New answers tagged selinux
Use echo 0 > /selinux/enforce on Centos.
SELinux context is stored in file's extended attributes (xattr, man 5 attr). Tools for working with them are available in core/attr package. Attributes, including SELinux context, can be retrieved with getfattr. There is a twist though: by default getfattr lists only attributes from user. namespace; and selinux attribute we need is in security namespace. So ...
Answering my own question: I was able to solve the problem by restoring the configuration of my /etc/proftpd.conf to AuthOrder mod_auth_pam.c* mod_auth_unix.c SELinux was configured by setting the following flags: setsebool ftpd_full_access 1 setsebool ftp_home_dir 1 Apparently the problem was related with mod_auth_unix.c which is forbidden by SELinux ...
I believe the FTP server is forbidden to access /etc/passwd or /etc/shadow. This is not true. From the AVC message, you see tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 which is some part of ftpd_t, not shadow or passwd (these files have different context, as you can see from ls -Z /etc/passwd). It is not complete solution, but moving forward. ...
In Raspbian, a Debian derivative, after deleting my config file from /etc/openvpn/ and then adding a differently named config file I found I had to: # systemctl daemon-reload Until then, openvpn was still trying to load the old, deleted config when run using service openvpn start, which I realised by tail following /var/log/syslog.
It looks like the best choice isn't to do it by hand, but through more SELinux automation. grep mysqld /var/log/audit/audit.log | grep shm | audit2allow -M mysql_tmpfs semodule -i mysql_tmpfs.pp The audit2allow(8) man page says the -M argument uses the next string as the new module name. Between that and the semodule(8) man page, I want to use a module ...
You can using apparmor Or better selinux for this porpose By they yiu can garanti just your software have access to the folder Another way is using chattr . But it not safer then apparmor v selinux
Apparmor does exactly what you're asking. You can explicitly allow/deny which file firefox can read/write/execute See here for more help
May others not fall into the same trap. Everything is actually fine. From the testing section of the authd documentation: Execute "telnet localhost auth" and type the two ports separated by a comma. The two ports selected must have a foreign address of localhost, or 127.0.0.1 as well as a matching local address. If they do not, a NO-USER error will be ...
Top 50 recent answers are included