root privileges from accessing app data? [closed]

Starting with Android 4.4 SELinux's MAC is enforced. Does this mean that if an app somehow can get installed and exploit the kernel to get root privileges, that MAC will still prevent that app with ...
7
votes
2answers
819 views

LXC containers as a sandbox environment

I am currently starting a project evaluating untrusted programs (student assignments) in a secure sandbox environment. Main idea is to create a web app for GlassFish and Java wrapper around lxc-utils ...
2
votes
0answers
212 views

After enabling SELinux (permissive mode) on Debian Wheezy, gdm3 does not finish loading

I recently enabled SELinux on my Debian Wheezy system, in permissive mode (I have confirmed that it is indeed operating in permissive mode). However, after the file labelling double-reboot, gdm3 ...
1
vote
0answers
421 views

What's missing with my SELinux installation?

According to Introduction to SELinux, section 14.4.2, SELinux support is built into the standard kernels provided by Debian. The core Unix tools support SELinux without any modifications. I have ...
1
vote
1answer
302 views

SELinux preventing ssh via public key

I have user $USER which is a system user account with an authorized users file. When I have SELinux enabled I am unable to ssh into the server using the public key. If I setenabled 0, $USER can now ...
0
votes
0answers
212 views

SElinux config file missing

Trying to set up mail I found out I have important file missing or it seems I do. First of all I have no selinux in /etc/sysconfig and in /etc/selinux there is folder mls and files restorecond.conf ...
2
votes
0answers
268 views

How does SELinux / SEAndroid prevent or allow pseudo terminal allocation?

I'm trying to resolve an SSH connection issue on an Android phone running SELinux in "Enforcing" mode. The problem is that any SSH connection that tries to allocate a pseudo-terminal (/dev/pts etc) is ...
6
votes
1answer
2k views

Why setsebool command of SELINUX taking so long and slow?

Hi I am new to the SELINUX and I have noticed the command setsebool take longer time than other linux commands. Such as: setsebool -P ftp_home_dir ON Out of curiosity I want to know why "setsebool" ...
6
votes
3answers
2k views

What roles do DAC (file permissions), ACL and MAC (SELinux) play in Linux file security?

I need some clarification/confirmation/elaboration on the different roles DAC, ACL and MAC play in Linux file security. After some research from the documentation, this is my understanding of the ...
3
votes
1answer
325 views

fail2ban permission denied on script

I've just upgraded from RHEL 5 to 6.5 and setup fail2ban anew. I can't seem to get my custom action to work now, supposedly because of a permission issue. I wan't to know what am I doing wrong, and ...