Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible role-based, mandatory access control (MAC) architecture on Linux through kernel modifications and user-tools. It is primarily used to confine system processes and users beyond the basic Discretionary Access Controls (DAC) mechanism or access-control list found on *nix systems.

Filter by
Sorted by
Tagged with
0
votes
0answers
14 views

Why does a SELinux problem get reported in /var/log/messages?

I have found a SELinux problem with logrotate. I'm just wondering why it was reported in /var/log/messages, and not in /var/log/audit/audit.log. I assumed that any SELinux issue gets logged into audit....
0
votes
0answers
13 views

How is it possible that processes in root-group can't both read/write to file in same group?

I am encountering a strange security issue on a Linux machine. I have 2 files (a.sh and b) that are trying to read and write to another file (c). -rwxr-xr-x 1 root root *** Nov 1 2020 /...
0
votes
0answers
3 views

Setting Default Category for Files using SELinux MCS

I'm still a bit new to SELinux but I'm trying to use categories to enforce access to files. I notice that when I create a new file, it defaults to the context (role+level+category) of the parent ...
0
votes
1answer
9 views

Making Changes To A Live HTML File From OfficeLibre Writer On Same Server

I have discussed this issue briefly in ##linux freednode twice over the past few months. Once I got crucified; WHY WOULD YOU DO THIS!? and second conversation I wasn't pleased with the results of ...
1
vote
1answer
21 views

Increase limit of categories in SELinux

I'm using SELinux in RHEL and I see that there is a default maximum of 1024 categories. MCS in Red Hat Enterprise Linux supports 1024 different categories: c0 through to c1023. s0-s0:c0.c1023 is ...
1
vote
0answers
10 views

What is the meaning of the confidence level in sealert?

In the output of sealert, how one should evaluate plugin confidence levels? The highest value should mean the most recommended action. However, are they expressed in percent? How are they calculated? ...
2
votes
1answer
56 views

SELinux: My First Policies

I am at the point it's time to create my first policies. I have read the HowTo Security SELinux, watched the video SELinux for mere mortals and multiple other documents I have received from the ...
0
votes
1answer
17 views

security context changed in new filesystem

I have /opt filesytem and files with security context within: system_u:object_r:usr_t:s0 Now I have created another filesystem and mounted it to /opt/test and files/folders within it are created with ...
1
vote
1answer
11 views

How to make selinux give access to apache|nginx in centos 8

i recently install yii2 app and after all setup i realize that i keep getting permission error and after a lot of search i notice there's nothing wrong with my setup but the problem is with SElinux ...
0
votes
1answer
74 views

systemd service won't start because of unconfined_u context?

So I'm trying to start a service (let's call it the "kite agent" and it's a binary executable that runs as part of a tracing service) with systemd via ansible deployment on CentOS Linux ...
0
votes
1answer
22 views

File context policy update vs. usage race condition

I have an Ansible playbook where one task adds a SELinux file context and the following tasks is supposed to use that new context - i.e. fix the file context of a directory if necessary. When I run ...
0
votes
1answer
73 views

Unable to run CentOs properly on my computer

I am following this guide to install lamp: https://www.linode.com/docs/web-servers/lamp/how-to-install-a-lamp-stack-on-centos-7/#optional-test-and-troubleshoot-the-lamp-stack. I cannot run the ...
2
votes
1answer
137 views

Fail to start services because of selinux Permission Denied

Can't start few services because of strange selinux Permission Denied on fresh Fedora 32 installation. UNIT LOAD ACTIVE SUB DESCRIPTION ● fprintd.service ...
0
votes
0answers
14 views

Centos7 SELinux user context not received from FreeIPA

Hopefully there is something simple I am missing here. I have FreeIPA 4.6.6 (can not update at this time), Centos 7 and Centos 6 systems. SELinux is in permissive mode. Logins on the Centos 6 system ...
1
vote
0answers
29 views

Why does sepolicy generate a self:unix_stream_socket create_stream_socket_perms allow rule?

When I generate the SELinux policy module boilerplate like this # sepolicy generate --application /usr/bin/maildrop the auto-generated local policy section reads: allow maildrop_t self:capability { ...
3
votes
1answer
295 views

Why does Linux need SELinux

What is SELinux and what are the advantages of using it? Why does Linux need another layer of protection?
0
votes
0answers
47 views

How to fix this Error: HTTP ERROR 500 and chcon: can't apply partial context to unlabeled file for WordPress

I am trying to correct this piece of code but I have an error and the code doesn't executed. I would like to use a Public IP to run WordPress as well. The problem is that I can't run sudo chcon -t ...
0
votes
2answers
177 views

SELinux: how to grant read access?

I have this systemd service with the following PIDFile property : PIDFile=/home/john/.pm2/pm2.pid You might have expected the file to be located under the /run directory. Unfortunately, that's the ...
1
vote
0answers
18 views

semodule -i fails with semodule: link.c:840: alias_copy_callback: Assertion `base_type->primary == target_type->s.value' failed

semodule -i zabbix_agentd.pp fails with semodule: link.c:840: alias_copy_callback: Assertion `base_type->primary == target_type->s.value' failed. Aborted (core dumped) Oracle Linux Server ...
1
vote
0answers
28 views

SELinux preventing write access to files

I have written a PAM module. This PAM module is loaded by processes gdm-password and gnome-screensaver (found on RHEL 6.4). The pam module wants to write some logs to a db file under user's home ...
2
votes
1answer
123 views

ls -Z option yields “?” in output

I was reading the book "Linux Bible", chapter 24 to understand SELinux. In the book the author says that using $ ls -Z my_stuff in the command should display the DAC controls and RBAC ...
0
votes
1answer
29 views

List Only The Active SELinux Booleans

I just want to know how i can list only the active or [ on ] SELinux Booleans in CentOS 8.2 when i type semanage boolean -l it gives me all the available booleans and of course it's default state and ...
1
vote
1answer
47 views

Quick way to set SELinux context for many labels - CentOS 8

I am using one of those cloud VPS providers that provide most of their storage on the /data disk, so my webroot is at /data/www instead of /var/www. And there is a symlink so that Apache works fine ...
0
votes
1answer
42 views

semanage & restorecon -R are not applying recursively as I expect

My VPS cloud provider is one of those that provides most of the storage under a /data disk, so the webroot would actually be at /data/www instead of /var/www , and there is a symbolic link from /var/...
-1
votes
1answer
20 views

Modify OS Security Module Configuration on SELinux vs AppArmor

Just some pretext, I am fairly new to this and I'm still learning how SELinux works. I am trying to Modify OS security module configurations, but the instructions given to me were for Ubuntu and ...
3
votes
1answer
107 views

Are LSM tools such as AppArmor and SELinux considered IDS/IPS? [closed]

I know this is kind of an odd question. An IDS/IPS basically autonomously recognizes and optionally prevents intrusions. And while SELinux and AppArmor seem to be trying to do the same, they are never ...
0
votes
0answers
27 views

Network gows down after SSH Session Centos 8

I have a Centos 8.2(Minimal) running on dedicated server, I setup the ssh services and ports via KVM, everything where ok but when I tried to connect from a remote PC via ssh, the host was unreachable....
0
votes
1answer
57 views

“sudo ls -a1 /home” Permission Denied

I have a php script that will run exec("bash /path/to/list.sh $dir", $out); The contents of list.sh are... #!/bin/bash sudo /usr/bin/ls -a1 $@ 2>&1 I have given apache permission to run ls ...
2
votes
1answer
72 views

What are recommended conventions for proper custom systemd service?

I have a binary that does not have any built-in commands to restart or shutdown the process it creates. After looking at some built-in CentOS services I came to conclusion I cant use them as a ...
0
votes
1answer
330 views

Unable to install Zabbix server

I just installed Zabbix-5.0 LTS on RHEL-8 OS. After logging in on the Zabbix fronend, I get message that "Zabbix server is not running:the information displayed may not be correct". Kindly help me ...
1
vote
0answers
53 views

Is it possible to use systemd on Gentoo with hardened/selinux profile?

Or I need to create custom profile which will combine settings from hardened/selinux and systemd profiles? Because I even can't unmask sys-apps/systemd or set USE-flag systemd on some package.
0
votes
1answer
27 views

Way to do a recursive chown avoiding any SELinux violation

in script a.sh: chown -R root:group parent-folder/ chown -R root:group parent-folder/* The script runs as root user. When chown gets executed it show below SELinux violations: chown : type=...
1
vote
0answers
46 views

Hundreds of CONFIG_CHANGE Messages in audit log

I'm using CentOS Linux release 7.8.2003 with SELinux in Enforcing mode. In my /var/log/audit directory, I'm seeing audit.log files with hundreds and hundreds of messages like this: type=...
0
votes
0answers
70 views

SELinux sandbox on debian buster

I have installed and enabled SELinux on Debian 10 (Buster). Running sandbox however returns: /usr/bin/sandbox: Sandbox Policy is not currently installed. You need to install the selinux-policy-...
0
votes
0answers
53 views

Why am i getting permission denied from selinux when running a script as a service?

when i ran the script myself it ran fine but when running as a service i get errors. As far as i can understand rsync is running in rsync_t domain and hence denied to write to user_home_dir_t. Please ...
0
votes
0answers
13 views

The contexts match but I dont understand why selinux is giving this error

I am getting the following error. type=AVC msg=audit(1588861923.865:686): avc: denied { execute } for pid=3669 comm="(realview)" name="realview" dev="dm-0" ino=18430955 scontext=system_u:system_r:...
0
votes
2answers
152 views

how to apply samba_share_t to everything under a folder

I mounted my 5tb worth of /data to my new linux RHEL 7.7 server. I have selinux as enforcing; I have /data samba shared out and it is mostly working. But when I go a few folders deep into /data/ I ...
0
votes
1answer
132 views

selinux samba samba_share_t and chcon vs semanage fcontext

Can I get clarification on how to properly set up samba folder shares on a RHEL/CENTOS 7 linux server having selinux enforcing. SELinux requires files to have an extended attribute to define the file ...
0
votes
0answers
12 views

SELinux vs. Boolen

Is it possible that SELinux is only reporting errors regarding context related issues in the avc.log (no audit daemon running) or audit.log (audit daemon running) log files? I was looking at an ...
0
votes
0answers
86 views

How to enable SELinux policy module permanently?

I have an RHEL 8.1 system that I use for development, and the system comes with SELinux in enforcing mode by default. On that system I write and run Python scripts with Visual Studio Code, and for ...
0
votes
0answers
31 views

SELinux: Preventing Command Execution from Webserver

I realize this may be a strange request but I am doing testing to see what selinux can do to secure web applications and I can't seem to disable command injection. I have looked through the httpd ...
1
vote
1answer
50 views

How to enable Nginx binding to UDP port 10000 with SELinux

Not sure if ServerFault is a better place for this question? I'm building a new application which needs Nginx to bind to UDP port 10000. If this were a TCP port for HTTP/S then I'd just add it to the ...
0
votes
1answer
309 views

SELinux is blocking gunicorn

I am wrote a systemd unit to start gunicorn but it unfortunately kept failing, upon checking journalctl I found the following error. SELinux is preventing /usr/lib/systemd/systemd from execute access ...
0
votes
0answers
20 views

Turning on selinux causes HDMI to not work. How to resolve?

In my ubuntu setup, i've turned on selinux. However that causes the HDMI port to not work? I assume there's a policy in there that stops this, but setting selinux to permissive, the machine still ...
2
votes
0answers
71 views

How to edit a binary SeLinux policy file?

It appears root access is irrelevant on my device as everything is managed by SeLinux (the root user basically can’t execute anything). The problem is I can’t just create my new polices. I need to ...
0
votes
0answers
8 views

How to add new rules to dontaudit

How to add new rules to dontaudit. How do I check on the Internet to show that I have not joined?
0
votes
0answers
24 views

Questions about audit and selinux

Recently wanted to keep log on auditd via logrotate But seliunx keeps blocking It is also invalid to follow the action recommended by selinux The action is as follows ausearch -c 'logrotate' --raw | ...
1
vote
1answer
127 views

Do I need to create a custom file context type for /etc/zabbix/ if I don't want to use unlabeled_t?

I have installed zabbix (a monitoring application) on a CentOS 7 machine. For security purposes, I want to leave selinux in enforced mode. Therefore I have to grant my zabbix a few permissions in ...
0
votes
2answers
700 views

How to recursively remove all SELinux contexts?

I am trying to make my production environment equivalent to my staging environment. On production, SELinux contexts were applied. If I list the files in a directory, I see the dot at the end of the ...
0
votes
0answers
43 views

How to write SEPolicy policy for MLS/MCS related types?

Can any one explain how to write sepolcies for MLS/MCS Multilevel security related allow rules. For MLS/MCS related denials, if we add policies in respective .te files also it is throwing denials ...

1
2 3 4 5
10