Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible role-based, mandatory access control (MAC) architecture on Linux through kernel modifications and user-tools. It is primarily used to confine system processes and users beyond the basic Discretionary Access Controls (DAC) mechanism or access-control list found on *nix systems.

Filter by
Sorted by
Tagged with
-1
votes
1answer
15 views

Modify OS Security Module Configuration on SELinux vs AppArmor

Just some pretext, I am fairly new to this and I'm still learning how SELinux works. I am trying to Modify OS security module configurations, but the instructions given to me were for Ubuntu and ...
2
votes
1answer
74 views

Are LSM tools such as AppArmor and SELinux considered IDS/IPS?

I know this is kind of an odd question. An IDS/IPS basically autonomously recognizes and optionally prevents intrusions. And while SELinux and AppArmor seem to be trying to do the same, they are never ...
0
votes
0answers
21 views

Network gows down after SSH Session Centos 8

I have a Centos 8.2(Minimal) running on dedicated server, I setup the ssh services and ports via KVM, everything where ok but when I tried to connect from a remote PC via ssh, the host was unreachable....
0
votes
1answer
36 views

“sudo ls -a1 /home” Permission Denied

I have a php script that will run exec("bash /path/to/list.sh $dir", $out); The contents of list.sh are... #!/bin/bash sudo /usr/bin/ls -a1 $@ 2>&1 I have given apache permission to run ls ...
1
vote
1answer
32 views

What are recommended conventions for proper custom systemd service?

I have a binary that does not have any built-in commands to restart or shutdown the process it creates. After looking at some built-in CentOS services I came to conclusion I cant use them as a ...
0
votes
1answer
65 views

Unable to install Zabbix server

I just installed Zabbix-5.0 LTS on RHEL-8 OS. After logging in on the Zabbix fronend, I get message that "Zabbix server is not running:the information displayed may not be correct". Kindly help me ...
1
vote
0answers
36 views

Is it possible to use systemd on Gentoo with hardened/selinux profile?

Or I need to create custom profile which will combine settings from hardened/selinux and systemd profiles? Because I even can't unmask sys-apps/systemd or set USE-flag systemd on some package.
0
votes
1answer
21 views

Way to do a recursive chown avoiding any SELinux violation

in script a.sh: chown -R root:group parent-folder/ chown -R root:group parent-folder/* The script runs as root user. When chown gets executed it show below SELinux violations: chown : type=...
1
vote
0answers
25 views

Hundreds of CONFIG_CHANGE Messages in audit log

I'm using CentOS Linux release 7.8.2003 with SELinux in Enforcing mode. In my /var/log/audit directory, I'm seeing audit.log files with hundreds and hundreds of messages like this: type=...
0
votes
0answers
31 views

SELinux sandbox on debian buster

I have installed and enabled SELinux on Debian 10 (Buster). Running sandbox however returns: /usr/bin/sandbox: Sandbox Policy is not currently installed. You need to install the selinux-policy-...
0
votes
0answers
22 views

Why am i getting permission denied from selinux when running a script as a service?

when i ran the script myself it ran fine but when running as a service i get errors. As far as i can understand rsync is running in rsync_t domain and hence denied to write to user_home_dir_t. Please ...
0
votes
0answers
13 views

The contexts match but I dont understand why selinux is giving this error

I am getting the following error. type=AVC msg=audit(1588861923.865:686): avc: denied { execute } for pid=3669 comm="(realview)" name="realview" dev="dm-0" ino=18430955 scontext=system_u:system_r:...
0
votes
2answers
56 views

how to apply samba_share_t to everything under a folder

I mounted my 5tb worth of /data to my new linux RHEL 7.7 server. I have selinux as enforcing; I have /data samba shared out and it is mostly working. But when I go a few folders deep into /data/ I ...
0
votes
1answer
38 views

selinux samba samba_share_t and chcon vs semanage fcontext

Can I get clarification on how to properly set up samba folder shares on a RHEL/CENTOS 7 linux server having selinux enforcing. SELinux requires files to have an extended attribute to define the file ...
0
votes
0answers
11 views

SELinux vs. Boolen

Is it possible that SELinux is only reporting errors regarding context related issues in the avc.log (no audit daemon running) or audit.log (audit daemon running) log files? I was looking at an ...
0
votes
0answers
29 views

How to enable SELinux policy module permanently?

I have an RHEL 8.1 system that I use for development, and the system comes with SELinux in enforcing mode by default. On that system I write and run Python scripts with Visual Studio Code, and for ...
-3
votes
2answers
122 views

SELinux causing boot failures [closed]

I can't boot because SELinux is causing some serious problems. It's blocking access to all files. Services are disabled. Stuck at grub prompt. In problem number 3, I'm stuck at it and there's no ...
0
votes
0answers
19 views

SELinux: Preventing Command Execution from Webserver

I realize this may be a strange request but I am doing testing to see what selinux can do to secure web applications and I can't seem to disable command injection. I have looked through the httpd ...
1
vote
1answer
21 views

How to enable Nginx binding to UDP port 10000 with SELinux

Not sure if ServerFault is a better place for this question? I'm building a new application which needs Nginx to bind to UDP port 10000. If this were a TCP port for HTTP/S then I'd just add it to the ...
0
votes
1answer
137 views

SELinux is blocking gunicorn

I am wrote a systemd unit to start gunicorn but it unfortunately kept failing, upon checking journalctl I found the following error. SELinux is preventing /usr/lib/systemd/systemd from execute access ...
0
votes
0answers
20 views

Turning on selinux causes HDMI to not work. How to resolve?

In my ubuntu setup, i've turned on selinux. However that causes the HDMI port to not work? I assume there's a policy in there that stops this, but setting selinux to permissive, the machine still ...
2
votes
0answers
39 views

How to edit a binary SeLinux policy file?

It appears root access is irrelevant on my device as everything is managed by SeLinux (the root user basically can’t execute anything). The problem is I can’t just create my new polices. I need to ...
0
votes
0answers
7 views

How to add new rules to dontaudit

How to add new rules to dontaudit. How do I check on the Internet to show that I have not joined?
0
votes
0answers
19 views

Questions about audit and selinux

Recently wanted to keep log on auditd via logrotate But seliunx keeps blocking It is also invalid to follow the action recommended by selinux The action is as follows ausearch -c 'logrotate' --raw | ...
1
vote
1answer
76 views

Do I need to create a custom file context type for /etc/zabbix/ if I don't want to use unlabeled_t?

I have installed zabbix (a monitoring application) on a CentOS 7 machine. For security purposes, I want to leave selinux in enforced mode. Therefore I have to grant my zabbix a few permissions in ...
0
votes
0answers
100 views

Can't Login to Fedora 31 After System Restore

I'm new here, so I apologize in advance for how ineptly I may ask this question. I recently had to restore my entire Fedora 31 system from a backup made with Rsnapshot. (I had intended to make ...
0
votes
1answer
156 views

How to recursively remove all SELinux contexts?

I am trying to make my production environment equivalent to my staging environment. On production, SELinux contexts were applied. If I list the files in a directory, I see the dot at the end of the ...
0
votes
0answers
34 views

How to write SEPolicy policy for MLS/MCS related types?

Can any one explain how to write sepolcies for MLS/MCS Multilevel security related allow rules. For MLS/MCS related denials, if we add policies in respective .te files also it is throwing denials ...
0
votes
0answers
13 views

audit.log shows unconfined even filesystem label is different

I have a file which is being labeled by a custom SELinux module's file context part. See relevant module.fc content: /home/openemm/var/run/bav\.sock -s gen_context(system_u:object_r:...
0
votes
0answers
36 views

Selinux context problem with Nagios ncpa plugin

I am installing the NCPA Nagios plugin in different servers for checking many parameters. Basically, NCPA runs a script in a remote machine and report the result to the Nagios server; NCPA every ...
0
votes
1answer
57 views

restorecon not setting fcontext created using semanage

I think there is a gap in my understanding of how to change one file's context permantently. After reading through https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/...
0
votes
1answer
197 views

How to set selinux labels for a folder hierarchy accessed server side by NFS, Apache, and SaMBa daemons simultaneously?

The Mandatory Access Controls or MAC labels are different for NFS which are different for httpd, and different yet again for SaMBa. What is the proper way nowadays to label a SINGLE shared filesystem ...
2
votes
1answer
73 views

SELinux is blocking connections from Amavis back into itself: no way in/out?

Running a fresh CentOS8 install here, MTA is Postfix with Amavis hooked in. I want to have Amavis inject messages from ORIGINATING (incoming submissions from port 587/Postfix through 10026/Amavis) ...
-2
votes
2answers
342 views

How to restrict anyone (Root user also) to modify file in Linux?

I am developing one security base software for LINUX platform using C and CPP. I want to restrict all users even ROOT user also to modify the file. i.e No one can modify the file. Modifying means No ...
2
votes
3answers
625 views

SELinux blocking qemu / libvirt from accessing ISO

I am unable to get selinux to allow libvirt to access images and ISO files outside of the default libvirt directory. What makes it more frustrating is that audit2allow and setroubleshooter does not ...
2
votes
1answer
63 views

Cannot disable SELinux by modifying the config file and rebooting

I'm trying to disable SELinux on a virtual environment (because a software component we use recommends it, not because I want to) I have tried setting its status to "disabled" in /etc/selinux/config ...
1
vote
0answers
72 views

Fedora 30 : Ensure No Device Files are Unlabeled by SELinux

While hardening Fedora 30, I encountered this measure on open-scap.org and actually the command : sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n" returns on my system ...
0
votes
2answers
129 views

selinux prevents pam_exec command from being executed

I am trying to setup my computer to notify me every time a user logs in (via ssh, via gdm or tty). Right now I am setting up sshd and I added this to /etc/pam.d/sshd: session optional pam_exec.so /...
3
votes
2answers
669 views

/etc/pam.d/ rules for ssh and login

In /etc/pam.d/, the configuration files for sshd and login have some rules for selinux. Can I simply disable those lines, when I am not using selinux ? I would like to simplify the pam rules. ...
0
votes
0answers
63 views

Restrict directory access to single process using apparmour

I'm going to create program creating directory and granting privileges to this directory to program request of creating this directory. Each directory, created by my program, will be putted in one ...
0
votes
1answer
159 views

Bash rm /proc/sys/net/ipv4/icmp_echo_ignore_all: Permission denied

I have created this file /proc/sys/net/ipv4/icmp_echo_ignore_all couple of months ago on my centos 7 server to disable ping requests permanently and now I can not undo this! I'm logged in as root ...
0
votes
1answer
29 views

Selinux and Docker file creation context

I'm working on a container that I want to add a static mount of -v /home/_username:/home/_username but I want to avoid using the z or Z mount options. I've been able to use audit2allow to create a ...
2
votes
1answer
19 views

Get SELinux permisison list associated with socket base

This shows the permissions associated with the tcp_socket class: > seinfo -c tcp_socket -x Classes: 1 class tcp_socket inherits socket { connectto name_connect ...
3
votes
1answer
633 views

How to set SELinux in permissive mode without reboot?

I am on Fedora 29 and SELinux is currently disabled. I am trying to put into permissive mode using setenforce permissive, but always get setenforce: SELinux is disabled this output and then status ...
1
vote
0answers
183 views

selinux preventing init_t access to httpd_sys_content_t

I have a systemd service file that runs a script. It is getting blocked by selinux: type=AVC msg=audit(1570329687.437:218): avc: denied { execute } for pid=1079 comm="(index.sh)" name="make_index....
0
votes
1answer
41 views

SElinux package removes grub-efi

ON my linux mint 19.2 machine, I am trying to set up Selinux. But when i install selinux package, it removes grub-efi. When I try to reinstall grub-efi, it removes selinux Does this mean selinux is ...
0
votes
1answer
341 views

Allow SCP in RHEL CentOS 7 selinux

running rhel 7.6 (or centos 7.6) With selinux = enforcing doing an ssh in to or out of the system works, but doing a scp to the RHEL selinux system does not work. On the RHEL system if I do ...
0
votes
1answer
120 views

What does “permissive” statement mean in SELinux policy type enforcement (.te) file?

I'm defining a new type mynewtype_t. There is a line which was automatically generated with the permissive keyword. $ sepolicy generate --init /bin/sh Failed to retrieve rpm info for selinux-policy ...
0
votes
0answers
78 views

How to setup an SELinux policy to allow only a specific context permission to 'execheap'

I want to enable the dynamic core in DOSBox but this is incompatible with SELinux as unconfined_t by default is not allowed to execute from the heap. The SELinux troubleshooter suggests: You must ...
0
votes
1answer
133 views

GoogleAuthenticator PAM Module Permissions Issue — VPN with MFA in AWS EC2 running CentOS

Full Disclosure: I am writing this question to then answer it myself. I searched the internet for a full day at work and was not able to find a solution that worked for me. I even compiled my own ...

1
2 3 4 5
10