Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

0
votes
1answer
25 views

Activate SElinux on Kali

I am unable to activate SElinux enforce on Kali. I tried the following without success Change the configuration command line \# setenforce 1 add set selinux=enforce to the boot option
1
vote
0answers
16 views

What combination of labels to use to let NGINX connect to socket in /home/user?

I'm running a uwsgi app that creates a unix socket in /home/user/myapp.sock and nginx has been given the right permissions to access the file, however, selinux isn't letting me connect to it: avc: ...
0
votes
0answers
18 views

CentoOS 7 Samba Share USB NTFS

Cannot seem to find an answer which includes all of the specifics of my situation. I followed instructions in Sharing a mounted drive with samba on CentOS7, but still have a problem. I have CentOS 7 ...
2
votes
0answers
29 views

User account mapped to SELinux staff_u account but unable to run sudo command

I have two user accounts in my virtual machine, anim and anim2. Both are part of the wheel group and can run su/sudo commands. I was reading on redhat how SELinux user staff_u can only run sudo ...
1
vote
2answers
64 views

Real application of selinux [closed]

Almost all tutorial and most systems i have seen seem to disable selinux. Are there actual implementation of selinux security in real world ?
0
votes
0answers
31 views

“semanage port” command does not work

So, I was tasked to chagen SSH port in a CentOS server. As I did in the configuration file, the service failed to start, so after a little research I found that I should make some changes in selinux, ...
7
votes
1answer
124 views

Allow certain risky behaviour of a single program in a safe way in SELinux

I have a program running inside a Docker container that loads an .so file which alters the behaviour of the program through hooking and memory manipulation. This behaviour is blocked by SELinux with ...
1
vote
0answers
60 views

How to exclude a directory or partition on pmlogger scan?

As on the details below it look like that the cause of the problem is the pmlogger is spawning the find command. And its takes a long time for the find to scan all the files in one of my partition. ...
3
votes
0answers
51 views

Symbolic links do not allow SELinux type_transition

Trying to access symbolic link does not allow to use SELinux type_transition. I mean that I tried to implement scheme in which user has access to a symbolic link located in /usr/bin/ and which leads ...
1
vote
0answers
89 views

How to mount ecryptfs and preserve individual SELinux tag of underlying files?

I am trying to mount ecryptfs on a system that uses SELinux (e.g. Cent-OS), and I want to preserve the security tag of all individual underlying files. Using mount -o command I can set the security ...
2
votes
2answers
100 views

Selinux is blocking my external kernel module

I'm trying to insert an external kernel module in permanent mode. During the boot, my module is being loaded by systemd-modules-load service so long as Selinux is permissive. But I want to keep ...
-1
votes
2answers
45 views

SELinux is preventing $_POST variables on Amazon Linux 2

I began playing with RPM based OSes and I am really impressed. Amazon Linux doesn't include setroubleshoot in any of their repos. I want to use official repos for everything, otherwise I would ...
1
vote
1answer
68 views

In a custom module, is there a way to allow all permissions for files/directories?

I've written a custom selinux module that looks something like this: require { type my_app_t; type my_app_file_t; class file { getattr lock open read write execute execute_no_trans ioctl ...
4
votes
1answer
137 views

SELinux Interfering With sss_cache

System: HP Pavilion Power Laptop 15-cb0xx Intel i7-7700HQ w/ integrated graphics enabled (can't be turned off in bios) Fedora 28 NVIDIA GTX 1050 (mobile) I used the dnfdragora GUI to update about ...
1
vote
2answers
100 views

SELinux demands constant relabeling

I have installed SELinux on Ubuntu 18.04.1 LTS via # apt install selinux After the mandatory reboot, SELinux was constantly disabled until I added SELinux = 1 to /etc/default/grub and executed ...
0
votes
2answers
202 views

SELinux is preventing httpd from create access on the file

Whenever I upload a file via my web browser to my web sever, I see the following lines in /var/log/messages Nov 8 12:18:24 sn setroubleshoot: SELinux is preventing httpd from create access on the ...
0
votes
0answers
34 views

Why can't set my selinux status as enabled?

I had bought a vps ,installed centos7. rpm -qa | grep selinux libselinux-2.5-12.el7.x86_64 libselinux-utils-2.5-12.el7.x86_64 libselinux-python-2.5-12.el7.x86_64 No /etc/sysconfig/selinux and /etc/...
0
votes
1answer
89 views

How to run Java application in confined SELinux domain?

I am working with a Java app that has been labeled with its own SELinux type. Java executes it as unconfined_t instead of the labeled type. Java is labeled as bin_t (ls -Z /usr/lib/jvm/java-1.8.0-...
1
vote
0answers
60 views

Maintaining file's SELinux labels when copying them from one directory into another

Default behavior for copying files or sub-dirs from one directory to another is that the copied objects do not maintain their SELinux type (domain) which is opposite to objects which were moved. ...
1
vote
1answer
166 views

SELinux vs AppArmor applicability

I am going through some primers on LSM implementations so eventually I am digging a bit into AppArmor and SELinux. I am aware of this discussion but this does not make very clear one question I am ...
2
votes
1answer
61 views

Prevent Mount under Destination

I want to prevent all users (including root) from mounting anything under a specific destination (e.g. /tmp) by SELinux or any other Linux tool, is this possible? And how would it be done? Regarding ...
1
vote
1answer
55 views

How is SELinux loaded on boot?

I understand that a configuration file is in: /etc/selinux/config But how is it processed at boot? How does SELinux start, is it a daemon? Which startup script starts SELinux?
0
votes
1answer
172 views

How to extend SELinux policy to allow ntpd to use gps?

There is an attached device on the motherboard and the NTP service tries to read data from it (the attached device link is in /dev directory). Using SELinux enforcing, the service status errors that ...
2
votes
0answers
197 views

Yama LSM seems to do nothing. RHEL/Centos 7.5

The Yama security module is supposed to be able to prevent users from running the ptrace system call, yet even with kernel.yama.ptrace_scope set to 3, users can still run strace (which uses ptrace). ...
3
votes
1answer
91 views

Is it possible to prevent a change in SELinux status without a reboot?

I'd like to be able to prevent even a privileged user from changing the SELinux mode from enforcing to permissive without a reboot. It's too easy for a root user to run setenforce permissive, make ...
0
votes
1answer
243 views

CentOS Server file permissions

I am starting to learn server management with a CentOS Virtual Machine. I am trying to make a simple website. Because the Apache default file is in /var/www it is hard to write/make/change files. ...
1
vote
1answer
81 views

How to troubleshoot SELinux issues?

I suspect I have a problem in SELinux configuration: my issue goes away after disabling selinux using setenforce 0. I am using the default policy without any modifications. How can I pinpoint the ...
6
votes
1answer
180 views

What is the proper way to set SELinux context in an RPM .spec? (RHEL7 in 2018)

The RHEL7 supplied tomcat package supports multiple instances through the creation of directories and symlinks. Once such a multiple instance is created and packaged as an RPM, the extra instances ...
-4
votes
1answer
302 views

Temporarily disable SElinux [closed]

I want to temporarily disable SELinux on Centos 7. However, setenforce Permissive has no effect. # setenforce Permissive # sestatus SELinux status: enabled SELinuxfs mount: ...
0
votes
0answers
26 views

SElinux grant permission to ntp daemon [duplicate]

I updated the ntpd.conf file to read some data from a device in the /dev directory. Running NTP daemon I got the error: Sep 04 17:09:08 hardware ntpd[5742]: PARSE receiver #0: parse_start: open of /...
-1
votes
1answer
118 views

SELinux - workaround using audit2allow?

I read carefully tutorial and got to explanations on using audit2allow which allows access for denied process. audit2allow tutorial After reading about audit2allow it seems that this tool can always ...
1
vote
1answer
88 views

I want allow user to execute *only* ping utility using SELinux

I did it already with rbash (restricted bash) but now I want to use SELinux. So I created new user and add him to guest_u: semanage login -a -s guest_u restricteduser also I forbid him to execute ...
1
vote
0answers
72 views

Are these SELinux messages suggestive of intrusion?

In the CentOS7 GUI, I have been seeing a smattering of messages such as: SELinux is preventing /usr/bin/smbd from getattr on the file ___. The files are for instance: /etc/default/grub /etc/rc.d/...
1
vote
1answer
242 views

SELinux Doesn't Switch to “Enforcing” Mode

I have a minimal CentOS 7.5.1804 (Core) system and trying to change SELinux mode from Disabled to Enforcing but when I tried to change mode using setenforce 1 command, I got an error message says: ...
0
votes
1answer
320 views

How to add exception in SELinux?

When SELinux is disabled, I have no issues, but when it's Enforced then I'm facing this [systemd] failed to get d-bus session: Failed to connect to socket /run/dbus/system_bus_socket: Permission ...
2
votes
2answers
71 views

Cannot list contents of directory with 0755 and owned by current user

The platform is a rooted Android 8.1 phone (Magisk) with the Termux Android terminal emulator and Linux environment app installed. I use this as a server on the go. After connecting a USB smart card ...
1
vote
1answer
89 views

Are both mitigations required when audit2allow suggests both restorecon and one type enforcement rule?

SELinux is permissive mode to help avoid operational issues during a transition to a new RHEL7 server deployment. Whilst some SELinux issues are fairly easy to review and resolve with a modicum of ...
0
votes
1answer
266 views

ssh_selinux_change_context: setcon failed with Invalid argument

I am trying to do ssh communication to an IP but I get the following error messages in logs. Jun 5 11:36:50 thetemplate my-sshd[26346]: Accepted password for user1 from 172.80.1.2 port 34278 ssh2 ...
1
vote
1answer
253 views

How do I get Brother printer drivers to work on Fedora?

I have two Brother printers : a QL-1050 label printer (USB-plugged) and an MFC-9330CDW (wifi). Both work fine with an Ubuntu laptop, but I struggle to get them to print under Fedora 28 (actually had ...
3
votes
1answer
470 views

restorecon does nothing on CentOS 7

On CentOS 7.5, Linux 3.10.0-862.3.2.el7.x86_64, I'm trying to understand how file contexts work. ls -Z, chcon and semanage seem to work as expected, but restorecon seems stubbornly silent. For ...
3
votes
2answers
90 views

Send email on SELinux violation

On my desktop I get a GNOME notification when an SELinux violation has occurred which makes debugging simple but for servers I do not have this. Is there any way I can set up SELinux so when there is ...
0
votes
2answers
462 views

SELinux blocks tomcat web application to load Java native library (JNI) from /tmp folder

I have a Centos 7 with Tomcat installed and tomcat user ls -l /var/lib/tomcat total 0 drwxrwxrwx. 5 root tomcat 84 Jul 3 13:18 webapps SELinux is enforcing and a Java web application which tries ...
1
vote
0answers
48 views

How does one grant access to directories with SELinux's sandbox utility?

I'm trying to run Tor Browser Bundle within an SELinux sandbox. I tried to do the following, after looking at man sandbox: $ sandbox -X -H sehome -T tmp -I /run/user/1000/dbus-1/* \ -t ...
2
votes
2answers
124 views

prohibit unconfined SELinux user (root) to install policy to a system

I am trying to write a SELinux policy which after its installation will prohibit for a unconfined (or another, which can be chosen) user any subsequent SELinux policy installation. It seems that there ...
0
votes
1answer
689 views

SELinux policy for Pi-Hole

I am running Fedora Server 28 for ARM on my Raspberry and during the installation of Pi-Hole I got a warning message about SELinux being set to 'Enforced' and that because of it I cannot use Pi-Hole's ...
1
vote
2answers
367 views

SELinux - How to avoid it preventing a process from write access on newly created files into folder

I'm hardly trying to correctly use selinux keeping it in enforced mode, but very often I encounter issues with it causing our application to work improperly. Our web application is java backend and ...
0
votes
0answers
325 views

Unable to pull from any Docker registry when SELinux is enabled

Whenever I try to pull an image with Docker on my Fedora 28 system, the connections time out while waiting for headers. Disabling SELinux fixes the problem and images are successfully pulled from ...
3
votes
1answer
603 views

Create a SELinux policy for a custom systemd service

I'm using Fedora Workstation 27 Live OS in which I want to run a custom service EnableBIOS.service along with OS boot. For this to work, I have to disable SELinux which is causing a problem in my ...
2
votes
2answers
1k views

Postfix and Apache: Permission denied on CentOS 7

I am setting up a CentOS 7 Server with Apache2, MySQL, PHP and Postfix (for sending emails over PHP) My problem at the moment is that I get the following error (at the error_log from Apache): ...
0
votes
0answers
301 views

CentOS7 boot fails after repairing corrupted xfs and reinstalling grub-2

My CentOS7 VM crashed the other day and I am trying to restore it. I couldn't boot at all because of a corrupted xfs partition which I fixed with xfs_repair -v -L /dev/sda1. I then got Failed to ...