Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

2
votes
1answer
48 views

Selinux is blocking my external kernel module

I'm trying to insert an external kernel module in permanent mode. During the boot, my module is being loaded by systemd-modules-load service so long as Selinux is permissive. But I want to keep ...
0
votes
0answers
24 views

osTicket SELinux settings [on hold]

I need to enable SELinux, but I don't know how to setup permissions for osTicket 1.10 with SELinux Centos 7.4. When SELinux is enabled, it prevents osTicket access. for example, SELinux should allow ...
-1
votes
2answers
25 views

SELinux is preventing $_POST variables on Amazon Linux 2

I began playing with RPM based OSes and I am really impressed. Amazon Linux doesn't include setroubleshoot in any of their repos. I want to use official repos for everything, otherwise I would ...
1
vote
1answer
51 views

In a custom module, is there a way to allow all permissions for files/directories?

I've written a custom selinux module that looks something like this: require { type my_app_t; type my_app_file_t; class file { getattr lock open read write execute execute_no_trans ioctl ...
4
votes
1answer
76 views

SELinux Interfering With sss_cache

System: HP Pavilion Power Laptop 15-cb0xx Intel i7-7700HQ w/ integrated graphics enabled (can't be turned off in bios) Fedora 28 NVIDIA GTX 1050 (mobile) I used the dnfdragora GUI to update about ...
1
vote
2answers
70 views

SELinux demands constant relabeling

I have installed SELinux on Ubuntu 18.04.1 LTS via # apt install selinux After the mandatory reboot, SELinux was constantly disabled until I added SELinux = 1 to /etc/default/grub and executed ...
0
votes
2answers
73 views

SELinux is preventing httpd from create access on the file

Whenever I upload a file via my web browser to my web sever, I see the following lines in /var/log/messages Nov 8 12:18:24 sn setroubleshoot: SELinux is preventing httpd from create access on the ...
0
votes
0answers
18 views

Why can't set my selinux status as enabled?

I had bought a vps ,installed centos7. rpm -qa | grep selinux libselinux-2.5-12.el7.x86_64 libselinux-utils-2.5-12.el7.x86_64 libselinux-python-2.5-12.el7.x86_64 No /etc/sysconfig/selinux and /etc/...
0
votes
0answers
30 views

autossh not reconnecting because of SELinux on Gentoo Hardened

I have a Gentoo system where autossh is used to establish a dynamic socks proxy. The system itself is behind a Tor transparent proxy. It gets DNS however through an ssh dynamic proxy to a Tor hidden ...
0
votes
1answer
56 views

How to run Java application in confined SELinux domain?

I am working with a Java app that has been labeled with its own SELinux type. Java executes it as unconfined_t instead of the labeled type. Java is labeled as bin_t (ls -Z /usr/lib/jvm/java-1.8.0-...
1
vote
0answers
27 views

Maintaining file's SELinux labels when copying them from one directory into another

Default behavior for copying files or sub-dirs from one directory to another is that the copied objects do not maintain their SELinux type (domain) which is opposite to objects which were moved. ...
1
vote
1answer
113 views

SELinux vs AppArmor applicability

I am going through some primers on LSM implementations so eventually I am digging a bit into AppArmor and SELinux. I am aware of this discussion but this does not make very clear one question I am ...
2
votes
1answer
59 views

Prevent Mount under Destination

I want to prevent all users (including root) from mounting anything under a specific destination (e.g. /tmp) by SELinux or any other Linux tool, is this possible? And how would it be done? Regarding ...
1
vote
1answer
35 views

How is SELinux loaded on boot?

I understand that a configuration file is in: /etc/selinux/config But how is it processed at boot? How does SELinux start, is it a daemon? Which startup script starts SELinux?
0
votes
1answer
76 views

How to extend SELinux policy to allow ntpd to use gps?

There is an attached device on the motherboard and the NTP service tries to read data from it (the attached device link is in /dev directory). Using SELinux enforcing, the service status errors that ...
2
votes
0answers
88 views

Yama LSM seems to do nothing. RHEL/Centos 7.5

The Yama security module is supposed to be able to prevent users from running the ptrace system call, yet even with kernel.yama.ptrace_scope set to 3, users can still run strace (which uses ptrace). ...
3
votes
1answer
62 views

Is it possible to prevent a change in SELinux status without a reboot?

I'd like to be able to prevent even a privileged user from changing the SELinux mode from enforcing to permissive without a reboot. It's too easy for a root user to run setenforce permissive, make ...
0
votes
1answer
122 views

CentOS Server file permissions

I am starting to learn server management with a CentOS Virtual Machine. I am trying to make a simple website. Because the Apache default file is in /var/www it is hard to write/make/change files. ...
1
vote
1answer
45 views

How to troubleshoot SELinux issues?

I suspect I have a problem in SELinux configuration: my issue goes away after disabling selinux using setenforce 0. I am using the default policy without any modifications. How can I pinpoint the ...
6
votes
1answer
107 views

What is the proper way to set SELinux context in an RPM .spec? (RHEL7 in 2018)

The RHEL7 supplied tomcat package supports multiple instances through the creation of directories and symlinks. Once such a multiple instance is created and packaged as an RPM, the extra instances ...
-4
votes
1answer
152 views

Temporarily disable SElinux [closed]

I want to temporarily disable SELinux on Centos 7. However, setenforce Permissive has no effect. # setenforce Permissive # sestatus SELinux status: enabled SELinuxfs mount: ...
0
votes
0answers
20 views

SElinux grant permission to ntp daemon [duplicate]

I updated the ntpd.conf file to read some data from a device in the /dev directory. Running NTP daemon I got the error: Sep 04 17:09:08 hardware ntpd[5742]: PARSE receiver #0: parse_start: open of /...
-1
votes
1answer
72 views

SELinux - workaround using audit2allow?

I read carefully tutorial and got to explanations on using audit2allow which allows access for denied process. audit2allow tutorial After reading about audit2allow it seems that this tool can always ...
1
vote
1answer
71 views

I want allow user to execute *only* ping utility using SELinux

I did it already with rbash (restricted bash) but now I want to use SELinux. So I created new user and add him to guest_u: semanage login -a -s guest_u restricteduser also I forbid him to execute ...
1
vote
0answers
72 views

Are these SELinux messages suggestive of intrusion?

In the CentOS7 GUI, I have been seeing a smattering of messages such as: SELinux is preventing /usr/bin/smbd from getattr on the file ___. The files are for instance: /etc/default/grub /etc/rc.d/...
1
vote
1answer
133 views

SELinux Doesn't Switch to “Enforcing” Mode

I have a minimal CentOS 7.5.1804 (Core) system and trying to change SELinux mode from Disabled to Enforcing but when I tried to change mode using setenforce 1 command, I got an error message says: ...
0
votes
1answer
182 views

How to add exception in SELinux?

When SELinux is disabled, I have no issues, but when it's Enforced then I'm facing this [systemd] failed to get d-bus session: Failed to connect to socket /run/dbus/system_bus_socket: Permission ...
2
votes
2answers
51 views

Cannot list contents of directory with 0755 and owned by current user

The platform is a rooted Android 8.1 phone (Magisk) with the Termux Android terminal emulator and Linux environment app installed. I use this as a server on the go. After connecting a USB smart card ...
1
vote
1answer
72 views

Are both mitigations required when audit2allow suggests both restorecon and one type enforcement rule?

SELinux is permissive mode to help avoid operational issues during a transition to a new RHEL7 server deployment. Whilst some SELinux issues are fairly easy to review and resolve with a modicum of ...
0
votes
1answer
166 views

ssh_selinux_change_context: setcon failed with Invalid argument

I am trying to do ssh communication to an IP but I get the following error messages in logs. Jun 5 11:36:50 thetemplate my-sshd[26346]: Accepted password for user1 from 172.80.1.2 port 34278 ssh2 ...
0
votes
0answers
420 views

Useradd/groupadd fails: failure while writing changes to /etc/passwd and /etc/group. Contexts problem

I have a virtual machine with Ubuntu 18.04 LTS, and I'm trying to enforce in with SELinux. I had to build and install a custom kernel out of current generic ver. for LTS with some extra flags. There ...
1
vote
1answer
176 views

How do I get Brother printer drivers to work on Fedora?

I have two Brother printers : a QL-1050 label printer (USB-plugged) and an MFC-9330CDW (wifi). Both work fine with an Ubuntu laptop, but I struggle to get them to print under Fedora 28 (actually had ...
3
votes
1answer
272 views

restorecon does nothing on CentOS 7

On CentOS 7.5, Linux 3.10.0-862.3.2.el7.x86_64, I'm trying to understand how file contexts work. ls -Z, chcon and semanage seem to work as expected, but restorecon seems stubbornly silent. For ...
3
votes
2answers
81 views

Send email on SELinux violation

On my desktop I get a GNOME notification when an SELinux violation has occurred which makes debugging simple but for servers I do not have this. Is there any way I can set up SELinux so when there is ...
0
votes
2answers
349 views

SELinux blocks tomcat web application to load Java native library (JNI) from /tmp folder

I have a Centos 7 with Tomcat installed and tomcat user ls -l /var/lib/tomcat total 0 drwxrwxrwx. 5 root tomcat 84 Jul 3 13:18 webapps SELinux is enforcing and a Java web application which tries ...
1
vote
0answers
43 views

How does one grant access to directories with SELinux's sandbox utility?

I'm trying to run Tor Browser Bundle within an SELinux sandbox. I tried to do the following, after looking at man sandbox: $ sandbox -X -H sehome -T tmp -I /run/user/1000/dbus-1/* \ -t ...
2
votes
2answers
107 views

prohibit unconfined SELinux user (root) to install policy to a system

I am trying to write a SELinux policy which after its installation will prohibit for a unconfined (or another, which can be chosen) user any subsequent SELinux policy installation. It seems that there ...
0
votes
1answer
418 views

SELinux policy for Pi-Hole

I am running Fedora Server 28 for ARM on my Raspberry and during the installation of Pi-Hole I got a warning message about SELinux being set to 'Enforced' and that because of it I cannot use Pi-Hole's ...
1
vote
2answers
237 views

SELinux - How to avoid it preventing a process from write access on newly created files into folder

I'm hardly trying to correctly use selinux keeping it in enforced mode, but very often I encounter issues with it causing our application to work improperly. Our web application is java backend and ...
0
votes
0answers
244 views

Unable to pull from any Docker registry when SELinux is enabled

Whenever I try to pull an image with Docker on my Fedora 28 system, the connections time out while waiting for headers. Disabling SELinux fixes the problem and images are successfully pulled from ...
3
votes
1answer
406 views

Create a SELinux policy for a custom systemd service

I'm using Fedora Workstation 27 Live OS in which I want to run a custom service EnableBIOS.service along with OS boot. For this to work, I have to disable SELinux which is causing a problem in my ...
2
votes
2answers
800 views

Postfix and Apache: Permission denied on CentOS 7

I am setting up a CentOS 7 Server with Apache2, MySQL, PHP and Postfix (for sending emails over PHP) My problem at the moment is that I get the following error (at the error_log from Apache): ...
0
votes
0answers
228 views

CentOS7 boot fails after repairing corrupted xfs and reinstalling grub-2

My CentOS7 VM crashed the other day and I am trying to restore it. I couldn't boot at all because of a corrupted xfs partition which I fixed with xfs_repair -v -L /dev/sda1. I then got Failed to ...
0
votes
0answers
384 views

/etc/selinux/config does not exist

I need to set SElinux as permissive but apparently that file does not exist! Or, I'm grossly mistaken. This is what my terminal shows: root@nox-09:~# cat /etc/selinux/config cat: /etc/selinux/...
1
vote
0answers
110 views

Changing MySQL Temporary File - Permissions Error

At the moment, MySQL Server is using /tmp as it's temporary directory, and I'd like to change that, because it's running into storage issues. Following this post: https://encylia.com/2015/02/06/how-...
0
votes
0answers
41 views

Home dir of ftp user in /var/www

I am trying to make a web server with Centos 7, I am trying to give access to a certain user in the /var/www dir via ftp making that dir his home directory. I use vsftpd; this is my config file: ...
1
vote
1answer
61 views

SELinux denied clamscan to delete uploaded file on nginx server

On my nginx server, the uploaded files context are set as: -rw-rw-r--. nginx nginx system_u:object_r:httpd_sys_rw_content_t:s0 eicar.sh.pdf Right after upload, clamscan runs to verify the file using ...
2
votes
0answers
37 views

SELinux file permissions history [duplicate]

How can I see the history of file labels - who and when set them? Right now SELinux reports that my /etc/resolv.conf with content # Generated by NetworkManager is mislabeled. It is now unlabeled_t ...
1
vote
1answer
177 views

Cannot stop SELinux from blocking Apache accessing /usr/local/nagios/var/rw/nagios.cmd

I have a Centos 7 server running Nagios Core 4.3.4 with Apache 2.4.6 in our UAT environment. I have a second server in PROD that was set up with the same Ansible playbook. Nagios was built from ...
1
vote
1answer
66 views

Permissions on a folder stopping Nginx from starting

I am fairly new to Linux. I have a couple of websites that I want to host on my CentOS 7 VPS with Nginx. Nginx ought to start on start up, but it is failing due to some permissions issue, I know what ...