Questions tagged [selinux]
SELinux (Security-Enhanced Linux) is an implementation of a flexible role-based, mandatory access control (MAC) architecture on Linux through kernel modifications and user-tools. It is primarily used to confine system processes and users beyond the basic Discretionary Access Controls (DAC) mechanism or access-control list found on *nix systems.
564
questions
0
votes
0
answers
12
views
/sys/fs/selinux/policy doesn't get loaded
I am working in an ecosystem wherein a main server running RHEL8.4 boots up first, and then for any accessory single CPU machine that boots up subsequently, a copy of the loaded OS is transferred at ...
- 133
0
votes
1
answer
22
views
SELinux doesn't let me allow ftpd
I'm in AlmaLinuxOS 9.
When I try to run setsebool -P ftpd_full_access on , it sends me a message saying boolean ftpd_full_access not defined.
I don't know how could I make it working nor what's wrong.
- 3
0
votes
0
answers
30
views
vsFTPd config error when using local_root=
What I am trying to achieve is the following, vsFTPd server which uses a different directory on a different mounted disk and jails each user to that directory while TLS/SSL is forced.
Currently I have ...
2
votes
1
answer
71
views
passwordless ssh (ssh-copy-id) not working, if the remote user's home folder is under /home2 instead of /home
I am setting up passwordless ssh from a client to a server.
I have two users, called user1 and user2. Both on the client and on the server, user1 has a home folder at /home/user1, i.e. the default ...
- 23
1
vote
1
answer
120
views
SSH not possible when using fish (installed through Nix) as shell
Using the nix package manager, I've installed fish for my login shell. I've added the shell to /etc/shells:
$ bat /etc/shells | grep --color=auto fish
/home/ajgringo619/.nix-profile/bin/fish
This ...
- 2,943
0
votes
0
answers
47
views
SELinux: block access to remote filesystems or external drives for unconfined_t
My current PC spec: Debian 11, default policy (via apt). How to restrict access to files in remote filesystems (nfs, cifs) or external drives on SELinux enforced system for unconfined_t processes?. ...
0
votes
1
answer
127
views
SELinux won't enable on AlmaLinux
I can't enable SELinux on a fresh image install of AlmaLinux 8.7.
After reboot:
[root@cs46949 stdusr]# cat /etc/redhat-release &&
> uptime &&
> dnf -y install policycoreutils ...
- 398
0
votes
1
answer
48
views
SELinux: Deny access to my custom type for unconfined_t processes
SELinux, debian 11, default policy (installed via apt). I created my own type for files. I want these files to be able to be accessed only by certain applications, but not by any other unconfined_t ...
0
votes
1
answer
51
views
vsftpd custom anonymous root folder
The default folder shared for the anonymous user by vsftpd is /var/ftp. This works fine. Now I want to share a different folder. I added this line to /etc/vsftpd/vsftpd.conf:
anon_root=/data/downloads/...
- 131
1
vote
1
answer
208
views
Host-wide consequences of setting SELinux z/Z option on container bind mounts
When running podman containers with volume mounts, it is often necessary to add the :z (or :Z) parameter to the mount path. It is due to SELinux and its type enforcement. What the parameter does is it ...
- 271
0
votes
0
answers
165
views
Running nodejs as systemd service -
I've tried running a nodejs server on RHEL by running a .js file with node and ran into the issue of being unable to bind to port 80, changing to a higher port fixed this, but I was unable to access ...
- 1
1
vote
1
answer
162
views
SELinux denies nginx to proxy on localhost
My current SELinux configuration does not allow nginx to connect at localhost:5000 (when doing a proxy pass). Here is the log from SELinux:
type=AVC
msg=audit(***********.*****): avc: denied { ...
- 131
0
votes
1
answer
57
views
How can I assign two contexts to a folder/file to give permissions to two processes (snapper and samba)?
I like to take snapshots of a Btrfs subvolume (mysubvol, using snapper) and share the .snapshots directory using samba. I can either assign the samba_share_t context to .snapshots and will then be ...
- 102
1
vote
1
answer
50
views
What is this strange SELinux attribute on several of my files?
I have run exa --long --extended on a folder containing some wallpapers and I noticed that it returns a strange security.selinux (len 37) tag on several of my files. I'd like to know what it is and ...
- 1,685
0
votes
1
answer
25
views
Setting file contexts on /proc files
I want to restrict access to files in /proc as much as possible using SELinux. When I try to chcon a directory in /proc, it fails:
$ chcon -t staff_proc_t /proc/acpi
chcon: failed to change context of ...
- 922
2
votes
0
answers
46
views
How to get the SELinux Type Enforcement (.te) file which contains all rules regarding certain type?
I would like to change permissions of certain directories(with user_home_t type) to further disallow guest_t to perform some actions on them.
I thought to do so by creating new type (protected_t) and ...
Marko Petrovic
0
votes
0
answers
71
views
lsof is frozen inside the container
I'm using Fedora 36 and running the container this way:
docker run --user 0 --rm \
--privileged \
--cap-add=SYS_PTRACE \
--volume=$(pwd)/.env:/legacy/app/.env \
--volume=$(pwd)/start....
- 679
0
votes
1
answer
427
views
How to prevent SElinux from blocking custom systemd service at boot?
SElinux is preventing a custom service of mine from getting picked up by systemd at boot.
MESSAGE=SELinux is preventing systemd from read access on the file custom.service
before rebooting
[root@box ...
- 1
0
votes
1
answer
386
views
Selinux php-fpm httpd and mariadb socket connection
New note with important details
I just ran a few version tests and resulted in the following:
Alright, here’s my latest update:
10.5 works
10.6 doesn’t
10.7 works
10.8 work
etc.
I was hoping to use ...
- 292
0
votes
2
answers
207
views
samba sharing nfs mounted folder and SELINUX
in RHEL 7.9, samba-4.10.16-19, nfs-utils-1.3.0,
server A and server B both have SELINUX as enforcing
from server A, the folder /data is NFS exported.
on server B, mount A:/data /data successfully ...
- 5,205
7
votes
1
answer
233
views
Firefox spamming SECCOMP events to journal/syslog - how to fix?
Since I updated to the snap-based Firefox on Ubuntu recently, I see it reporting SECCOMP_RET_TRAP messages to the journal whenever some application is drawing a canvas.
And since applications drawing ...
- 124
0
votes
0
answers
122
views
SELinux blocking port bind when command run via `sh -c '...'`
I am trying to start a systemd user unit. The unit is a podman container that attempts to bind a port.
If I run systemctl --user start my-service, the container starts fine.
If I run sh -c 'systemctl -...
0
votes
0
answers
219
views
SELnux errors in RHEL 8 : SELinux policy enabled , suEXEC mechanism enabled , No slotmem from mod_heartmonitor , OpenSSL/1.1.1k configured
Recently I installed SSL certificate for my linux rhel 8 server. Now, I am trying to load the application files it trows error
[pid 3176151:tid 139812477512000] SELinux policy enabled; httpd ...
- 1
0
votes
0
answers
70
views
restarting service remotely via snmp blocked by selinux/pam on Redhat8
I am having some trouble remotely starting/stopping/restarting a service through snmp.
It seems to work fine with SElinux set in permissive but with it in enforcing mode it will fail with this type of ...
- 1
2
votes
0
answers
831
views
What SELinux setting is preventing Samba from displaying and allowing me access to shares?
I have a very basic /etc/samba/smb.conf configuration:
[global]
workgroup = WORKGROUP
server string = Samba server (%v) on %h
security = user
passdb backend = tdbsam
[...
- 2,345
0
votes
1
answer
14
views
SELinux: Why do common utilities need to be compiled with custom flags
See: https://wiki.archlinux.org/title/SELinux#SELinux_aware_system_utilities
Why are they compiled with SELinux? If they aren't, what happens?
1
vote
1
answer
66
views
mdadm raid6 has all 6 drives working, but was marked as failed after selinux blocked access during a system update
So, during a recent dnf update on my system, apparently according to the system logs at some point selinux suddenly disallowed write access to the kernel and it then marked the raid drive as "...
- 81
1
vote
1
answer
240
views
SELinux is blocking VPN connections for non root users
I want (open)vpn connections to be available to all users, but if I'm not root are blocked by SELinux.
I looked In var/log/audit/audit.log first in no permisive mode:
type=AVC msg=audit(1659770552.275:...
- 183
3
votes
1
answer
137
views
File permissions not matching allowed operations...?
I have been having several issues with a CentOS 9 VM related to file permissions. I've never had this much trouble before, and I'm wondering if it has something to do with the security options and ...
- 266
0
votes
0
answers
199
views
samba 4.16 interactions with Selinux
I upgraded my server a couple weeks ago to Centos 8 and everything to current levels. This apparently included upgrading Samba to 4.16.2. Nothing seemed amis but I did notice big lags streaming data ...
- 21
0
votes
1
answer
70
views
Turn off SELinux without logging in?
So I have a CentOS VM and changed SELinux to enforcing (which was a mistake), and after rebooting I couldn't login at all (even with root - there was a login loop where I kept getting sent back to the ...
- 13
0
votes
1
answer
326
views
How to set selinux file permissions on specific files?
I have a couple of files that I copied from one device to another and it's causing problems because the file permissions need to be changed.
What I'm getting:
$ ls -laZ
...
drwxrwx--x 2 u0_a119 ...
- 747
0
votes
0
answers
86
views
Yocto SELinux on read only file system
I am trying to enforce SELinux on a read only file system, my current status is I can boot and get to login prompt (either serial or SSH) when i try to login if I have SELinux in "enforcing" ...
- 1
0
votes
0
answers
23
views
SELinux types for global object classes
I am new to SELinux and I understand the concepts that a certain process is running in a specific domain, and by the policy rules it can (or can't) act with a certain permission (or a whole set of ...
- 101
0
votes
0
answers
69
views
Can SELinux limit the scope of a binary which has capabilities set?
I would like to give my application (running unprivileged) a set of capabilities which allows it to:
chown/delete some files not owned by it
set quota for users
but limit the scope of its "...
- 75
0
votes
1
answer
46
views
Does this prevent leaks out of homedirs without SELinux?
I would like to prevent certain users from leaking info out of their home dir trees, even if they chmod their home dir. In other words, I have users alice and bob, and I want to prevent alice from ...
0
votes
1
answer
90
views
SELinux issue with FTP/Samba/Home directory
I am setting up my home camera to record to my NAS server (CentOS 8 Stream). I am using FTP for the transfer. I installed vsftpd and created a dedicated user (ftpuser). I want the files to be ...
0
votes
0
answers
240
views
Script on ssh login triggered by pam_exec.so gets blocked by SELinux
I am trying to execute a custom script on every ssh login. Following several manuals on the internet (and the manpage of pam_exec.so), I added the following line to /etc/pam.d/sshd:
session ...
- 1
0
votes
1
answer
27
views
My user (tom) has user_u , user_r and user_t via semanage but it still can perform sudo
My user (tom) is mapped to user_u user , user_r role and user_t domain via semanage
[tom@localhost ~]$ id -Z
user_u:user_r:user_t:s0
[tom@localhost ~]$
because I have made the "default" as ...
- 3
0
votes
0
answers
53
views
why can unconfined_u user not have sysadm_r role and sysadm_t type
The semanage on my instance looks like the following:
[root@localhost ~]# semanage login -l
Login Name SELinux User MLS/MCS Range Service
__default__ unconfined_u ...
- 3
0
votes
1
answer
34
views
For fedora, how do I get the original text based source file of selinux policy file, as well as plaintext versions of other files, like .te files?
I've been trying to find the original source files for the Fedora selinux policies.
The policy file is distributed as a binary file in the /etc/selinux/targeted/policy. Is there a way to get the ...
- 729
3
votes
1
answer
155
views
How to tell SELinux to allow a python script to do "everything"
I'm new to SELinux and it is giving me a headache. I have a python service that runs a python script on my home directory (my_script.py). I've been running the service, seeing what aspect of it ...
- 131
1
vote
1
answer
834
views
How to allow a custom application with SELinux?
I have a Go application that has a basic systemd service that runs with the user web. NGiNX talks to it via reverse proxy, and it talks to the MySQL database on the same server. NGiNX and MySQL ...
- 223
0
votes
1
answer
266
views
/var/log/httpd permissions reset from 705 to 700 after reboot
After a reboot /var/log/httpd permissions reset from 705 to 700.
Could this be a SELinux issue?
OS is RHEL 8.
- 1
1
vote
1
answer
263
views
What does system_u means when assigned to a file?
What my question is :
if there is a file assigned with system_u as SELinux that means only the user mapped to system_u/unconfined_u gets to access the file?
if this label is assigned to an executable ...
- 13
0
votes
0
answers
219
views
Ubuntu 20.04 doesn't boot after setting SELinux to enforcing
I'm trying to set SELinux to enforcing on Ubuntu 20.04, and the steps I did are as follow:
Install SELinux = sudo apt-get install policycoreutils selinux-utils selinux-basics -y
Activate SELinux = ...
- 1
2
votes
0
answers
133
views
What are the reasons for the default behavior of restorecon in SELinux?
At one point when learning the administration of SELinux, the restorecon(8) program gave me a good headache. No matter how I tried to change the permanent file contexts with semanage-fcontext(8) and ...
- 157
0
votes
1
answer
759
views
Mounting lvm after fstab entry is not creating SElinux labels in the new lvm
On RHEL8, I created an lvm with ext4 filesystem. Added it to /etc/fstab but when I use mount -av, I get the following error:
You just mounted an file system that supports labels which does not
...
- 416
1
vote
0
answers
111
views
Cant install Selinux policy
I am trying to install selinux on my librem14 pureos machine, every time I run sudo apt-get install selinux-policy-default
I get:
dpkg: error processing package selinux-policy-default (--configure):
...
- 11
1
vote
0
answers
113
views
SELinux: allow socat to run on unreserved_port_t
I'm working on an embedded distro with SELinux.
I am having this issue:
root@unknown7:~# socat openssl-listen:7777,reuseaddr, stdio
2022/02/03 13:44:44 socat[2331] E bind(5, {AF=2 0.0.0.0:7777}, 16): ...
- 363