Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

0
votes
1answer
21 views

SELinuxs policy.conf configuration

I'm trying to configure SELinux on my home pc. During installation /etc/selinux/policy file had not been created thus I was not able to configure custom policy with checkpolicy. So I've copied it from ...
2
votes
1answer
138 views

How to get mount information of host inside a docker container

I need the mountpoints of all disks attached to a host inside a docker container. The mount information is available in /proc/1/mounts file, but I cannot access that file on all OS. When I run the ...
0
votes
1answer
46 views

Website cannot write to files or create directories

I've been trying to install TeemIP for about 6+ months now and I've never been able to figure out this issue on Centos7. The error I get is the following: The directory '/var/www/teemip/public_html/...
2
votes
1answer
33 views

Is there a way to specify file name using wildcards in selinux type_transition rules?

This kind of rules works perfect if filename matches exactly one specified at the end of rule, but not with wildcards. The star in the example below does not work. Well, actually it does, but it is ...
1
vote
3answers
107 views

setroubleshootd excessive cpu and memory usage

I have Centos 7 fresh install and I see setroubleshootd with high CPU usage. How can I fix this? What is this process doing?
2
votes
1answer
37 views

How to create a SELinux policy module with existing output from audit2allow?

I know the standard way of creating a SELinux policy module, like cat <auditlog_file> | audit2allow -M <module_name> However, is there a way to create a policy module if all I have is ...
2
votes
1answer
41 views

How to troubleshoot Nginx permission denied in subdirectory?

I'm working on Fedora 29 Server. SELinux is in Enforcing mode. I'm having trouble getting Nginx to serve documents from a subdirectory below root. I need to know how to troubleshot it further because ...
0
votes
0answers
71 views

Unable to restart Polkit service in Centos 7

I am unable to start nscd.service on centos 7 the error is polkit service is not running. Below is error. ** (pkttyagent:27796): WARNING **: Unable to register authentication agent: GDBus.Error:org....
0
votes
1answer
33 views

Ansible modules copy/template errors for Linux 5 hosts using python26 ,python binding libselinux-python needed

We have some 50 odd linux 5 hosts, and to manage that we use ansible. Problem :- Ansible modules copy/template errors for Linux 5 hosts using python26 ,python binding libselinux-python needed ...
1
vote
0answers
44 views

Having issue with nscd.service in Centos 7. Error Failed to start Name Service Cache Daemon [closed]

I am running Centos 7 server. I am unable to start "nscd.service". Error shows "Failed to start Name Service Cache Daemon". Please provide me with solution?
0
votes
0answers
21 views

After I enable SELinux, some devices node are unable to be accessed

I enable SELinux feature by configuring kernel (below shows what I changed): @@ -44,7 +44,10 @@ CONFIG_SYSVIPC=y CONFIG_SYSVIPC_SYSCTL=y # CONFIG_POSIX_MQUEUE is not set # CONFIG_FHANDLE is not ...
2
votes
1answer
15 views

How can I allow a given application to access a given folder and its content

I recently installed a game through Steam, but some of the assets of the game aren't loaded. After a few investigations on the web, the Windows users who had the same problem were adviced to turn off ...
0
votes
0answers
32 views

Allowing read write access to a directory under SELinux

Is it possible to allow ANY process to read/write to a directory under SELinux? What I'd like is proper 0777 access to a directory and I really don't care which processes read or write to it. I know ...
1
vote
0answers
20 views

Running lightweight SELinux policy in production

I'd like to take advantage of SELinux ability to restrict a group of Linux processes. The group is unprivileged users with high enough UID (say, >1000). This I want to do on a shared hosting server, ...
0
votes
0answers
103 views

SELinux is preventing /usr/sbin/nginx from execute access on the file /etc/ld.so.cache

I'm getting a weird SElinux issue where if I restart Nginx with sudo systemctl restart nginx and SElinux is enforcing the server jams up causing the website to crash and the servers CPU hits 70 - 90 ...
6
votes
2answers
39 views

Is there a tool which can find which SELinux rule allowed a particular access to occur?

My system has a very complex SELinux policy. Is there a tool which can explain why a particular access was granted? Often when I search for a particular rule using text search I don't find it because ...
0
votes
1answer
36 views

SElinux and TCP Traceroute

I need to run a TCP Traceroute in the browser but are getting a few SElinux alerts. I have tried creating a policy with audit2allow, e.g ausearch -c 'traceroute' --raw | audit2allow -M my-traceroute ...
2
votes
0answers
30 views

Change SE Linux context label of a specific folder inside a cifs mount

have cifs mount on my setup mounted via /etc/fstab with context set to system_u:object_r:cifs_t:s0. There are some specific folders that I want to override default context to set public_content_t so I ...
2
votes
1answer
96 views

SELinux is preventing /usr/sbin/php-fpm from lock access on the file cert9.db

I have an selinux alert for the file /var/cache/nginx/.pki/nssdb/cert9.db., but I don't know what label I should give to it. The selinux report suggests hundreds of labels, but which is the correct ...
-1
votes
1answer
130 views

How to disable SELINUX using grub?

I accidentally enabled SELINUX and reboot the system without knowing it's consequence. Now, I can't access the login system in my CENTOS 7 unit. What I've tried so far: https://serverfault.com/...
0
votes
1answer
63 views

SFTP SELinux ssh_chroot_full_access

I always configured SFTP on Centos 6 like this: https://www.linuxtechi.com/configure-chroot-sftp-in-linux/ Where in the comment this item appeared: setsebool -P ssh_chroot_full_access on From the ...
0
votes
2answers
47 views

side effects of disabling selinux

A few days ago I ran into a big problem and asked it here and I found out that selinux was the cause of that. I have some virtual and physical machines with CentOS 6.7 or 6.9 as OS. They all have ...
0
votes
1answer
121 views

Activate SElinux on Kali

I am unable to activate SElinux enforce on Kali. I tried the following without success Change the configuration command line \# setenforce 1 add set selinux=enforce to the boot option
1
vote
0answers
21 views

What combination of labels to use to let NGINX connect to socket in /home/user?

I'm running a uwsgi app that creates a unix socket in /home/user/myapp.sock and nginx has been given the right permissions to access the file, however, selinux isn't letting me connect to it: avc: ...
0
votes
0answers
52 views

CentoOS 7 Samba Share USB NTFS

Cannot seem to find an answer which includes all of the specifics of my situation. I followed instructions in Sharing a mounted drive with samba on CentOS7, but still have a problem. I have CentOS 7 ...
2
votes
0answers
89 views

User account mapped to SELinux staff_u account but unable to run sudo command

I have two user accounts in my virtual machine, anim and anim2. Both are part of the wheel group and can run su/sudo commands. I was reading on redhat how SELinux user staff_u can only run sudo ...
1
vote
2answers
76 views

Real application of selinux [closed]

Almost all tutorial and most systems i have seen seem to disable selinux. Are there actual implementation of selinux security in real world ?
0
votes
0answers
51 views

“semanage port” command does not work

So, I was tasked to chagen SSH port in a CentOS server. As I did in the configuration file, the service failed to start, so after a little research I found that I should make some changes in selinux, ...
8
votes
1answer
157 views

Allow certain risky behaviour of a single program in a safe way in SELinux

I have a program running inside a Docker container that loads an .so file which alters the behaviour of the program through hooking and memory manipulation. This behaviour is blocked by SELinux with ...
1
vote
0answers
83 views

How to exclude a directory or partition on pmlogger scan?

As on the details below it look like that the cause of the problem is the pmlogger is spawning the find command. And its takes a long time for the find to scan all the files in one of my partition. ...
3
votes
0answers
116 views

Symbolic links do not allow SELinux type_transition

Trying to access symbolic link does not allow to use SELinux type_transition. I mean that I tried to implement scheme in which user has access to a symbolic link located in /usr/bin/ and which leads ...
1
vote
0answers
108 views

How to mount ecryptfs and preserve individual SELinux tag of underlying files?

I am trying to mount ecryptfs on a system that uses SELinux (e.g. Cent-OS), and I want to preserve the security tag of all individual underlying files. Using mount -o command I can set the security ...
2
votes
2answers
136 views

Selinux is blocking my external kernel module

I'm trying to insert an external kernel module in permanent mode. During the boot, my module is being loaded by systemd-modules-load service so long as Selinux is permissive. But I want to keep ...
-1
votes
2answers
62 views

SELinux is preventing $_POST variables on Amazon Linux 2

I began playing with RPM based OSes and I am really impressed. Amazon Linux doesn't include setroubleshoot in any of their repos. I want to use official repos for everything, otherwise I would ...
1
vote
1answer
120 views

In a custom module, is there a way to allow all permissions for files/directories?

I've written a custom selinux module that looks something like this: require { type my_app_t; type my_app_file_t; class file { getattr lock open read write execute execute_no_trans ioctl ...
4
votes
1answer
196 views

SELinux Interfering With sss_cache

System: HP Pavilion Power Laptop 15-cb0xx Intel i7-7700HQ w/ integrated graphics enabled (can't be turned off in bios) Fedora 28 NVIDIA GTX 1050 (mobile) I used the dnfdragora GUI to update about ...
1
vote
2answers
150 views

SELinux demands constant relabeling

I have installed SELinux on Ubuntu 18.04.1 LTS via # apt install selinux After the mandatory reboot, SELinux was constantly disabled until I added SELinux = 1 to /etc/default/grub and executed ...
0
votes
2answers
399 views

SELinux is preventing httpd from create access on the file

Whenever I upload a file via my web browser to my web sever, I see the following lines in /var/log/messages Nov 8 12:18:24 sn setroubleshoot: SELinux is preventing httpd from create access on the ...
0
votes
0answers
50 views

Why can't set my selinux status as enabled?

I had bought a vps ,installed centos7. rpm -qa | grep selinux libselinux-2.5-12.el7.x86_64 libselinux-utils-2.5-12.el7.x86_64 libselinux-python-2.5-12.el7.x86_64 No /etc/sysconfig/selinux and /etc/...
0
votes
1answer
125 views

How to run Java application in confined SELinux domain?

I am working with a Java app that has been labeled with its own SELinux type. Java executes it as unconfined_t instead of the labeled type. Java is labeled as bin_t (ls -Z /usr/lib/jvm/java-1.8.0-...
2
votes
0answers
94 views

Maintaining file's SELinux labels when copying them from one directory into another

Default behavior for copying files or sub-dirs from one directory to another is that the copied objects do not maintain their SELinux type (domain) which is opposite to objects which were moved. ...
1
vote
1answer
234 views

SELinux vs AppArmor applicability

I am going through some primers on LSM implementations so eventually I am digging a bit into AppArmor and SELinux. I am aware of this discussion but this does not make very clear one question I am ...
2
votes
1answer
64 views

Prevent Mount under Destination

I want to prevent all users (including root) from mounting anything under a specific destination (e.g. /tmp) by SELinux or any other Linux tool, is this possible? And how would it be done? Regarding ...
2
votes
1answer
82 views

How is SELinux loaded on boot?

I understand that a configuration file is in: /etc/selinux/config But how is it processed at boot? How does SELinux start, is it a daemon? Which startup script starts SELinux?
0
votes
1answer
254 views

How to extend SELinux policy to allow ntpd to use gps?

There is an attached device on the motherboard and the NTP service tries to read data from it (the attached device link is in /dev directory). Using SELinux enforcing, the service status errors that ...
2
votes
0answers
303 views

Yama LSM seems to do nothing. RHEL/Centos 7.5

The Yama security module is supposed to be able to prevent users from running the ptrace system call, yet even with kernel.yama.ptrace_scope set to 3, users can still run strace (which uses ptrace). ...
3
votes
1answer
115 views

Is it possible to prevent a change in SELinux status without a reboot?

I'd like to be able to prevent even a privileged user from changing the SELinux mode from enforcing to permissive without a reboot. It's too easy for a root user to run setenforce permissive, make ...
0
votes
1answer
287 views

CentOS Server file permissions

I am starting to learn server management with a CentOS Virtual Machine. I am trying to make a simple website. Because the Apache default file is in /var/www it is hard to write/make/change files. ...
1
vote
1answer
133 views

How to troubleshoot SELinux issues?

I suspect I have a problem in SELinux configuration: my issue goes away after disabling selinux using setenforce 0. I am using the default policy without any modifications. How can I pinpoint the ...
7
votes
1answer
292 views

What is the proper way to set SELinux context in an RPM .spec? (RHEL7 in 2018)

The RHEL7 supplied tomcat package supports multiple instances through the creation of directories and symlinks. Once such a multiple instance is created and packaged as an RPM, the extra instances ...