Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

1
vote
0answers
11 views

How to run single application in permissive mode and remaing all in enforcement mode for SEAndroid?

I want to allow single application to run in permissive and remaining all enforcement mode for SEAndroid. For setting up that what needs to do.. Please suggest me solution for SEAndroid. Thanks,
0
votes
0answers
23 views

Permission denied for imjournal: rename()

after disabling and enabling SELinux the Apache and MySQL cannot start, this error shows in messages.log: imjournal: rename() failed for new path: '/var/lib/rsyslog/imjournal.state': Permission ...
0
votes
1answer
42 views

SElinux configuration of symlinked /etc/my.cnf -> /app/program/my.cnf

Please advise me of whether it is possible to configure SElinux context in a way that MariaDB would pick it up. current configuration: ls -lZ /etc/my.cnf lrwxrwxrwx. root root system_u:object_r:...
1
vote
1answer
28 views

How to disable dontaudit denials in SEAndroid

My application is working in permissive mode, but not in Enforcing mode for SEAndroid. Here i cleared (allowed) all denials,so now there is no denial logs coming in my logcat logs.So it might be ...
-1
votes
1answer
22 views

Rsyslog in not logging due to Selinux, is my workaround ok

I have these two parameters in /etc/rsyslog.conf $ModLoad imjournal # provides access to the systemd journal ... # Turn off message reception via local log socket; # local messages are retrieved ...
0
votes
1answer
38 views

sshd[5589]: error: PAM: pam_open_session(): Cannot make/remove an entry for the specified session

I am working with a CentOS7 minimal install. I configured pam_radius with pam_script and was always able to ssh to the server using pubkey auth: that was on purpose. But after hardening the server ...
2
votes
1answer
38 views

Selinux causing sshd to fail when using AuthorizedKeysCommand

I have been following Gitlab's guide to enable Fast lookup of authorized SSH keys. Guide instructs to use AuthorizedKeysCommand. Authorized command is calling local https server. This command chain ...
4
votes
1answer
67 views

SELinux: running a custom shell binary from /etc/passwd

----- Problem -------- I have CentOS 7.6 running on my system. I want to invoke a custom shell instead of standard shell in the /etc/passwd file. I have SELinux enabled, and for some reason sshd_t ...
2
votes
0answers
19 views

selinux restorecon on systems without selinux like ubuntu [duplicate]

recently i had to change two files on a fedora raw image mounted via loopback on ubuntu, which usually runs in a kvm on the ubuntu host. That made a lot of troubles with selinux after booting from the ...
4
votes
3answers
84 views

Why do selinux policies apply to commands (e.g: logrotate) running from cronjobs, but not when run directly from command line?

Why do selinux policies apply to commands (e.g: logrotate) running from cronjobs, but not when run directly from command line? When I run logrotate manually from the command line, it works perfectly. ...
0
votes
1answer
28 views

SELinuxs policy.conf configuration

I'm trying to configure SELinux on my home pc. During installation /etc/selinux/policy file had not been created thus I was not able to configure custom policy with checkpolicy. So I've copied it from ...
3
votes
1answer
484 views

How to get mount information of host inside a docker container

I need the mountpoints of all disks attached to a host inside a docker container. The mount information is available in /proc/1/mounts file, but I cannot access that file on all OS. When I run the ...
0
votes
2answers
123 views

Website cannot write to files or create directories

I've been trying to install TeemIP for about 6+ months now and I've never been able to figure out this issue on Centos7. The error I get is the following: The directory '/var/www/teemip/public_html/...
3
votes
1answer
41 views

Is there a way to specify file name using wildcards in selinux type_transition rules?

This kind of rules works perfect if filename matches exactly one specified at the end of rule, but not with wildcards. The star in the example below does not work. Well, actually it does, but it is ...
1
vote
3answers
280 views

setroubleshootd excessive cpu and memory usage

I have Centos 7 fresh install and I see setroubleshootd with high CPU usage. How can I fix this? What is this process doing?
2
votes
1answer
47 views

How to create a SELinux policy module with existing output from audit2allow?

I know the standard way of creating a SELinux policy module, like cat <auditlog_file> | audit2allow -M <module_name> However, is there a way to create a policy module if all I have is ...
2
votes
1answer
87 views

How to troubleshoot Nginx permission denied in subdirectory?

I'm working on Fedora 29 Server. SELinux is in Enforcing mode. I'm having trouble getting Nginx to serve documents from a subdirectory below root. I need to know how to troubleshot it further because ...
0
votes
0answers
224 views

Unable to restart Polkit service in Centos 7

I am unable to start nscd.service on centos 7 the error is polkit service is not running. Below is error. ** (pkttyagent:27796): WARNING **: Unable to register authentication agent: GDBus.Error:org....
0
votes
1answer
110 views

Ansible modules copy/template errors for Linux 5 hosts using python26 ,python binding libselinux-python needed

We have some 50 odd linux 5 hosts, and to manage that we use ansible. Problem :- Ansible modules copy/template errors for Linux 5 hosts using python26 ,python binding libselinux-python needed ...
1
vote
0answers
122 views

Having issue with nscd.service in Centos 7. Error Failed to start Name Service Cache Daemon [closed]

I am running Centos 7 server. I am unable to start "nscd.service". Error shows "Failed to start Name Service Cache Daemon". Please provide me with solution?
0
votes
0answers
44 views

After I enable SELinux, some devices node are unable to be accessed

I enable SELinux feature by configuring kernel (below shows what I changed): @@ -44,7 +44,10 @@ CONFIG_SYSVIPC=y CONFIG_SYSVIPC_SYSCTL=y # CONFIG_POSIX_MQUEUE is not set # CONFIG_FHANDLE is not ...
2
votes
1answer
22 views

How can I allow a given application to access a given folder and its content

I recently installed a game through Steam, but some of the assets of the game aren't loaded. After a few investigations on the web, the Windows users who had the same problem were adviced to turn off ...
0
votes
0answers
70 views

Allowing read write access to a directory under SELinux

Is it possible to allow ANY process to read/write to a directory under SELinux? What I'd like is proper 0777 access to a directory and I really don't care which processes read or write to it. I know ...
1
vote
0answers
25 views

Running lightweight SELinux policy in production

I'd like to take advantage of SELinux ability to restrict a group of Linux processes. The group is unprivileged users with high enough UID (say, >1000). This I want to do on a shared hosting server, ...
0
votes
0answers
197 views

SELinux is preventing /usr/sbin/nginx from execute access on the file /etc/ld.so.cache

I'm getting a weird SElinux issue where if I restart Nginx with sudo systemctl restart nginx and SElinux is enforcing the server jams up causing the website to crash and the servers CPU hits 70 - 90 ...
6
votes
2answers
43 views

Is there a tool which can find which SELinux rule allowed a particular access to occur?

My system has a very complex SELinux policy. Is there a tool which can explain why a particular access was granted? Often when I search for a particular rule using text search I don't find it because ...
0
votes
1answer
46 views

SElinux and TCP Traceroute

I need to run a TCP Traceroute in the browser but are getting a few SElinux alerts. I have tried creating a policy with audit2allow, e.g ausearch -c 'traceroute' --raw | audit2allow -M my-traceroute ...
2
votes
0answers
41 views

Change SE Linux context label of a specific folder inside a cifs mount

have cifs mount on my setup mounted via /etc/fstab with context set to system_u:object_r:cifs_t:s0. There are some specific folders that I want to override default context to set public_content_t so I ...
2
votes
1answer
161 views

SELinux is preventing /usr/sbin/php-fpm from lock access on the file cert9.db

I have an selinux alert for the file /var/cache/nginx/.pki/nssdb/cert9.db., but I don't know what label I should give to it. The selinux report suggests hundreds of labels, but which is the correct ...
-1
votes
1answer
324 views

How to disable SELINUX using grub?

I accidentally enabled SELINUX and reboot the system without knowing it's consequence. Now, I can't access the login system in my CENTOS 7 unit. What I've tried so far: https://serverfault.com/...
0
votes
1answer
114 views

SFTP SELinux ssh_chroot_full_access

I always configured SFTP on Centos 6 like this: https://www.linuxtechi.com/configure-chroot-sftp-in-linux/ Where in the comment this item appeared: setsebool -P ssh_chroot_full_access on From the ...
0
votes
2answers
72 views

side effects of disabling selinux

A few days ago I ran into a big problem and asked it here and I found out that selinux was the cause of that. I have some virtual and physical machines with CentOS 6.7 or 6.9 as OS. They all have ...
1
vote
0answers
25 views

What combination of labels to use to let NGINX connect to socket in /home/user?

I'm running a uwsgi app that creates a unix socket in /home/user/myapp.sock and nginx has been given the right permissions to access the file, however, selinux isn't letting me connect to it: avc: ...
0
votes
0answers
93 views

CentoOS 7 Samba Share USB NTFS

Cannot seem to find an answer which includes all of the specifics of my situation. I followed instructions in Sharing a mounted drive with samba on CentOS7, but still have a problem. I have CentOS 7 ...
2
votes
0answers
178 views

User account mapped to SELinux staff_u account but unable to run sudo command

I have two user accounts in my virtual machine, anim and anim2. Both are part of the wheel group and can run su/sudo commands. I was reading on redhat how SELinux user staff_u can only run sudo ...
1
vote
2answers
85 views

Real application of selinux [closed]

Almost all tutorial and most systems i have seen seem to disable selinux. Are there actual implementation of selinux security in real world ?
0
votes
0answers
74 views

“semanage port” command does not work

So, I was tasked to chagen SSH port in a CentOS server. As I did in the configuration file, the service failed to start, so after a little research I found that I should make some changes in selinux, ...
8
votes
1answer
170 views

Allow certain risky behaviour of a single program in a safe way in SELinux

I have a program running inside a Docker container that loads an .so file which alters the behaviour of the program through hooking and memory manipulation. This behaviour is blocked by SELinux with ...
1
vote
0answers
105 views

How to exclude a directory or partition on pmlogger scan?

As on the details below it look like that the cause of the problem is the pmlogger is spawning the find command. And its takes a long time for the find to scan all the files in one of my partition. ...
3
votes
0answers
181 views

Symbolic links do not allow SELinux type_transition

Trying to access symbolic link does not allow to use SELinux type_transition. I mean that I tried to implement scheme in which user has access to a symbolic link located in /usr/bin/ and which leads ...
1
vote
0answers
122 views

How to mount ecryptfs and preserve individual SELinux tag of underlying files?

I am trying to mount ecryptfs on a system that uses SELinux (e.g. Cent-OS), and I want to preserve the security tag of all individual underlying files. Using mount -o command I can set the security ...
2
votes
2answers
182 views

Selinux is blocking my external kernel module

I'm trying to insert an external kernel module in permanent mode. During the boot, my module is being loaded by systemd-modules-load service so long as Selinux is permissive. But I want to keep ...
-1
votes
2answers
93 views

SELinux is preventing $_POST variables on Amazon Linux 2

I began playing with RPM based OSes and I am really impressed. Amazon Linux doesn't include setroubleshoot in any of their repos. I want to use official repos for everything, otherwise I would ...
1
vote
1answer
172 views

In a custom module, is there a way to allow all permissions for files/directories?

I've written a custom selinux module that looks something like this: require { type my_app_t; type my_app_file_t; class file { getattr lock open read write execute execute_no_trans ioctl ...
4
votes
1answer
226 views

SELinux Interfering With sss_cache

System: HP Pavilion Power Laptop 15-cb0xx Intel i7-7700HQ w/ integrated graphics enabled (can't be turned off in bios) Fedora 28 NVIDIA GTX 1050 (mobile) I used the dnfdragora GUI to update about ...
1
vote
2answers
187 views

SELinux demands constant relabeling

I have installed SELinux on Ubuntu 18.04.1 LTS via # apt install selinux After the mandatory reboot, SELinux was constantly disabled until I added SELinux = 1 to /etc/default/grub and executed ...
0
votes
2answers
503 views

SELinux is preventing httpd from create access on the file

Whenever I upload a file via my web browser to my web sever, I see the following lines in /var/log/messages Nov 8 12:18:24 sn setroubleshoot: SELinux is preventing httpd from create access on the ...
0
votes
0answers
59 views

Why can't set my selinux status as enabled?

I had bought a vps ,installed centos7. rpm -qa | grep selinux libselinux-2.5-12.el7.x86_64 libselinux-utils-2.5-12.el7.x86_64 libselinux-python-2.5-12.el7.x86_64 No /etc/sysconfig/selinux and /etc/...
0
votes
1answer
182 views

How to run Java application in confined SELinux domain?

I am working with a Java app that has been labeled with its own SELinux type. Java executes it as unconfined_t instead of the labeled type. Java is labeled as bin_t (ls -Z /usr/lib/jvm/java-1.8.0-...
2
votes
0answers
128 views

Maintaining file's SELinux labels when copying them from one directory into another

Default behavior for copying files or sub-dirs from one directory to another is that the copied objects do not maintain their SELinux type (domain) which is opposite to objects which were moved. ...