Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

Filter by
Sorted by
Tagged with
1
vote
0answers
38 views

Fedora 30 : Ensure No Device Files are Unlabeled by SELinux

While hardening Fedora 30, I encountered this measure on open-scap.org and actually the command : sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n" returns on my system ...
0
votes
2answers
22 views

selinux prevents pam_exec command from being executed

I am trying to setup my computer to notify me every time a user logs in (via ssh, via gdm or tty). Right now I am setting up sshd and I added this to /etc/pam.d/sshd: session optional pam_exec.so /...
3
votes
2answers
100 views

/etc/pam.d/ rules for ssh and login

In /etc/pam.d/, the configuration files for sshd and login have some rules for selinux. Can I simply disable those lines, when I am not using selinux ? I would like to simplify the pam rules. ...
0
votes
0answers
17 views

Restrict directory access to single process using apparmour

I'm going to create program creating directory and granting privileges to this directory to program request of creating this directory. Each directory, created by my program, will be putted in one ...
0
votes
1answer
56 views

Bash rm /proc/sys/net/ipv4/icmp_echo_ignore_all: Permission denied

I have created this file /proc/sys/net/ipv4/icmp_echo_ignore_all couple of months ago on my centos 7 server to disable ping requests permanently and now I can not undo this! I'm logged in as root ...
0
votes
1answer
19 views

Selinux and Docker file creation context

I'm working on a container that I want to add a static mount of -v /home/_username:/home/_username but I want to avoid using the z or Z mount options. I've been able to use audit2allow to create a ...
2
votes
1answer
15 views

Get SELinux permisison list associated with socket base

This shows the permissions associated with the tcp_socket class: > seinfo -c tcp_socket -x Classes: 1 class tcp_socket inherits socket { connectto name_connect ...
2
votes
1answer
124 views

How to set SELinux in permissive mode without reboot?

I am on Fedora 29 and SELinux is currently disabled. I am trying to put into permissive mode using setenforce permissive, but always get setenforce: SELinux is disabled this output and then status ...
1
vote
0answers
54 views

selinux preventing init_t access to httpd_sys_content_t

I have a systemd service file that runs a script. It is getting blocked by selinux: type=AVC msg=audit(1570329687.437:218): avc: denied { execute } for pid=1079 comm="(index.sh)" name="make_index....
0
votes
1answer
25 views

SElinux package removes grub-efi

ON my linux mint 19.2 machine, I am trying to set up Selinux. But when i install selinux package, it removes grub-efi. When I try to reinstall grub-efi, it removes selinux Does this mean selinux is ...
0
votes
1answer
86 views

Allow SCP in RHEL CentOS 7 selinux

running rhel 7.6 (or centos 7.6) With selinux = enforcing doing an ssh in to or out of the system works, but doing a scp to the RHEL selinux system does not work. On the RHEL system if I do ...
0
votes
1answer
49 views

What does “permissive” statement mean in SELinux policy type enforcement (.te) file?

I'm defining a new type mynewtype_t. There is a line which was automatically generated with the permissive keyword. $ sepolicy generate --init /bin/sh Failed to retrieve rpm info for selinux-policy ...
0
votes
0answers
21 views

How to setup an SELinux policy to allow only a specific context permission to 'execheap'

I want to enable the dynamic core in DOSBox but this is incompatible with SELinux as unconfined_t by default is not allowed to execute from the heap. The SELinux troubleshooter suggests: You must ...
0
votes
1answer
33 views

GoogleAuthenticator PAM Module Permissions Issue — VPN with MFA in AWS EC2 running CentOS

Full Disclosure: I am writing this question to then answer it myself. I searched the internet for a full day at work and was not able to find a solution that worked for me. I even compiled my own ...
1
vote
1answer
19 views

Docker without SELinux makes ERR_NETWORK_CHANGED errors in Chromium

I had errors from SELinux when using files inside docker, so I've edited the file /etc/sysconfig/docker to disable SELinux for docker, after restart I was keep gettings errors ERR_NETWORK_CHANGED ...
0
votes
0answers
48 views

How to prevent SELinux errors from inside docker conainers

I've run docker container like this: mkdir ~/tmp docker run -ti --rm --name test -v /home/kuba/tmp:/root/tmp ubuntu:14.04 bash and after writing /root/tmp/file.txt file (inside docker container) I'...
2
votes
0answers
22 views

semodule fails to install module

I run Fedora Atomic host 29, with SELinux enforced. The box is a few week old and run smoothly, until recently when it comes to SELinux. Trying to solve some errors with this command: # cat /var/log/...
3
votes
1answer
211 views

rsync daemon with enforcing selinux policy rsync_export_all_ro still prevents access to files under /var/spool/postfix/private/

I have a number of Debian-based systems that get backed up regularly using rsync. For a number of reasons I have had to deploy a small CentOS 7 server, and I want to add it to my backup schedule. It ...
2
votes
2answers
66 views

SELinux security context of parent directories

I'm using a RHEL machine with SELinux enabled. I'd like to change the logfile position of auditd to /mydir/log/audit.log. I can apply the security context system_u:object_r:auditd_log_t:s0 to this ...
0
votes
0answers
20 views

Should every SELinux denial event result in an accompanying AVC?

On a currently running system that heavily is using docker containers, I noticed that running the daemon with selinux-enforcing:true, I obtained an (previously unseen) error message in my audit log. ...
1
vote
1answer
50 views

Why does SELinux (with Enforcing=1) allow binding to low (or any) ports, by default?

I assume that Selinux defaults, based on the documentation, mandate that basically all port operations would be blocked and logged as AVCs. I have an SELinux enforcing enabled VM, created with ...
1
vote
0answers
39 views

How to run single application in permissive mode and remaing all in enforcement mode for SEAndroid?

I want to allow single application to run in permissive and keep enforcing mode for all other applications in SEAndroid. How to do this?
0
votes
0answers
343 views

Permission denied for imjournal: rename()

after disabling and enabling SELinux the Apache and MySQL cannot start, this error shows in messages.log: imjournal: rename() failed for new path: '/var/lib/rsyslog/imjournal.state': Permission ...
0
votes
1answer
67 views

SElinux configuration of symlinked /etc/my.cnf -> /app/program/my.cnf

Please advise me of whether it is possible to configure SElinux context in a way that MariaDB would pick it up. current configuration: ls -lZ /etc/my.cnf lrwxrwxrwx. root root system_u:object_r:...
1
vote
1answer
134 views

How to disable dontaudit denials in SEAndroid

My application is working in permissive mode, but not in Enforcing mode for SEAndroid. Here i cleared (allowed) all denials,so now there is no denial logs coming in my logcat logs.So it might be ...
-1
votes
1answer
419 views

Rsyslog in not logging due to Selinux, is my workaround ok

I have these two parameters in /etc/rsyslog.conf $ModLoad imjournal # provides access to the systemd journal ... # Turn off message reception via local log socket; # local messages are retrieved ...
1
vote
1answer
672 views

sshd[5589]: error: PAM: pam_open_session(): Cannot make/remove an entry for the specified session

I am working with a CentOS7 minimal install. I configured pam_radius with pam_script and was always able to ssh to the server using pubkey auth: that was on purpose. But after hardening the server ...
2
votes
1answer
117 views

Selinux causing sshd to fail when using AuthorizedKeysCommand

I have been following Gitlab's guide to enable Fast lookup of authorized SSH keys. Guide instructs to use AuthorizedKeysCommand. Authorized command is calling local https server. This command chain ...
4
votes
1answer
124 views

SELinux: running a custom shell binary from /etc/passwd

----- Problem -------- I have CentOS 7.6 running on my system. I want to invoke a custom shell instead of standard shell in the /etc/passwd file. I have SELinux enabled, and for some reason sshd_t ...
2
votes
0answers
21 views

selinux restorecon on systems without selinux like ubuntu [duplicate]

recently i had to change two files on a fedora raw image mounted via loopback on ubuntu, which usually runs in a kvm on the ubuntu host. That made a lot of troubles with selinux after booting from the ...
4
votes
4answers
239 views

Why do selinux policies apply to commands (e.g: logrotate) running from cronjobs, but not when run directly from command line?

Why do selinux policies apply to commands (e.g: logrotate) running from cronjobs, but not when run directly from command line? When I run logrotate manually from the command line, it works perfectly. ...
0
votes
1answer
51 views

SELinuxs policy.conf configuration

I'm trying to configure SELinux on my home pc. During installation /etc/selinux/policy file had not been created thus I was not able to configure custom policy with checkpolicy. So I've copied it from ...
3
votes
1answer
2k views

How to get mount information of host inside a docker container

I need the mountpoints of all disks attached to a host inside a docker container. The mount information is available in /proc/1/mounts file, but I cannot access that file on all OS. When I run the ...
0
votes
2answers
457 views

Website cannot write to files or create directories

I've been trying to install TeemIP for about 6+ months now and I've never been able to figure out this issue on Centos7. The error I get is the following: The directory '/var/www/teemip/public_html/...
3
votes
1answer
55 views

Is there a way to specify file name using wildcards in selinux type_transition rules?

This kind of rules works perfect if filename matches exactly one specified at the end of rule, but not with wildcards. The star in the example below does not work. Well, actually it does, but it is ...
1
vote
3answers
1k views

setroubleshootd excessive cpu and memory usage

I have Centos 7 fresh install and I see setroubleshootd with high CPU usage. How can I fix this? What is this process doing?
2
votes
1answer
77 views

How to create a SELinux policy module with existing output from audit2allow?

I know the standard way of creating a SELinux policy module, like cat <auditlog_file> | audit2allow -M <module_name> However, is there a way to create a policy module if all I have is ...
2
votes
1answer
354 views

How to troubleshoot Nginx permission denied in subdirectory?

I'm working on Fedora 29 Server. SELinux is in Enforcing mode. I'm having trouble getting Nginx to serve documents from a subdirectory below root. I need to know how to troubleshot it further because ...
0
votes
0answers
375 views

Unable to restart Polkit service in Centos 7

I am unable to start nscd.service on centos 7 the error is polkit service is not running. Below is error. ** (pkttyagent:27796): WARNING **: Unable to register authentication agent: GDBus.Error:org....
0
votes
1answer
887 views

Ansible modules copy/template errors for Linux 5 hosts using python26 ,python binding libselinux-python needed

We have some 50 odd linux 5 hosts, and to manage that we use ansible. Problem :- Ansible modules copy/template errors for Linux 5 hosts using python26 ,python binding libselinux-python needed ...
0
votes
0answers
117 views

After I enable SELinux, some devices node are unable to be accessed

I enable SELinux feature by configuring kernel (below shows what I changed): @@ -44,7 +44,10 @@ CONFIG_SYSVIPC=y CONFIG_SYSVIPC_SYSCTL=y # CONFIG_POSIX_MQUEUE is not set # CONFIG_FHANDLE is not ...
2
votes
1answer
34 views

How can I allow a given application to access a given folder and its content

I recently installed a game through Steam, but some of the assets of the game aren't loaded. After a few investigations on the web, the Windows users who had the same problem were adviced to turn off ...
0
votes
0answers
117 views

Allowing read write access to a directory under SELinux

Is it possible to allow ANY process to read/write to a directory under SELinux? What I'd like is proper 0777 access to a directory and I really don't care which processes read or write to it. I know ...
1
vote
0answers
43 views

Running lightweight SELinux policy in production

I'd like to take advantage of SELinux ability to restrict a group of Linux processes. The group is unprivileged users with high enough UID (say, >1000). This I want to do on a shared hosting server, ...
0
votes
0answers
468 views

SELinux is preventing /usr/sbin/nginx from execute access on the file /etc/ld.so.cache

I'm getting a weird SElinux issue where if I restart Nginx with sudo systemctl restart nginx and SElinux is enforcing the server jams up causing the website to crash and the servers CPU hits 70 - 90 ...
6
votes
2answers
49 views

Is there a tool which can find which SELinux rule allowed a particular access to occur?

My system has a very complex SELinux policy. Is there a tool which can explain why a particular access was granted? Often when I search for a particular rule using text search I don't find it because ...
0
votes
1answer
93 views

SElinux and TCP Traceroute

I need to run a TCP Traceroute in the browser but are getting a few SElinux alerts. I have tried creating a policy with audit2allow, e.g ausearch -c 'traceroute' --raw | audit2allow -M my-traceroute ...
2
votes
0answers
93 views

Change SE Linux context label of a specific folder inside a cifs mount

have cifs mount on my setup mounted via /etc/fstab with context set to system_u:object_r:cifs_t:s0. There are some specific folders that I want to override default context to set public_content_t so I ...
2
votes
1answer
327 views

SELinux is preventing /usr/sbin/php-fpm from lock access on the file cert9.db

I have an selinux alert for the file /var/cache/nginx/.pki/nssdb/cert9.db., but I don't know what label I should give to it. The selinux report suggests hundreds of labels, but which is the correct ...
0
votes
2answers
2k views

How to disable SELINUX using grub?

I accidentally enabled SELINUX and reboot the system without knowing it's consequence. Now, I can't access the login system in my CENTOS 7 unit. What I've tried so far: https://serverfault.com/...