SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

learn more… | top users | synonyms

17
votes
2answers
4k views

What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?

I am planning to go back to Linux as a Desktop machine. I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server. What would be a good, ...
11
votes
2answers
2k views

Does SELinux provide enough extra security to be worth the hassle of learning/setting it up?

I recently installed Fedora 14 on my home pc and have been working on setting up different server related features such as apache, mysql, ftp, vpn, ssh, etc. I ran extremely quickly in to a barrier ...
11
votes
3answers
350 views

Prompt user on Linux security denial

Is it possible to make a Linux security module (eg. AppArmor, SELinux etc.) prompt the user, when an application wants to access classified files or folders (digital signatures, SSH keys, credit card ...
8
votes
1answer
1k views

What is the proper way to set SELinux context in an RPM .spec?

I am trying to build an RPM that targets RHEL4 and 5. Right now I call chcon from %post but multiple Google entries say "that's not how you are supposed to do it" with very limited help on the right ...
7
votes
9answers
726 views

How to prevent a process from writing files

I want to run a command on Linux in a way that it cannot create or open any files to write. It should still be able to read files as normal (so an empty chroot is not an option), and still be able to ...
7
votes
2answers
572 views

LXC containers as a sandbox environment

I am currently starting a project evaluating untrusted programs (student assignments) in a secure sandbox environment. Main idea is to create a web app for GlassFish and Java wrapper around lxc-utils ...
7
votes
1answer
1k views

What is the safe way to allow Java 7 to run on SELinux

Short version: What is the most secure way to allow Java 7 to run on (with?) SELinux? Long version: Sorry in advance if I use incorrect terminology. I'm really just a Java developer with a meager ...
6
votes
3answers
1k views

What roles do DAC (file permissions), ACL and MAC (SELinux) play in Linux file security?

I need some clarification/confirmation/elaboration on the different roles DAC, ACL and MAC play in Linux file security. After some research from the documentation, this is my understanding of the ...
6
votes
2answers
416 views

Make all SELinux contexts permanent

I've done a lot of chcon-ing lately,but if I understand it correctly, these will be erased on the next relabel. Is there any way to make the current contexts (preferably just under a certain ...
6
votes
1answer
130 views

deny any writing to given app and its children

So I have a Python app (which spawns other processes) which I want to deny any writing. It seems like a job for SELinux. Could you describe the steps needed to accomplish this, or perhaps direct me to ...
6
votes
1answer
736 views

What is the best way to learn SELinux?

I want to learn SELinux to a high level, being able to understand the intricacies of domains, types and switching. What is the best way to go about this? I considered starting with Fedora and a good ...
6
votes
1answer
420 views

SELinux re-labeling problem while attempting to run OpenVPN

I'm trying to run OpenVPN under Fedora 19 with selinux (selinux-policy-targeted) in enforcing mode, and I'm running into an AVC I'm not entirely sure how to handle. Starting OpenVPN from the command ...
5
votes
2answers
772 views

Fedora 15 :Twitter on Google Chrome

It's been almost 15 days since I installed Fedora 15 on my laptop. And since day 1, Twitter seems to be having some issue opening up. Whenever I try to load twitter.com, it loads an "Aw Snap" page. ...
5
votes
3answers
9k views

How to mount NFS 3 volumes on Fedora 17?

I installed the package nfs-utils and tried it via: # mount -t nfs server:/mnt /mnt mount.nfs: rpc.statd is not running but is required for remote locking. mount.nfs: Either use '-o nolock' to keep ...
5
votes
1answer
7k views

chcon: can't apply partial context to unlabeled file while installing nagios with SELinux

I'm setting up Nagios core on CentOS with SELINUX=enforcing. I try to run chcon -R -t httpd_sys_content_t /usr/local/nagios/sbin/ as suggested in the manual, but I get this error messages: chcon: ...
5
votes
2answers
2k views

Hide processes from other users based on groups (under Linux)?

Is it possible to configure process hiding for certain user groups under a linux system? For example: Users from group X should not see processes owned by users from group Y in ps/top or under /proc. ...
5
votes
0answers
55 views

Does Android's implementation of SELinux's M.A.C. inhibit root apps with root privileges from accessing app data? [closed]

Starting with Android 4.4 SELinux's MAC is enforced. Does this mean that if an app somehow can get installed and exploit the kernel to get root privileges, that MAC will still prevent that app with ...
5
votes
4answers
1k views

Selinux is denying access to mysqld

I have a script that dumps a mysql database. It then compresses the file and this gets stored in my home folder by using cron. The problem is I seem to be getting an error message. mysqldump: ...
4
votes
3answers
686 views

Running Viber as another user while using “mine” X Server's microphine and speakers

I run Fedora with GNOME and recently installed Viber for linux. It's very good and all is working just fine. As Viber is not open-source software, I decided to run it as another user to make sure ...
4
votes
1answer
435 views

SELinux interfering with host/guest file sharing using KVM

I'm running Fedora 17 with KVM and the virtual machine runs okay. I tried to follow this to get access to a file on the host system but SELinux prevents the VM from accessing any files other than ...
4
votes
1answer
1k views

How do I edit a file and preserve its access control list / SELinux security context?

I'm on CentOS 6.2, and have a file with the alternate access method character displayed as a dot. ls -l myfile -rwxr-x---. 1 me mygroup 172 Aug 13 10:03 myfile ^ This dot. ...
4
votes
1answer
361 views

Why do SELinux policies require a system restart?

When changing SELinux policies, I've been reading that you're required to restart the system. What changes would require this? Are there certain policy changes that would not require a restart?
4
votes
1answer
1k views

Why setsebool command of SELINUX taking so long and slow?

Hi I am new to the SELINUX and I have noticed the command setsebool take longer time than other linux commands. Such as: setsebool -P ftp_home_dir ON Out of curiosity I want to know why "setsebool" ...
4
votes
1answer
2k views

Gnome terminal fails to start

After upgrading to Fedora 18, on certain occasions, gnome-terminal will fail to launch, requiring me to log out of the desktop and log in again. I tried tracing the error and found the following in ...
4
votes
1answer
2k views

How can I configure SELinux when the semanage command isn't found?

I'm having a very hard time configuring SELinux to allow Sending mail. Looking into selinux documentation I've found I can manage ports via the semanage command, but the command can't be found. Is ...
4
votes
2answers
443 views

SELinux denied access

I keep receiving this message from SELinux in a bug report. I am new to Linux, running Fedora 13 and I am learning as I go. Any advice on what this might be would be appreciated. Summary: SELinux is ...
4
votes
1answer
191 views

Myth or reality: SELinux can confine the root user?

I read or heard somewhere (maybe in LinuxCBT's SELinux course; but I'm not sure) that there are online Linux servers, for which the password of the root user is also given. The Linux server is ...
4
votes
0answers
209 views

fsarchiver error

I'm running the following fsarchiver command: $ fsarchiver restfs /tmp/backup/c0d0p2.fsa id=0,dest=/dev/cciss/c0d0p2 I get the following error: [errno=22, Invalid argument]: ...
3
votes
2answers
124 views

Are there other LSM (Linux Security Modules) in addition to SELinux and AppArmor?

In researching this U&L Q&A titled: permission denied for ptrace under GDB, the question came up, "Is there other software similar to SELinux & AppArmor?". User @IwillnotexistIdonotexist ...
3
votes
5answers
8k views

Apache won't start on Fedora 15

I can't get Apache to start on Fedora 15. I downloaded a project into /var/www/html and changed myself to the owner (recursively), though I don't think I changed any SELinux contexts or anything like ...
3
votes
2answers
50 views

Cannot delete File on Fedora

I have a file with following permission: -rwSr-s---. 1 1634630331 1818884080 118784 Jun 29 1970 DailyUpdateClass.class If I try to delete this file with root login, I get error. rm: cannot remove ...
3
votes
1answer
2k views

How do I configure SELinux to allow outbound connections from a CGI script?

I'm migrating to a new webserver which has SELinux set up (running Centos 5.5). I've got it set up so that it can execute CGI scripts with no problem, but some of the older Perl based scripts are ...
3
votes
1answer
80 views

Why does the SELinux filesystem have it's own null device?

Looking through /sys/fs/selinux, I found this: # ls -l /sys/fs/selinux/null crw-rw-rw-. 1 root root 1, 3 Jan 24 02:47 /sys/fs/selinux/null Which is identical to /dev/null: # ls -l /dev/null ...
3
votes
2answers
2k views

SELinux: Can I disable copying of certain files?

Please excuse me if this is too basic and you're tempted to throw an RTFM at me. I want to prevent users from copying certain files while granting them read access to the same files. I thought this ...
3
votes
2answers
3k views

SELinux stops Google Chrome from executing

I can no longer start Google Chrome on Fedora 14 (using GNOME). strace strace google-chrome ... readlink("/proc/self/exe", "/opt/google/chrome/chrome"..., 4096) = 25 socketpair(PF_FILE, ...
3
votes
3answers
393 views

Output compiler options from SSH

How can I list the configuration options that ssh/sshd was compiled with? I'm attempting to troubleshoot a SELinux configuration issue, and want to make sure that SSH was compiled with ...
3
votes
1answer
166 views

SELinux context of files mounted from a Solaris server

Something I'm attempting to run in RHEL6 fails as a result of SELinux. The problem is temporarily easily solved with "setenforce 0". However turning SELinux off entirely isn't an option in my case. ...
3
votes
1answer
821 views

Debian: unable to set up SELinux

I'm trying to set up SELinux on Debian 6 according to (the instructions reported on the Debian wiki). I've run this commands: apt-get install selinux-basics selinux-policy-default selinux-activate ...
3
votes
2answers
582 views

allow webalizer in selinux (centos)

I roughly followed these instructions: http://library.linode.com/web-applications/analytics/webalizer/centos-5 to install and configure webalizer to run on several VirtualHosts. Unfortunately when i ...
3
votes
1answer
453 views

SELinux outbound access to other sites with restrictions

We have CentOS 6 configured with SELinux to host a number of websites. Unfortunately SELinux is preventing websites from accessing (outbound) sites, such as download.wordpress.com to update ...
3
votes
2answers
215 views

Backup selinux system running strict

I have a cron job that is backing up a SELinux system running in strict mode. The problem is that SELinux wants to deny access to to the backup script since it wants access to every single file on the ...
3
votes
1answer
112 views

fail2ban permission denied on script

I've just upgraded from RHEL 5 to 6.5 and setup fail2ban anew. I can't seem to get my custom action to work now, supposedly because of a permission issue. I wan't to know what am I doing wrong, and ...
3
votes
1answer
55 views

SELlinux security domains

I'm studying SELinux, but I can't find any clear definition for security domains. What is a security domain and what is its difference with security context?
3
votes
1answer
80 views

groupadd failure while writing changes to /etc/group

I have been following this guide on installing debian-kit on my Sony Xperia Tablet Z and the installation goes fine until I try to apt-get install andromize which fails with the error groupadd: ...
3
votes
1answer
1k views

SELinux - allowing rsyslog open/read access to some files

So I've got three files I need rsyslog to open in order to forward the entries to another server. SELinux is preventing this with the following error: type=AVC msg=audit(1371186588.768:1324460): ...
3
votes
1answer
376 views

GDM will not start on boot, unable to login into graphical interface

I am running RHEL 5.8 . SELinux is enabled but in permissive mode. Here are some snippets from /var/log/messages on boot. kernel: type=1400 audit(1360613500.551:6): avc: denied { write } for ...
3
votes
0answers
529 views

How do I set up the SELinux sandbox in Debian?

I've installed SELinux in Debian sid in order to use the sandbox that locks down apps to a restricted enviroment, but I can't get it to work. If I try to use the sandbox command in permissive mode ...
2
votes
2answers
628 views

Prevent creating directories but allow creating files

I have a directory shared through Samba. I want users to be able to create/modify/delete files but not create/erase directories. I haven't found a way to do it. Maybe with SELinux? But how?
2
votes
2answers
2k views

How to permamently disable SELinux?

We run a site with big traffic surges and, because of that, SELinux usually thinks that the traffic is a SYN flood attack. We have this same problem on many different CentOS servers. Despite ...
2
votes
1answer
177 views

/usr/sbin/sendmail: Permission denied

I am trying to setup the mail on my fedora 20. Every time I try to fire a test mail it tells me the permission is denied on /usr/sbin/sendmail. I checked the permissions and this is the output: ...