Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible role-based, mandatory access control (MAC) architecture on Linux through kernel modifications and user-tools. It is primarily used to confine system processes and users beyond the basic Discretionary Access Controls (DAC) mechanism or access-control list found on *nix systems.

Filter by
Sorted by
Tagged with
0 votes
1 answer
27 views

Who is setting SELinux context in default configuation

I see the SELinux context set for almost all the files in the root file system. This is our customized Linux image built from kernel 4.19 with userland packages including systemd service to manage ...
pitnal's user avatar
  • 101
0 votes
0 answers
55 views

Who sets the dot permission in ls -l output at build time in linux?

We have a custom build of Linux and user-land applications which contains libselinux, attr, OpenSSH, systemd, docker-ce and few more applications. We have a rpm based build system similar to fedora. ...
Prajval Badiger's user avatar
0 votes
0 answers
22 views

User not changing SElinux context (SELinux User)

I've added multiple users to SELinux user contexts: # semanage login -l Login Name SELinux User MLS/MCS Range Service __default__ unconfined_u s0-s0:c0....
user1098490's user avatar
2 votes
1 answer
61 views

SELinux does not log denial

SELinux does not allow auditd to start the process (named myplagin) and does not log the reason in the /var/log/audit/audit.log. The only mention of the denial I found in the /var/log/messages: ...
ibse's user avatar
  • 295
0 votes
1 answer
34 views

Why does NetworkManager ignore config files when SELinux is enabled?

I'm trying to set up a system based on AlmaLinux 9.2, to use SELinux and NetworkManager, with a read-only rootfs. For various reasons, I want to keep my 'keyfiles' on a separate partition. I have ...
Popup's user avatar
  • 516
0 votes
0 answers
10 views

Does SELinux file relabelling start anew if it is interrupted during boot phase?

SELinux relabelling can continue very long during boot phase. What happens when this process is interrupted by yet another boot? Does SELinux start relabelling from the beginning if it could not ...
Thomas's user avatar
  • 13
0 votes
0 answers
42 views

SElinux denies to access file in /proc

My audit plugin process needs to be able to iterate through /proc and read /proc/pid/stat files, but SElinux refuses this. Process context of my plugin: ps auxZ | grep -i myplugin system_u:system_r:...
ibse's user avatar
  • 295
-1 votes
1 answer
83 views

My machine always connect to some strange foreign IP addresses

My machine installed Centos 6.4 without any special online services. Recently, my machine caused congestion on LAN. I'm a newbie to Linux, so I'm very confused. I do not know what happened. Also maybe ...
nghia nguyen's user avatar
0 votes
0 answers
137 views

Configure SELinux to allow qemu/virt-manager and samba to both read/write to the same folder?

Problem summary I have a local folder that is shared under samba but if I try to allow qemu (via user session) to access it via virtio-9p, I get an error (SELinux avc). Works fine with SELinux ...
zpangwin's user avatar
  • 741
1 vote
1 answer
64 views

SELINUX policy not applying

I have a Fedora Server v39 (minimal install) running as a VM (host is also Fedora Server v39). I have shared a host directory with the VM using virtiofs and mapped it to /etc/wireguard in the VM. drwx-...
Christian's user avatar
  • 2,195
1 vote
1 answer
88 views

Wireguard cant read wg0.conf on share

I have a virtual fedora server running using libvirt and have shared a directory from the host using virtiofs. hostshare /etc/wireguard virtiofs rw,relatime 0 0 The dir in the guest is mapped to /etc/...
Christian's user avatar
  • 2,195
2 votes
1 answer
51 views

pam_exec cannot call systemctl due to SELinux

I'm trying to execute a script every time an SSH session starts and ends, on CentOS 7. This script should start/stop a systemd service. This is my setup: In /etc/pam.d/sshd, I added the following ...
flyx's user avatar
  • 131
1 vote
0 answers
81 views

How can I get away from "mount point busy" after using semanage?

I'm trying to label a port for SELinux (RHEL 8.8) using semanage: semanage port -a -t mylabel_port_t -p tcp 2345 This seems to work fine. But after running this command, it is impossible to remount ...
LisaHH's user avatar
  • 11
0 votes
0 answers
82 views

restorecon fails with permission denied on ~user .ssh

I discovered this when trying to do an ssh-copy-id. I was getting the error 'restorecon: could not set context for /home/rit/.ssh'. The premissions look correct. [rit@host ~]$ ls -ld .ssh drwx------. ...
Jeff Gaer's user avatar
  • 101
0 votes
2 answers
328 views

podman fails with 'Error relocating' / 'RELRO protection failed'; ~/.local/share/containers a link to a different location

Trying to run any pods on Podman fails, after an SELinux relabeling $ podman run -ti alpine Error relocating /lib/ld-musl-x86_64.so.1: RELRO protection failed: No error information Error relocating /...
caxcaxcoatl's user avatar
1 vote
1 answer
156 views

how can i make a dbus connection from a sandbox to pipewire

How can i create a DBUS connection to PipeWire (to communicate with the sound daemon) from a SElinux sandbox?
ministry's user avatar
1 vote
0 answers
124 views

selinux user_u staff_u .bash_profile permission denied on ssh login

A security rule states RHEL must prevent non-privileged users from executing privileged functions, including disabling, circumventing, or altering implemented security safeguards/countermeasures. All ...
ron's user avatar
  • 6,515
1 vote
0 answers
162 views

SELinux policy for Android emulator

The Google Android emulator requires execheap permissions, otherwise it segfaults when SElinux is in enforcing mode. For those who are not familiar with the Android emulator: It uses a forked version ...
a.ilchinger's user avatar
0 votes
0 answers
39 views

selinux and systemctl start versus service start

From https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/getting-started-with-selinux_using-selinux 1.4. SELinux architecture and packages Important: To avoid ...
ron's user avatar
  • 6,515
1 vote
0 answers
419 views

How can I assume user 1000 inside of a docker container on linux?

I am trying to use AFL++ to fuzz a target application on Fedora 36. I followed the instructions listed on this page by pulling down and running the AFL++ container and building it, and then creating ...
the_endian's user avatar
0 votes
1 answer
180 views

After a problematic software update OS boots only with SELinux disabled

I have Fedora 38. The last software update messed up my system. It became unbootable. The reason probably was in having duplicate packages. I managed to fix dnf check errors by dnf remove --duplicates ...
RCKT's user avatar
  • 11
0 votes
0 answers
130 views

How to use tmpfs in MariaDB when SELinux is enforced?

Running AlmaLinux 9.2 and MariaDB 10.11. Trying to use in my.cnf: tmpdir = /dev/shm This works fine when PHP-FPM is connecting using TCP port. Now trying to use faster Socket (/var/lib/mysql/mysql....
Ivan's user avatar
  • 1
0 votes
1 answer
190 views

How can I get SELinux to allow runc to transition to container_t?

I am referencing this page and following these simple instructions on Fedora 36: docker pull aflplusplus/aflplusplus: docker run -ti -v /location/of/your/target:/src aflplusplus/aflplusplus However, ...
the_endian's user avatar
0 votes
0 answers
80 views

What is /dev/selinux?

Is there a device node called /dev/selinux Android 13 init crashes with the following [ 1.417333] (7)[1:init]selinux: SELinux: Loaded file_contexts [ 1.417341] (7)[1:init]selinux: [ 1....
Bret Joseph's user avatar
0 votes
1 answer
2k views

selinux context for ExecStart of custom systemd service

I have a Type=simple /etc/systemd/system/custom.service. It has ExecStart=/root/scripts/custom.sh. I use this to make various administration things happen automatically after boot. It has worked well ...
ron's user avatar
  • 6,515
2 votes
0 answers
482 views

selinux allowing custom systemd service

in RHEL 8.8, I have a custom /etc/systemd/system/custom.service. [Unit] Description=custom [Service] Type=simple ExecStart=/root/scripts/custom.sh [Install] WantedBy=default.target my /root/scripts/...
ron's user avatar
  • 6,515
1 vote
1 answer
307 views

Where is the mapping between SElinux source and target contexts

I am learning about SELinux and have a question: There doesn't appear to be a direct correlation between the fields of the source and the target. For example Apache may run with Type httpd_t and the ...
Johan's user avatar
  • 4,148
1 vote
0 answers
119 views

SELinux sandboxed firefox has no audio

Running firefox in a SELinux sandbox using this script: Random variables for directories, Allowing multiple instances SEhome=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 8 | head -n 1) SEtemp=$(...
ministry's user avatar
1 vote
0 answers
672 views

Systemd service fails to run firewall-cmd

I recently set up wireguard on my Fedora-38 machine and started it using systemctl start wg-quick@wg0 which worked perfectly fine until now. When I start the service I see the following error message: ...
minils's user avatar
  • 163
0 votes
0 answers
159 views

Selinux sshd mismatch boolean settings vs permanent ones

I got my centreon using sshd to connect to my servers with one user which don't have password set. After one : sealert -a /var/log/audit/audit.log I apply : ausearch -c "sshd" --raw | ...
Peutre's user avatar
  • 77
0 votes
1 answer
25 views

Locked out of ssh with TFA from selinux

I have a debian bullseye headless home server. I recently found out about, and installed, selinux. I have been reading multiple wiki and tutorials to learn how it works and how to configure it. I have ...
Èl Sea's user avatar
  • 43
0 votes
0 answers
148 views

User can't sudo even if mapped to staff_u

I created a new user yv8904_local that i mapped to staff_u in SElinux. I want the user to ssh and be allowed to sudo. I'm able to ssh with the user but i can't sudo, i'm getting this error : > sudo:...
Mooh's user avatar
  • 101
0 votes
0 answers
366 views

configure SELinux for Wordpress on Apache, Almalinux

I have an issue with SELinux that when enforcing (enabled) causes Wordpress on Apache to throw errors in the header like: Warning: An unexpected error occurred. Something may be wrong with WordPress....
TexasTim's user avatar
1 vote
0 answers
53 views

How would you assign read-only permissions to run ls -l /proc/{pid}/fd for processes you don't own using SELinux in Android

I am developing an application on Android as a non-root user.  However, I need read access to all the /proc/{pid}/fd files so as to check the inode numbers from the symlink under fd. How do I do that ...
Mahavir Surana's user avatar
0 votes
0 answers
54 views

SELINUX add process_type access to file_type

nslcd.service cannot start because SELINUX is enabled. It doesn't allow nslcd to access /etc/openldap/certs/*. The permissions on the files in that directory are: -r--r--r--. 1 root root system_u:...
John Miller's user avatar
0 votes
0 answers
196 views

RHEL 9.1 - SELinux is preventing /usr/local/bin/php from read access on the file /web/inc/init_db.inc.php

i want to solve this problem what SELinux says. SELinux is preventing /usr/local/bin/php from read access on the file /web/inc/init_db.inc.php. output from console is: [root@rhel ~]# ausearch -c 'php'...
ArchMatt's user avatar
0 votes
0 answers
221 views

How to transfer selinux file context respectively to the full copy?

I have an image with files marked with their SELinux context: system_u:object_r:net_conf_t:s0 for example. I also have a second image with the same files, but without the preserved context (the ...
caiiiok254's user avatar
0 votes
0 answers
116 views

/sys/fs/selinux/policy doesn't get loaded

I am working in an ecosystem wherein a main server running RHEL8.4 boots up first, and then for any accessory single CPU machine that boots up subsequently, a copy of the loaded OS is transferred at ...
Vinod's user avatar
  • 155
0 votes
1 answer
144 views

SELinux doesn't let me allow ftpd

I'm in AlmaLinuxOS 9. When I try to run setsebool -P ftpd_full_access on , it sends me a message saying boolean ftpd_full_access not defined. I don't know how could I make it working nor what's wrong.
stackpws's user avatar
0 votes
0 answers
130 views

vsFTPd config error when using local_root=

What I am trying to achieve is the following, vsFTPd server which uses a different directory on a different mounted disk and jails each user to that directory while TLS/SSL is forced. Currently I have ...
Rettercon's user avatar
3 votes
1 answer
321 views

passwordless ssh (ssh-copy-id) not working, if the remote user's home folder is under /home2 instead of /home

I am setting up passwordless ssh from a client to a server. I have two users, called user1 and user2. Both on the client and on the server, user1 has a home folder at /home/user1, i.e. the default ...
Swatow's user avatar
  • 33
0 votes
1 answer
243 views

SSH not possible when using fish (installed through Nix) as shell

Using the nix package manager, I've installed fish for my login shell. I've added the shell to /etc/shells: $ bat /etc/shells | grep --color=auto fish /home/ajgringo619/.nix-profile/bin/fish This ...
ajgringo619's user avatar
  • 3,236
0 votes
1 answer
466 views

SELinux won't enable on AlmaLinux

I can't enable SELinux on a fresh image install of AlmaLinux 8.7. After reboot: [root@cs46949 stdusr]# cat /etc/redhat-release && > uptime && > dnf -y install policycoreutils ...
jamacoe's user avatar
  • 408
1 vote
1 answer
295 views

SELinux: Deny access to my custom type for unconfined_t processes

SELinux, debian 11, default policy (installed via apt). I created my own type for files. I want these files to be able to be accessed only by certain applications, but not by any other unconfined_t ...
German Titov's user avatar
0 votes
1 answer
93 views

vsftpd custom anonymous root folder

The default folder shared for the anonymous user by vsftpd is /var/ftp. This works fine. Now I want to share a different folder. I added this line to /etc/vsftpd/vsftpd.conf: anon_root=/data/downloads/...
user1785730's user avatar
1 vote
1 answer
1k views

Host-wide consequences of setting SELinux z/Z option on container bind mounts

When running podman containers with volume mounts, it is often necessary to add the :z (or :Z) parameter to the mount path. It is due to SELinux and its type enforcement. What the parameter does is it ...
mnj's user avatar
  • 291
0 votes
0 answers
539 views

Running nodejs as systemd service -

I've tried running a nodejs server on RHEL by running a .js file with node and ran into the issue of being unable to bind to port 80, changing to a higher port fixed this, but I was unable to access ...
grass's user avatar
  • 1
1 vote
1 answer
1k views

SELinux denies nginx to proxy on localhost

My current SELinux configuration does not allow nginx to connect at localhost:5000 (when doing a proxy pass). Here is the log from SELinux: type=AVC msg=audit(***********.*****): avc: denied { ...
uben's user avatar
  • 131
0 votes
1 answer
101 views

How can I assign two contexts to a folder/file to give permissions to two processes (snapper and samba)?

I like to take snapshots of a Btrfs subvolume (mysubvol, using snapper) and share the .snapshots directory using samba. I can either assign the samba_share_t context to .snapshots and will then be ...
dani's user avatar
  • 102
1 vote
1 answer
363 views

What is this strange SELinux attribute on several of my files?

I have run exa --long --extended on a folder containing some wallpapers and I noticed that it returns a strange security.selinux (len 37) tag on several of my files. I'd like to know what it is and ...
telometto's user avatar
  • 1,950

1
2 3 4 5
12