SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

learn more… | top users | synonyms

4
votes
1answer
381 views

Myth or reality: SELinux can confine the root user?

I read or heard somewhere (maybe in LinuxCBT's SELinux course; but I'm not sure) that there are online Linux servers, for which the password of the root user is also given. The Linux server is ...
3
votes
1answer
104 views

How do I remedy SELinux not allowing legit programs in use access to my system?

I have a system where some programs are getting access denied in SELinux when performing their duties. These programs are ClamAV, fail2ban and Logwatch. I think I've managed to allow all the access ...
3
votes
1answer
2k views

SELinux - allowing rsyslog open/read access to some files

So I've got three files I need rsyslog to open in order to forward the entries to another server. SELinux is preventing this with the following error: type=AVC msg=audit(1371186588.768:1324460): ...
3
votes
1answer
509 views

GDM will not start on boot, unable to login into graphical interface

I am running RHEL 5.8 . SELinux is enabled but in permissive mode. Here are some snippets from /var/log/messages on boot. kernel: type=1400 audit(1360613500.551:6): avc: denied { write } for ...
2
votes
1answer
25 views

SELinux Enforcing is preventing logging into another user account?

I am using Debian 6 with SELinux enabled. After enabling "enforcing" mode in SElinux, I have tried to login into another user account by 'login' command. But, I have been restricted by selinux. ...
1
vote
1answer
129 views

Problem running “selinux sandbox” with java

I am trying to sandbox a java application using selinux sandbox. System details: Redhat 6 | x86_64 | no x server install | jdk7 from oracle tar.gz version | cgred and cgconfig are stop The cmd ...
1
vote
1answer
33 views

SELinux ignoring configuration?

I'm using Vagrant and VirtualBox to run a CentOS 6.5 VM. In /etc/sysconfig/selinux I have set SELINUX=permissive. However, everytime I restart the VM, sudo getenforce shows SELinux as Enforcing. ...
1
vote
1answer
31 views

How do I find/list all files on filesystem with a certain SELinux “fcontext”

I'm having trouble finding information on what command, presumably from setools, I should use to find all the files on my filesystem that are labeled by SELinux with a certain file-context (fcontext). ...
1
vote
1answer
42 views

SELinux Sandbox Usage

What am I doing wrong in the following, from the man file and internet it looks like this is right. $ echo "hello world" 1> test $ sandbox -i test cat test /usr/bin/cat: test: Permission denied
1
vote
1answer
4k views

SELinux Write access for vsftpd and samba

This should be easy enough I think, but I'm new to SELinux. I have a CentOS 6 file server. I have some LVM file systems at /var/media and I want to use both Samba and FTP to share them with a Windows ...
1
vote
1answer
280 views

Scientific Linux 6.3 run evince in SELinux sandbox

I'm trying to run evince in the SELinux sandbox: sandbox -X /usr/bin/evince Unixforpoets.pdf but after waiting for minutes nothing happens, console doesn't outputs anything. So I collected the ...
1
vote
1answer
90 views

Can selinux log an application owner name?

So I've set up selinux to log all file access operations in a certain directory. Here's some sample log output when doing an ls from sftp: type=AVC msg=audit(1338465611.221:356): avc: granted { ...
0
votes
1answer
46 views

How to put dracut to initframs?

I try to make SElinux permissive. I changed the config from disabled to permissive. However, I guess it does not recognize that change. In the red hat web site, It says : If the system was ...
0
votes
1answer
234 views

Compiling Awesome from source on CentOS: cannot find libraries

I am trying to install awesome (v3.5.5) on CentOS7. Since I could not find a repository that carries it, I am compiling it from source. However, I am getting this error on running make: -- checking ...
0
votes
1answer
233 views

Installing Domjudge in Fedora 19

I tried to install Domjudge in Fedora 19 (based on its documentation) and it installed successfully but when I try to start it in browser (localhost/domjudge) I get the following error: Forbidden ...
4
votes
0answers
628 views

How do I set up the SELinux sandbox in Debian?

I've installed SELinux in Debian sid in order to use the sandbox that locks down apps to a restricted enviroment, but I can't get it to work. If I try to use the sandbox command in permissive mode ...
4
votes
0answers
222 views

fsarchiver error

I'm running the following fsarchiver command: $ fsarchiver restfs /tmp/backup/c0d0p2.fsa id=0,dest=/dev/cciss/c0d0p2 I get the following error: [errno=22, Invalid argument]: ...
3
votes
0answers
363 views

SSH AuthorizedKeysCommand and SELinux

I'm trying to use the SSH AuthorizedKeysCommand in a CentOS 6.5 machine, but I'm encountering an SELinux error. When I switch SELinux to permissive mode - using setenforce 0 - it works, but when I ...
2
votes
0answers
265 views

After enabling SELinux (permissive mode) on Debian Wheezy, gdm3 does not finish loading

I recently enabled SELinux on my Debian Wheezy system, in permissive mode (I have confirmed that it is indeed operating in permissive mode). However, after the file labelling double-reboot, gdm3 ...
2
votes
0answers
327 views

How does SELinux / SEAndroid prevent or allow pseudo terminal allocation?

I'm trying to resolve an SSH connection issue on an Android phone running SELinux in "Enforcing" mode. The problem is that any SSH connection that tries to allocate a pseudo-terminal (/dev/pts etc) is ...
2
votes
0answers
361 views

SELinux: chcon to a type, ls -Z shows another one

When I do chcon -v -t httpd_sys_script_ro_t a_folder_at_home/ And then: ls -dZ I got: DACs user grp unconfined_u:object_r:httpd_sys_content_t:s0 a_folder_at_home/ In case of error I would ...
1
vote
0answers
17 views

SELinux log on Debian Wheezy

I'm currently playing around with SELinux on a Debian Wheezy VM. I've seen a video by a RedHat employee talking about how easy SELinux is to use and that everything will be logged into ...
1
vote
0answers
19 views

What is SELinux's regex type?

I'm trying to locate all files on my system matching an SELinux file context (fcontext). These contexts are specified using some regex, and I'd like to use find -regex ... to the same effect. However, ...
1
vote
0answers
28 views

How can I enable ufw automatically on boot?

sudo ufw enable Firewall is active and enabled on system startup sudo ufw status Status: active But after I restart the system and run sudo ufw status, I get the message: Status: inactive How ...
1
vote
0answers
27 views

SELinux: 'chcon' is not reflected in another user account

I am using Debian 6 with SELinux enabled. For testing, I have tried to block access to date command for users. Now, I have mapped 'Test_Unix_User' account to 'user_u' SELinux account. 'user_r' can ...
1
vote
0answers
41 views

how do i build / apply an selinux policy file, on redhat 7?

I'm trying to install RabbitMQ on Redhat Linux 7 (RHEL7). I followed the instructions on the RabbitMQ site, and it installed fine. However, it won't run because SELinux is preventing Erlang from ...
1
vote
0answers
34 views

Can't modify or delete SELinux user

I was playing around with user_u in the targeted policy on RHEL 6.5. I'm logged in as root in the unconfined context, so I have full ability to change anything I want. I've also switched to ...
1
vote
0answers
40 views

Acpid event denied by SELinux, how can I savely allow the event without opening security holes?

I installed Fedora (3.17.2-200.fc20.x86_64) on my new Notebook (Lenovo Yoga Pad) and wanted to add this script to trigger whenever I flip over my screen. The script triggered whith the event is ...
1
vote
0answers
45 views

How to get SELinux to prevent Apache/HTTPD from reading specific files

What am I missing with SELinux? I thought it was supposed to be another layer of security but I built a web page vulnerable to command injection and it can basically traverse most of my file system. ...
1
vote
0answers
28 views

SELinux. Prevent Apache/HTTPD from reading specific files.

What am I missing with SELinux, i thought it was suppose to be another layer of security but i built a vulnerable web page vulnerable to command injection and it can basically traverse most of my file ...
1
vote
0answers
276 views

Permission denied when running logrotate with anacron

I am trying to figure out what is causing anacron to send me the following error message: /etc/cron.daily/logrotate: /var/log/mariadb/mariadb.log-20140710.gz: Permission denied error: error running ...
1
vote
0answers
771 views

What's missing with my SELinux installation?

According to Introduction to SELinux, section 14.4.2, SELinux support is built into the standard kernels provided by Debian. The core Unix tools support SELinux without any modifications. I have ...
1
vote
0answers
125 views

How to do restorecon -f recursively?

I have tried both with a file and using standard input, and it seems it is impossible to get restorecon -r -f [file|-] to do anything at all. Is this possible?
1
vote
0answers
2k views

Issues with Fedora 20 and bumblebee

I'm experiencing several issues trying to use my Fedora 20 laptop NVIDIA Optimus technology. My system: ASUS N53S Fedora 20 x86-64 3.12.6-300.fc20.x86_64 Kernel Intel Core i7-2670QM NVIDIA Geforce ...
1
vote
0answers
227 views

403 Forbidden on Sub-Folders

I am a Linux newbie and decided to do a LAMP install to start getting more familiar with it (as our company is moving more towards nix these days). Everything went great and PHPMyAdmin, MySQL, ...
1
vote
0answers
398 views

selinux, dovecot and sieve

I've just started learning to configure SELINUX and this morning on my CentOS 6.4 x64 system, with postfix/dovecot/mysql installed, I woke up to the following selinux issue found 1 alerts in ...
1
vote
0answers
282 views

How to set SELinux samba policy to enable dirs deletion/renaming?

I`m lost in trouble with SELinux once more link to my previous solved Q on Samba SELinux When share's users try to delete a dir on share they fail with SELinux advertisement to solve problem do ...
0
votes
0answers
15 views

SELinux: bin_t type socket-application can access http_port_t ports

I am trying to compromising my application (myapp) to use limited ports. For that, I have decided to assign httpd_t type to myapp. So, myapp could use only http_port_t typed ports & I could ...
0
votes
0answers
40 views

How to recompile ImageMagick to detect the DELEGATES

I am using Imagemagick(6.4.3.6-7.18.x86_64) in SLES11 SP2 Using it like bellow.. import -window $wid $jpg and getting this error import: DelegateLibrarySupportNotBuiltIn `' (X11) @ ...
0
votes
0answers
33 views

SELinux error when yum updated pcre package

When doing a yum update, I got the following errors: Updating : pcre-8.33-7.fc20.i686 82/164 libsepol.module_package_read_offsets: module package header ...
0
votes
0answers
93 views

Cannot label F2FS (SELinux)

I'm running Arch Linux [testing] x86_64 For some reasons, I can't relabel my root file system (F2FS) with SELinux (custom kernel compiled, using refpolicy) Kernel ver $ uname -a ...
0
votes
0answers
314 views

SElinux config file missing

Trying to set up mail I found out I have important file missing or it seems I do. First of all I have no selinux in /etc/sysconfig and in /etc/selinux there is folder mls and files restorecond.conf ...
0
votes
0answers
109 views

Are there any recommended SELinux policies for JBOSS?

I’m looking for tips about defining JBoss policies in SELinux. I saw that OWASP is planning to publish a document about this, but I need some guidance ASAP. Can someone please help?
0
votes
0answers
92 views

Fedora - SELinux - livecd-tools

I'm using livecd-tools to build an image and I am able to consistently build images now, but upon bootup and login, I get "no shell - permission denied". After reading about that error, I saw it is ...