SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

learn more… | top users | synonyms

6
votes
0answers
237 views

fsarchiver error

I'm running the following fsarchiver command: $ fsarchiver restfs /tmp/backup/c0d0p2.fsa id=0,dest=/dev/cciss/c0d0p2 I get the following error: [errno=22, Invalid argument]: oper_restore.c#213,...
5
votes
0answers
63 views

Wrong role and type on login

I'm on an Ubuntu 14.04 derivative, elementary OS Freya. I have installed and configured SELinux using the selinux-policy-default package, which contains a lot of modules. I've also added my user to ...
4
votes
0answers
116 views

Relocation in a docker volume: svirt_sandbox_file_t and texrel_shlib_t

I run a Docker container with a volume that contains a executable and shared library which requires relocation. I get: error while loading shared libraries: /opt/J9/bin/libj9thr24.so: cannot restore ...
4
votes
0answers
241 views

What SELinux context shall the script have to be ran by pam_exec?

I just installed Fedora 22 on my VPS and tried to make trivial thing -- run my informer script on every ssh login via pam_exec. But I was confronted with unexpected difficulties: pam_exec failed with ...
4
votes
0answers
402 views

How to understand the security context in “ls -Z”?

After referring "man ls", it shows "ls -Z" can display the security context: -Z, --context Display security context so it fits on most displays. Displays only mode, user, group, security ...
4
votes
0answers
797 views

SSH AuthorizedKeysCommand and SELinux

I'm trying to use the SSH AuthorizedKeysCommand in a CentOS 6.5 machine, but I'm encountering an SELinux error. When I switch SELinux to permissive mode - using setenforce 0 - it works, but when I ...
4
votes
0answers
612 views

selinux, dovecot and sieve

I've just started learning to configure SELINUX and this morning on my CentOS 6.4 x64 system, with postfix/dovecot/mysql installed, I woke up to the following selinux issue found 1 alerts in /var/log/...
3
votes
0answers
133 views

How to create an SELinux exception for individual files

I use a monitoring tool and on one of my systems that is checked remotely, it calls up a script, which in turn runs systemctl to check the status of a service. This was not working until I put SELinux ...
3
votes
0answers
84 views

Sandboxing a binary on linux

I am trying to understand various options I have to restrict/sandbox a binary in Linux. I see that I can use namespaces and cgroups like docker does. I could use SELinux like this link suggests. Which ...
3
votes
0answers
498 views

SELinux: chcon to a type, ls -Z shows another one

When I do chcon -v -t httpd_sys_script_ro_t a_folder_at_home/ And then: ls -dZ I got: DACs user grp unconfined_u:object_r:httpd_sys_content_t:s0 a_folder_at_home/ In case of error I would ...
2
votes
0answers
27 views

Restrict /proc/mounts to avoid exposure of /run/user/

EDIT: Currently looking at this solution.. (namespaces), but still wouldn't mind any pointers for doing what I'm after another way. We have a custom SELinux policy on CentOS 7.2 which confines users ...
2
votes
0answers
34 views

Benchmarking under SELinux Sandbox with Phoronix Test Suite

I would like to run the Phoronix Test Suite 6.2.2 under the SELinux sandbox on Fedora 23, but I can't execute it using $ sandbox ./phoronix-test-suite. I probably don't have the correct SELinux type. ...
2
votes
0answers
266 views

Where to put the SElinux policy to allow acpid shutdown the system?

I'm using Centos7 minimal. I've installed acpid and the daemon is running. When I hit the power button, I get the following in /var/log/messages May 2 18:52:53 localhost systemd-logind: Power key ...
2
votes
0answers
117 views

Acpid event denied by SELinux, how can I savely allow the event without opening security holes?

I installed Fedora (3.17.2-200.fc20.x86_64) on my new Notebook (Lenovo Yoga Pad) and wanted to add this script to trigger whenever I flip over my screen. The script triggered whith the event is ...
2
votes
0answers
460 views

After enabling SELinux (permissive mode) on Debian Wheezy, gdm3 does not finish loading

I recently enabled SELinux on my Debian Wheezy system, in permissive mode (I have confirmed that it is indeed operating in permissive mode). However, after the file labelling double-reboot, gdm3 doesn'...
2
votes
0answers
3k views

What's missing with my SELinux installation?

According to Introduction to SELinux, section 14.4.2, SELinux support is built into the standard kernels provided by Debian. The core Unix tools support SELinux without any modifications. I have ...
2
votes
0answers
600 views

How does SELinux / SEAndroid prevent or allow pseudo terminal allocation?

I'm trying to resolve an SSH connection issue on an Android phone running SELinux in "Enforcing" mode. The problem is that any SSH connection that tries to allocate a pseudo-terminal (/dev/pts etc) is ...
1
vote
0answers
23 views

Cannot add group on RHEL desktop

[root@notebook ~]# groupadd testing groupadd: failure while writing changes to /etc/group [root@notebook ~]# grep testing /var/log/audit/audit.log type=ADD_GROUP msg=audit(1465386369.617:2553): pid=...
1
vote
0answers
19 views

How to work out why Apache is attempting “execmem”?

I'm getting audit messages from SELinux saying that it denied Apache doing execmem: type=AVC msg=audit(05/06/16 19:51:43.058:181060) : avc: denied { execmem } for pid=123456 comm=httpd scontext=...
1
vote
0answers
28 views

SELINUX not installing on Hyper-V Debian Jessie VM

I'm currently trying to install SELINUX on Debian Jessie VM. I'm following the instructions on the Debian website here Once I've completed the installation, I make a change to /etc/default/rcS to ...
1
vote
0answers
18 views

selinux on squashfs with overlayfs

Is it possible to use SELinux on a system with a squashfs root with an overlayfs overlay for read-write operations? On funtoo (gentoo), I booted with SELinux enabled in permissive mode to see what ...
1
vote
0answers
11 views

Adding fcontext to unconfined application

This feels like the most horrid twist of fate ever... A user is having me setup tomEE (apache-tomee-jaxrs-1.7.4). This is on a RHEL6 machine. I've installed from the tarball available from apache's ...
1
vote
0answers
7 views

Defining a group of ports for SELinux

At my organization, we use a piece of software for instrumenting and monitoring our servers. Since this piece of software neither supports SELinux nor SystemD, we are currently working on improving ...
1
vote
0answers
7 views

SELinux forbits ACPI/udev hook to use sudo

I have a ThinkPad X220 Tablet which has a twistable display. The thinkpad-scripts collection which I wrote with a friend hooks into the hardware event (as root) and then runs a script. This is the ...
1
vote
0answers
16 views

SELinux prevents auto-umount of ecryptfs

I'm running SELinux and ecryptfs on a Debian machine. When a user logs out, unfortunately it's home directory is not unmounted, and I get the following error in audit.log: type=USER_AVC msg=audit(...
1
vote
0answers
32 views

Selinux inode security struct allocation

i'm trying to understand allocation of inode_security_struct in Selinux. I looked for a source code of selinux and there is only one allocation of this struct on line 230 in hooks.c file. This ...
1
vote
0answers
15 views

Recreating local selinux contexts after OS Reinstallation

We have added a few specific contexts to our SELinux via the "semanage fcontext ..." command. The patterns are stored in /etc/selinux/targetd/contexts/files/file_contexts.local. Assuming that we ...
1
vote
0answers
27 views

apply proper security labels during filesystem restore

When restoring a filesystem on a separate system (i.e., possibly a different system than the one where the filesystem was originally mounted and in use), I would like to apply the correct security ...
1
vote
0answers
87 views

Unable to emerge SystemD on Hardened/SELinux

I'm on the hardened/linux/amd64/selinux profile on a recent Stage 3 of Gentoo amd64. I'm trying to install SystemD, and I see the following: > emerge -aq sys-apps/ The following mask changes are ...
1
vote
0answers
208 views

Cannot execute semanage fcontext --add under Fedora 21 using policy targeted

I cannot add a file contexts to the running SELinux policy using semanage under Fedora 21. When executing the semanage fcontext --add command, I receive an OSError: mf@vienna ~ % sudo semanage ...
1
vote
0answers
62 views

SELinux log on Debian Wheezy

I'm currently playing around with SELinux on a Debian Wheezy VM. I've seen a video by a RedHat employee talking about how easy SELinux is to use and that everything will be logged into /var/log/...
1
vote
0answers
64 views

What is SELinux's regex type?

I'm trying to locate all files on my system matching an SELinux file context (fcontext). These contexts are specified using some regex, and I'd like to use find -regex ... to the same effect. However, ...
1
vote
0answers
150 views

SELinux: 'chcon' is not reflected in another user account

I am using Debian 6 with SELinux enabled. For testing, I have tried to block access to date command for users. Now, I have mapped 'Test_Unix_User' account to 'user_u' SELinux account. 'user_r' can ...
1
vote
0answers
146 views

how do i build / apply an selinux policy file, on redhat 7?

I'm trying to install RabbitMQ on Redhat Linux 7 (RHEL7). I followed the instructions on the RabbitMQ site, and it installed fine. However, it won't run because SELinux is preventing Erlang from ...
1
vote
0answers
143 views

Can't modify or delete SELinux user

I was playing around with user_u in the targeted policy on RHEL 6.5. I'm logged in as root in the unconfined context, so I have full ability to change anything I want. I've also switched to ...
1
vote
0answers
117 views

How to get SELinux to prevent Apache/HTTPD from reading specific files

What am I missing with SELinux? I thought it was supposed to be another layer of security but I built a web page vulnerable to command injection and it can basically traverse most of my file system. ...
1
vote
0answers
52 views

SELinux. Prevent Apache/HTTPD from reading specific files.

What am I missing with SELinux, i thought it was suppose to be another layer of security but i built a vulnerable web page vulnerable to command injection and it can basically traverse most of my file ...
1
vote
0answers
259 views

How to do restorecon -f recursively?

I have tried both with a file and using standard input, and it seems it is impossible to get restorecon -r -f [file|-] to do anything at all. Is this possible?
1
vote
0answers
2k views

Issues with Fedora 20 and bumblebee

I'm experiencing several issues trying to use my Fedora 20 laptop NVIDIA Optimus technology. My system: ASUS N53S Fedora 20 x86-64 3.12.6-300.fc20.x86_64 Kernel Intel Core i7-2670QM NVIDIA Geforce ...
1
vote
0answers
286 views

403 Forbidden on Sub-Folders

I am a Linux newbie and decided to do a LAMP install to start getting more familiar with it (as our company is moving more towards nix these days). Everything went great and PHPMyAdmin, MySQL, Apache/...
1
vote
0answers
333 views

How to set SELinux samba policy to enable dirs deletion/renaming?

I`m lost in trouble with SELinux once more link to my previous solved Q on Samba SELinux When share's users try to delete a dir on share they fail with SELinux advertisement to solve problem do ...
0
votes
0answers
9 views

How can I protect SELinux labels from being modified?

I'm running Fedora 23. I have SELinux enabled and enforced. I know that you can change a file's labels with restorecon and chcon (and possibly other programs). This is no doubt an avenue by which a ...
0
votes
0answers
13 views

selinux blocking vsftpd directory listing

I am trying to get a better understanding of selinux and configuring a local ftp repository on Centos7. I installed vsftpd on my host. I created a repository on my host: /var/ftp/pub/centos7 EFI ...
0
votes
0answers
22 views

Can SELinux filter system calls?

Let's say I want to restrict use of the system call shutdown to /sbin/mount or filter the arguments that get passed to the system call mount. Can SELinux policy be used to achieve this?
0
votes
0answers
12 views

Samba share not working on second hard drive

I have a centos7 file server with a samba share on the main drive and this is working fine. However I have tried to add a share on a second drive with the same setting but machines on the network are ...
0
votes
0answers
38 views

SELinux httpd CentOS

I'm having trouble with SELinux and Apache DokuWiki on my CentOS 7 box. First I was unable to read the html directory contents. I disabled SELinux to test and a test index.html that I placed there ...
0
votes
0answers
20 views

what does policycoreutils-devel do with regards to SElinux in relation to rhcsa

I am studying for the RHCSA exam with multiple supporting materials along with an 'official' course. One of my supplemental materials references installing policycoreutils-devel with relation to the ...
0
votes
0answers
78 views

'syntax error' at token '' on line 6:

I'm quite new to Linux and I need to build a local policy SElinux module. I'm compiling with audit2allow from a file containing the following lines : module lockx11vnc 1.1; require { class ...
0
votes
0answers
62 views

nginx server never resolves

I have set up an nginx server which is a proxy for port 80 to http://127.0.0.1:3000, but the request never gets through. It just infinitely loads. I have tried sudo /sbin/iptables -I INPUT -p tcp -m ...
0
votes
0answers
43 views

Cannot access server outside of server`

I have a node server listening on port 80. If I send a request to it like this: request('http://127.0.0.1:80',function(err,res,data) {console.log(data)}) It works. It returns what I would expect. ...