Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible role-based, mandatory access control (MAC) architecture on Linux through kernel modifications and user-tools. It is primarily used to confine system processes and users beyond the basic Discretionary Access Controls (DAC) mechanism or access-control list found on *nix systems.

Filter by
Sorted by
Tagged with
0 votes
1 answer
32 views

/var/log/httpd permissions reset from 705 to 700 after reboot

After a reboot /var/log/httpd permissions reset from 705 to 700. Could this be a SELinux issue? OS is RHEL 8.
user avatar
1 vote
1 answer
43 views

What does system_u means when assigned to a file?

What my question is : if there is a file assigned with system_u as SELinux that means only the user mapped to system_u/unconfined_u gets to access the file? if this label is assigned to an executable ...
user avatar
0 votes
0 answers
32 views

Ubuntu 20.04 doesn't boot after setting SELinux to enforcing

I'm trying to set SELinux to enforcing on Ubuntu 20.04, and the steps I did are as follow: Install SELinux = sudo apt-get install policycoreutils selinux-utils selinux-basics -y Activate SELinux = ...
user avatar
2 votes
0 answers
17 views

What are the reasons for the default behavior of restorecon in SELinux?

At one point when learning the administration of SELinux, the restorecon(8) program gave me a good headache. No matter how I tried to change the permanent file contexts with semanage-fcontext(8) and ...
user avatar
0 votes
1 answer
79 views

Mounting lvm after fstab entry is not creating SElinux labels in the new lvm

On RHEL8, I created an lvm with ext4 filesystem. Added it to /etc/fstab but when I use mount -av, I get the following error: You just mounted an file system that supports labels which does not ...
user avatar
  • 125
1 vote
0 answers
25 views

Cant install Selinux policy

I am trying to install selinux on my librem14 pureos machine, every time I run sudo apt-get install selinux-policy-default I get: dpkg: error processing package selinux-policy-default (--configure): ...
user avatar
  • 11
0 votes
0 answers
14 views

Can't execute HIDS samhain with SELinux enabled

Trying to execute some HIDS Samhain commands raises SELinux permissions error (working in permissive mode, not in enforcing): --------- sh_readconf.c --- 433 --------- Could not open the local ...
user avatar
  • 351
0 votes
0 answers
15 views

SELinux configuration to cache ssh key passphrase between reboots

I am using CentOS Stream 8. I added my ssh key to keychain: ssh-keygen -l eval `ssh-agent` ssh-add -k ~/.ssh/id_rsa # test connections ssh -T git@bitbucket.org ssh text passes in this terminal ...
user avatar
  • 101
1 vote
0 answers
43 views

SELinux: allow socat to run on unreserved_port_t

I'm working on an embedded distro with SELinux. I am having this issue: root@unknown7:~# socat openssl-listen:7777,reuseaddr, stdio 2022/02/03 13:44:44 socat[2331] E bind(5, {AF=2 0.0.0.0:7777}, 16): ...
user avatar
  • 351
1 vote
0 answers
54 views

initrc_t bash: /etc/init.d/network: /bin/bash: bad interpreter: Permission denied

on my CentOS 7.6 with SELinux enforcing I faced with the issue: uid=0(root) gid=0(root) groups=0(root) context=sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 #ls -lZ /etc/init.d/network -rwxr-x---. root ...
user avatar
  • 259
2 votes
1 answer
46 views

Any way to make sysfs file immutable?

I'm trying to make /sys/fs/selinux/enforce always contain "1", and prevent it from being changed. I've been able to do this on /etc/selinux/config by running chattr +i /etc/selinux/config ...
user avatar
3 votes
0 answers
148 views

set sshd SELinux security context

I'm working on my custom board and on my custom UNIX-like O.S. . When I connect using ssh and no root users a receve this SELinux error: A valid context for could not be obtained. where user is not ...
user avatar
  • 31
0 votes
0 answers
24 views

block internet access to all applications except whitelisted

If blacklisting I'd use firejail, but since I want to whitelist and include preinstalled binaries, seems like SEL is the only potential choice. Essentially, could SEL be used to add a new type context ...
user avatar
  • 13
1 vote
1 answer
35 views

Offline setting an SELinux boolean

I had an issue with an SELinux boolean, allow_ypbind that is wrongly set at 0 when starting my embedded Linux distro. I know that at runtime I may run a setsebool command to set it to 1. I need to ...
user avatar
  • 351
0 votes
0 answers
127 views

How to enable SELinux on RaspberryPi's 5.10 BullsEye Lite OS

SELinux files appear on a fresh image of BullsEye 5.10 lite, RaspberryPi OS but I can not find any directions on how to enable it. This should be well documented but not found for the current ...
user avatar
  • 1
0 votes
2 answers
58 views

su issues for non-root user if SELinux is on

I have a common user on my RHEL 7.6 server and when SELinux is off, su command works for it. But when SElinux is on, su command doesn't work anymore. In the PAM sources I found that #ifndef ...
user avatar
  • 259
0 votes
0 answers
46 views

Preserving file permissions in a samba server secured with SELinux

I am trying to share a folder in my Fedora machine through samba secured with SELinux. I need my machine to have read/write permission to the shared folder while other machines to only have read ...
user avatar
  • 21
0 votes
0 answers
128 views

How to enable Wireguard UDP port on SELinux

I have a wireguard tunnel on a RHEL 8 server and I would like to enable SELinux. In order to do that, Redhat docs suggest the following commnad: #> semanage port -a -t <type> -p udp <port&...
user avatar
  • 175
0 votes
0 answers
24 views

SELinux: allow line for any application

It's possible to write for SELinux an allow line for every application? I.e. I am working on a Linux embedded distro and many applications need to explicitly allowed to make use of the pseudoterminal: ...
user avatar
  • 351
0 votes
0 answers
17 views

why doesn't mkdir have a selinux policy file in android?

I have seen even toolbox (ls , rm.. etc) has selinux policy file. But, mkdir I don't see any selinux policy existing what is difference between these two ?
user avatar
0 votes
1 answer
54 views

Not parsing all ini files in /etc/php.d

Oracle Linux Server release 8.5 Apache/2.4.37 (Oracle Linux) PHP 7.2.24 The specific INI file is 20-oci8.ini, using php -i in the command line, it shows that the INI file was parsed and an OCI8 ...
user avatar
1 vote
0 answers
32 views

Mount disk of non-selinux machine on machine with selinux enabled

I have a backup server, which has selinux enabled. It has an external hard drive attached to it to store the backups (ext4). I also have a workstation which has selinux disabled. If I run rsync from ...
user avatar
  • 813
0 votes
0 answers
35 views

shmat returns error (void *) -1 in selinux enabled rhel environment

as per the documentaion:- If SHM_RDONLY is specified in shmflg, the segment is attached for reading and the process must have read permission for the segment. Otherwise the segment is attached for ...
user avatar
0 votes
2 answers
238 views

selinux blocks ping from php exec

Apache server running Centos7. I'm trying to execute a ping from PHP's 'exec' command but get "socket: permission denied". It works with selinux disabled. My linux knowledge is somewhat ...
user avatar
  • 113
0 votes
0 answers
247 views

Is it possible to change the SElinux context of a running process?

If a process is already running with a certain SElinux context: system_u:system_r:typea_t Is it possible to change the context of this running process to: system_u:system_r:typeb_t Assuming that ...
user avatar
0 votes
1 answer
103 views

I created and enabled a systemd service that manually starts, but won't auto-start after reboot. How do I figure out why it won't auto-start?

I created and enabled a systemd service that launches a CLI application in Tmux (had to disable SELinux) but the service needs to be manually started after reboot. How do I figure out why it won't ...
user avatar
  • 1
1 vote
1 answer
58 views

Is the /proc/[pid]/attr directory always created even if SELinux is not available?

I have two machines, a standard Intel-based Ubuntu and a Jetson Xavier, which both have a /proc/self/attr/current file. However, the one on the Jetson computer doesn't seem to work: Here is the output ...
user avatar
  • 2,305
0 votes
0 answers
75 views

Unable to set context label with semanage - CentOS 8

I am setting the context label with semanage on a non-default Apache Document Root. I did the following: $ su - # yum install httpd curl -y # mkdir /web # echo 'welcome to my web server' > /web/...
user avatar
1 vote
1 answer
73 views

what is the best way to add/update fcontext rules for many paths?

I need a routine to configure the fcontext for many paths. Currently I maintain a bash script calling semanage to do that. But the task seems quite verbose. The main issue here is: I cannot find a ...
user avatar
  • 930
1 vote
0 answers
165 views

Permission Denied inside a Cron script

I am having issues with commands (ls and find) not working inside a script when run via crontab. The script: #!/bin/bash -x whoami ls -l / ls -l /u01 The results: + whoami oracle + ls -l / total 640 ...
user avatar
1 vote
1 answer
115 views

Selinux: type=anom_abend for php-fpm, Error 502 while accessing the application

Hi I am using nginx server which is hosting a web application in RHEL OS with selinux in enforcing mode. On accessing the application I am getting the 502 bad gateway error and on checking the audit ...
user avatar
0 votes
0 answers
27 views

Use selinux for path based access

Consider the following scenario. I've a ro file system mounted at /system and I can't remount it rw at all. There is a file /system/bin/xyz with context u:r:bin_t. Naturally I cannot change the ...
user avatar
0 votes
0 answers
47 views

How to build custom Linux image

I want to build custom Gentoo image, one based on hardened+nomultilib stage, and another one based on hardened+nomultilib+selinux stage. I’m going to setup own binary package server on Gentoo in the ...
user avatar
0 votes
1 answer
204 views

How to allow "guix-daemon" to "remount" in SELinux?

I've installed Guix and installed the bundled SELinux policy manually. But according to Ricardo Wurmus, as of 30 June 2021: There are really just two ways: either 1) disable SELinux (or set it to ...
user avatar
1 vote
1 answer
352 views

How to install SELinux policy for guix-daemon.service on Fedora?

After installing Guix, how do I install the bundled SELinux policy, which is intended to allow the guix-daemon.service to run? To install Guix 1.3.0 on Fedora 34 Workstation, I used the shell ...
user avatar
3 votes
1 answer
432 views

SELinux: A custom Systemd Service can't write into a /var/log directory with StandardOutput

I'm trying to write a custom service definition for SystemD on a RHEL system. Currently, the output goes into the Journal, but I'd need it in a file to parse and forward it with logstash. (Note: For ...
user avatar
  • 163
0 votes
0 answers
30 views

Is there a way to allow a directory only to contain symbolic links?

I was wondering if there was a way to allow a directory only to contain symbolic links, but no standard files or directories. I want to get permission denied if a file is not a symbolic link. Maybe ...
user avatar
  • 148
0 votes
0 answers
47 views

SELinux: command output printed on serial but not on ssh

I am trying to configure SELinux on Poky Linux distro. I am connecting to the board both on serial and ssh. Launching ping and ifconfig on ssh the board prints nothing, whereas the same command on ...
user avatar
  • 351
0 votes
1 answer
42 views

audit2allow behavior has changed

I have a Red Hat server in which I was using the following command to scan the audit log and generate selinux policies: audit2allow -a -l -M modulename All of a sudden now, the program outputs an ...
user avatar
0 votes
0 answers
166 views

Adding an SELinux rule to grant a user read/write access to specific file

I'm currently running into a problem where a user on my machine called qemu can't access certain files. For example /dev/shm/looking-glass. I already ran: sudo setfacl --modify user:$(logname):rw &...
user avatar
  • 677
0 votes
0 answers
94 views

Enable full syscall auditing on Fedora for better SELinux AVC messages

When searching for SELinux AVCs one often finds the advice to enable full syscall auditing in order to path information attached to an AVC. For example, when debugging dac_override AVCs. For sure, by ...
user avatar
  • 52.9k
0 votes
0 answers
50 views

Errors when running audit2allow

Any time I run audit2allow to allow a denied action in SELinux, it throws the following errors, but proceeds normally. It started happening after I created my own custom policies for xrdp and xrdp-...
user avatar
0 votes
0 answers
30 views

SElinux "denied" IDs missing in /var/log/audit/audit.log

I have "avc: denied" entries in /var/log/audit/audit.log and want to see details for it with command "sealert -l [message_ID]" however I can't find it in audit.log nor in /var/log/...
user avatar
  • 2,537
0 votes
1 answer
89 views

SELinux and cryptsetup: chown failed and can't access temporary keystore

I am trying to set up SELinux and an encrypted additional partition that I mount at startup using a systemd service. If I run SELinux in permissive mode, everything runs ok (partition is correctly ...
user avatar
  • 351
0 votes
0 answers
47 views

Selinux avc denied read write to shm key

I am new to selinux concept and I want httpd to access shared memory, but some how httpd is not able to access the shared memory, as per audit log the message tells read write is denied for shm class ...
user avatar
0 votes
0 answers
47 views

SELinux Prevents httpd to do shared memory syscall

looks like the workaround is to allow httpd_t to run in unconfined_t for shm, which doesn't look right. I don't know how the shm need unconfined_t for key=1392707921? Can we give permission to the &...
user avatar
1 vote
0 answers
45 views

Permissions required to modify SELinux labels

I am writing code that is SELinux aware. I am new to this security module and am having a steep learning curve. For my code to work in an SELinux environment, I need to be able to relabel files. For ...
user avatar
  • 46
0 votes
0 answers
89 views

httpd, avc: denied { unix_read unix_write }

I am new to selinux concept and here I am stuck on how to make httpd perform {unix_read unix_write} Below is the audit log message. type=IPC msg=audit(1624375715.312:4225): ouid=0 ogid=0 mode=0666 obj=...
user avatar
0 votes
2 answers
389 views

chcon: failed to change context of ‘/usr/sbin/httpd’, Permission denied

I am new to SELiunx concept and as per the RHEL7 > SELinux User's and Administrator's Guide > 3.2. UNCONFINED PROCESSES Audit log type=IPC msg=audit(1624375715.312:4225): ouid=0 ogid=0 mode=0666 ...
user avatar
0 votes
0 answers
40 views

Selinux change root mapping

I want to control some accesses of root in Linux- fedora, for example, I want to run a process and I want root not to be able to kill it. I use SELinux and I changed root mapping from unconfined to ...
user avatar
  • 1

1
2 3 4 5
11