Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible role-based, mandatory access control (MAC) architecture on Linux through kernel modifications and user-tools. It is primarily used to confine system processes and users beyond the basic Discretionary Access Controls (DAC) mechanism or access-control list found on *nix systems.

Filter by
Sorted by
Tagged with
0
votes
0answers
8 views

Docker/Podman Selinux Udica - Rootless Container unable to mount/run from mapped entrypoint script

I like to use steamcmd as dockercontainer rootless for my serveruser. But steamcmd should normally installed with normal user under /opt/steam/steamcmd/steamcmd.sh I created a custom steamcmd.sh which ...
0
votes
0answers
21 views

Clean Debian install: User Manager unit failed state?

I've got a fresh Debian 10 install (I only added SSH and SELinux, installed per the Debian docs) on a VPS that runs fine, but when I do systemctl status it lists a failed unit user@1001.service. ...
2
votes
1answer
51 views

rsync_xal_set: lremovexattr(“/my/path/file.zPXUj1”,“security.selinux”) failed: Permission denied (13)

I am currently migrating from Ubuntu 20.04 to Fedora 34. Following backup script has worked fine so far: rsync \ -avixXEH \ --stats \ -...
0
votes
0answers
10 views

selinux: files in /home are created with wrong context

on Cents 7 folders/files created in /home are getting wrong context # pwd /home # ls # ls -dZ . drwxr-xr-x. root root system_u:object_r:home_root_t:s0 . # mkdir -p test/.ssh # touch test/.ssh/...
0
votes
0answers
5 views

How do I recreate /var/log/audit with the right permissions?

Since my disk space was running out and I saw it was using up several gigabytes, I decided to delete everything in /var/log/*, thinking they're just log files and it should be OK to delete. I manually ...
0
votes
0answers
51 views

Not able to install realtek rtl8723de driver on debian 10.9

I have recently installed debian 10.9 on my system using a non-free kde image. As expected there was no wifi so I had to configure it. I got this after running lspci , 03:00.0 Network controller: ...
0
votes
0answers
8 views

CUDA thows exception in podman container running on Centos 8 with SELINUX=enforcing

Getting following exception in podman container when running cuda with SELinux enforcing mode on host os: Traceback (most recent call last): File "/usr/lib/python3.8/threading.py", line ...
0
votes
1answer
41 views

Have SELinux allow syslog and logrotate to handle files outside of /var/log

on a Centos 8 server, I attached a bigger disk mounted to /mnt/data. The server runs rsyslogd which has a policy to write logs from external systems to /mnt/data/logs/$HOSTNAME. I do now have the ...
0
votes
1answer
43 views

Make a binary to always run in a cgroup

I want to make sure a binary located at certain path is always run as part of a certain cgroup. Everything I found so far involves running the binary through some special command (e.g. with systemd-...
0
votes
0answers
67 views

How to enable libvirt shared dir between fedora 33 host w/selinux and centos7 guest w/o selinux?

Using a fedora 33 host computer with SELinux enabled, I've setup a qemu/kvm guesr centos 7. In order to enable shared dir between them, I have installed centos plus kernel in the guest. The guest ...
0
votes
0answers
42 views

Automating SELinux user mappings for SSSD AD users without an IdM solution

I have several RHEL7 and CentOS7 based systems that are tied into a Windows Server 2019 Active Directory using realms/SSSD. Currently, AD users adopt the unconfined_u SELinux user mapping by default. ...
0
votes
1answer
39 views

SQLi vulnerability vs SELinux

Assume an SQLi vulnerable web app running on a Linux system, SELinux in enforcing mode. The MariaDB is running as a non-root user, say db_user. Assume we are trying to take advantage of the SQLi ...
2
votes
1answer
25 views

SELinux : Where I find selinux policy for google-chrome on Fedora Linux?

How do I find all the SELinux policies used for Google Chrome on Fedora Linux?
1
vote
0answers
59 views

dmesg is flooding with lines as SELinux: initialized

on our rhel 7.x machines we have run dmesg but we get all log as [12283.628766] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs [12286.352175] SELinux: initialized (dev tmpfs, type ...
1
vote
1answer
91 views

Block/allow specific subprocesses being launched by a process

I block all Internet traffic for my kids' Linux accounts using iptables. Sometimes I want to allow them to use one program or another. In such cases I enable them to run that program as another(...
1
vote
1answer
28 views

Linux Security Modules - SELinux/AppArmor

can someone explain to me why SELinux is officially broken under Ubuntu while AppArmor works fine? AppArmor is build on the "Linux Security Modules" framework and so is SELinux. As a result, ...
0
votes
1answer
251 views

disable rtkit-daemon.service service when selinux is disabled

we have Hadoop cluster , each machine in the cluster is rhel 7.6 version since the provider - hortonworks recommended to disable the selinux then we disabled the selinux on all rhel machines now about ...
0
votes
1answer
50 views

Linux SELINUX CONTEXTS and LABELING

Until recently I came across a situation where I was working with automount with non nfs protocol storage type ie Fsx Lustre in AWS where I found a weird issue on the automounted home directories and ...
0
votes
1answer
234 views

sudo nano /etc/network/interfaces opening a blank file

I'm trying to open a file in a CENTOS VM using sudo nano /etc/network/interfaces but all I get is a blank file. What am I missing? I'm running libselinux-2.5-15.el7.x86_64. I tried other files as well ...
2
votes
1answer
106 views

SElinux doesn't accept connection with private key

I have the following problem: I installed SElinux, mapped my user as unconfined_r with sudo privileges and allowed SSH connections, but after I set up the enforcing mode can't log in anymore with ssh ...
0
votes
1answer
117 views

Why does a SELinux problem get reported in /var/log/messages?

I have found a SELinux problem with logrotate. I'm just wondering why it was reported in /var/log/messages, and not in /var/log/audit/audit.log. I assumed that any SELinux issue gets logged into audit....
0
votes
0answers
16 views

How is it possible that processes in root-group can't both read/write to file in same group?

I am encountering a strange security issue on a Linux machine. I have 2 files (a.sh and b) that are trying to read and write to another file (c). -rwxr-xr-x 1 root root *** Nov 1 2020 /...
0
votes
0answers
18 views

Setting Default Category for Files using SELinux MCS

I'm still a bit new to SELinux but I'm trying to use categories to enforce access to files. I notice that when I create a new file, it defaults to the context (role+level+category) of the parent ...
0
votes
1answer
13 views

Making Changes To A Live HTML File From OfficeLibre Writer On Same Server

I have discussed this issue briefly in ##linux freednode twice over the past few months. Once I got crucified; WHY WOULD YOU DO THIS!? and second conversation I wasn't pleased with the results of ...
1
vote
1answer
31 views

Increase limit of categories in SELinux

I'm using SELinux in RHEL and I see that there is a default maximum of 1024 categories. MCS in Red Hat Enterprise Linux supports 1024 different categories: c0 through to c1023. s0-s0:c0.c1023 is ...
2
votes
0answers
25 views

What is the meaning of the confidence level in sealert?

In the output of sealert, how one should evaluate plugin confidence levels? The highest value should mean the most recommended action. However, are they expressed in percent? How are they calculated? ...
2
votes
1answer
69 views

SELinux: My First Policies

I am at the point it's time to create my first policies. I have read the HowTo Security SELinux, watched the video SELinux for mere mortals and multiple other documents I have received from the ...
0
votes
1answer
24 views

security context changed in new filesystem

I have /opt filesytem and files with security context within: system_u:object_r:usr_t:s0 Now I have created another filesystem and mounted it to /opt/test and files/folders within it are created with ...
1
vote
1answer
165 views

How to make selinux give access to apache|nginx in centos 8

i recently install yii2 app and after all setup i realize that i keep getting permission error and after a lot of search i notice there's nothing wrong with my setup but the problem is with SElinux ...
0
votes
1answer
280 views

systemd service won't start because of unconfined_u context?

So I'm trying to start a service (let's call it the "kite agent" and it's a binary executable that runs as part of a tracing service) with systemd via ansible deployment on CentOS Linux ...
0
votes
1answer
37 views

File context policy update vs. usage race condition

I have an Ansible playbook where one task adds a SELinux file context and the following tasks is supposed to use that new context - i.e. fix the file context of a directory if necessary. When I run ...
0
votes
1answer
194 views

Unable to run CentOs properly on my computer

I am following this guide to install lamp: https://www.linode.com/docs/web-servers/lamp/how-to-install-a-lamp-stack-on-centos-7/#optional-test-and-troubleshoot-the-lamp-stack. I cannot run the ...
2
votes
1answer
518 views

Fail to start services because of selinux Permission Denied

Can't start few services because of strange selinux Permission Denied on fresh Fedora 32 installation. UNIT LOAD ACTIVE SUB DESCRIPTION ● fprintd.service ...
0
votes
0answers
30 views

Centos7 SELinux user context not received from FreeIPA

Hopefully there is something simple I am missing here. I have FreeIPA 4.6.6 (can not update at this time), Centos 7 and Centos 6 systems. SELinux is in permissive mode. Logins on the Centos 6 system ...
1
vote
0answers
52 views

Why does sepolicy generate a self:unix_stream_socket create_stream_socket_perms allow rule?

When I generate the SELinux policy module boilerplate like this # sepolicy generate --application /usr/bin/maildrop the auto-generated local policy section reads: allow maildrop_t self:capability { ...
3
votes
1answer
347 views

Why does Linux need SELinux

What is SELinux and what are the advantages of using it? Why does Linux need another layer of protection?
0
votes
0answers
171 views

How to fix this Error: HTTP ERROR 500 and chcon: can't apply partial context to unlabeled file for WordPress

I am trying to correct this piece of code but I have an error and the code doesn't executed. I would like to use a Public IP to run WordPress as well. The problem is that I can't run sudo chcon -t ...
1
vote
2answers
574 views

SELinux: how to grant read access?

I have this systemd service with the following PIDFile property : PIDFile=/home/john/.pm2/pm2.pid You might have expected the file to be located under the /run directory. Unfortunately, that's the ...
1
vote
0answers
20 views

semodule -i fails with semodule: link.c:840: alias_copy_callback: Assertion `base_type->primary == target_type->s.value' failed

semodule -i zabbix_agentd.pp fails with semodule: link.c:840: alias_copy_callback: Assertion `base_type->primary == target_type->s.value' failed. Aborted (core dumped) Oracle Linux Server ...
1
vote
0answers
77 views

SELinux preventing write access to files

I have written a PAM module. This PAM module is loaded by processes gdm-password and gnome-screensaver (found on RHEL 6.4). The pam module wants to write some logs to a db file under user's home ...
3
votes
1answer
257 views

ls -Z option yields “?” in output

I was reading the book "Linux Bible", chapter 24 to understand SELinux. In the book the author says that using $ ls -Z my_stuff in the command should display the DAC controls and RBAC ...
0
votes
1answer
39 views

List Only The Active SELinux Booleans

I just want to know how i can list only the active or [ on ] SELinux Booleans in CentOS 8.2 when i type semanage boolean -l it gives me all the available booleans and of course it's default state and ...
1
vote
1answer
158 views

Quick way to set SELinux context for many labels - CentOS 8

I am using one of those cloud VPS providers that provide most of their storage on the /data disk, so my webroot is at /data/www instead of /var/www. And there is a symlink so that Apache works fine ...
0
votes
1answer
149 views

semanage & restorecon -R are not applying recursively as I expect

My VPS cloud provider is one of those that provides most of the storage under a /data disk, so the webroot would actually be at /data/www instead of /var/www , and there is a symbolic link from /var/...
-1
votes
1answer
35 views

Modify OS Security Module Configuration on SELinux vs AppArmor

Just some pretext, I am fairly new to this and I'm still learning how SELinux works. I am trying to Modify OS security module configurations, but the instructions given to me were for Ubuntu and ...
3
votes
1answer
179 views

Are LSM tools such as AppArmor and SELinux considered IDS/IPS? [closed]

I know this is kind of an odd question. An IDS/IPS basically autonomously recognizes and optionally prevents intrusions. And while SELinux and AppArmor seem to be trying to do the same, they are never ...
0
votes
0answers
28 views

Network gows down after SSH Session Centos 8

I have a Centos 8.2(Minimal) running on dedicated server, I setup the ssh services and ports via KVM, everything where ok but when I tried to connect from a remote PC via ssh, the host was unreachable....
0
votes
1answer
136 views

“sudo ls -a1 /home” Permission Denied

I have a php script that will run exec("bash /path/to/list.sh $dir", $out); The contents of list.sh are... #!/bin/bash sudo /usr/bin/ls -a1 $@ 2>&1 I have given apache permission to run ls ...
2
votes
1answer
280 views

What are recommended conventions for proper custom systemd service?

I have a binary that does not have any built-in commands to restart or shutdown the process it creates. After looking at some built-in CentOS services I came to conclusion I cant use them as a ...
0
votes
1answer
1k views

Unable to install Zabbix server

I just installed Zabbix-5.0 LTS on RHEL-8 OS. After logging in on the Zabbix fronend, I get message that "Zabbix server is not running:the information displayed may not be correct". Kindly help me ...

1
2 3 4 5
10