Skip to main content

Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible role-based, mandatory access control (MAC) architecture on Linux through kernel modifications and user-tools. It is primarily used to confine system processes and users beyond the basic Discretionary Access Controls (DAC) mechanism or access-control list found on *nix systems.

Filter by
Sorted by
Tagged with
0 votes
1 answer
18 views

Adding a fresh zfs sub-dataset pri_zp/Z1/Z99-future to pri_zp/Z1, and resuming recursive replication to sec_zp/Z1

I have set up and replicated the OpenZFS dataset pri_zp/Z1 (with pri_zp/Z1/Z00-initial) to sec_zp/Z1 using a zfs send -R. But then (months later) when I try to create (and replicate) a newer data set, ...
NevilleDNZ's user avatar
0 votes
0 answers
20 views

Selinux seems to be blocking but no denied message appearing in audit log

I have a script executed by a Java app with testmod_t context. This script does chage -M -1 user to set a user to no expiry. However, when SELinux is enforcing, the command does not seem to do ...
neffect's user avatar
0 votes
0 answers
56 views

How do I create an SElinux policy to allow php-fpm to execute optipng?

I am running Wordpress in Rocky Linux 9 and need optipng for some image transformation tasks, but it is being blocked: SELinux is preventing /usr/sbin/php-fpm from execute access on the file optipng. ...
location's user avatar
0 votes
0 answers
27 views

Android SELinux: start dnsmasq on startup

I have had this question on android.stackexchange.com for more than a month, but I just realised that my problem isn't related to Android as much as it is related to SELinux and Android security. I’m ...
ellat's user avatar
  • 37
1 vote
0 answers
26 views

Setting custom SELinux policy for a systemd service

In AlmaLinux9 I have a small ExectStart systemd service which runs a java process (Java Temurin 21). I am getting SELinux errors due to the service not having the execmem permission (already checked ...
Mateo Upegui Borja's user avatar
1 vote
1 answer
30 views

Confined user (staff_u) can use sudo to transition to unconfined_r even though there is no sudoers entry that permits it

I've created a user that is mapped to the staff_u SELinux user: # semanage login -l Login Name SELinux User MLS/MCS Range Service __default__ unconfined_u ...
Sam Morris's user avatar
  • 1,050
0 votes
1 answer
67 views

geoclue redhat selinux annoyance

on a clean install of RHEL-8.9 from iso, with selinux in its default state of enforcing, geoclue shows up via sealert -a /var/log/audit/audit.log SELinux is preventing /usr/libexec/geoclue from search ...
ron's user avatar
  • 7,264
1 vote
0 answers
31 views

SELINUX issue running systemctl from script invoked by rsyslogd

We have a constant issue where sssd is getting itself in failed state when an oom-killer event happens and kills a user's memory hog job. No idea why this happens as the oom-killer is not touching ...
raines's user avatar
  • 314
0 votes
0 answers
63 views

Set SELinux labels in Docker build

I'm trying to produce a squashfs image with labeled files for SELinux. I'm building this using docker buildx. Both of the ideas I tried failed: setfattr and chcon do not work on SELinux-enforcing ...
Dmitry Sharshakov's user avatar
0 votes
1 answer
70 views

Fine-tune selinux constraints on nginx without semanage?

I'm setting up nginx on a Rocky 8.9 server, and ran into SELinux problems trying to listen on ports other than 80 and 443. The recommended solutions across the internet all seem to recommend semanage,...
Wildcard's user avatar
  • 36.8k
1 vote
1 answer
38 views

How do I automatically set the target context for a .sock file to be **httpd_var_run_t** so that nginx can connect to and write to the socket?

The original file context for /run/unicorn.sock is tcontext=system_u:object_r:var_run_t:s0 How do I have the file context automatically be system_u:object_r:httpd_var_run_t:s0 when I start the socket ...
siralbert's user avatar
  • 117
4 votes
1 answer
376 views

Can I use SELinux to add an extra layer of protection against 0-day VM escape exploits in KVM/QEMU?

My host is Fedora, and I want to add an extra layer of protection against 0day KVM/QEMU exploits that execute code on the host. For example there have been CVEs where if we run a specially crafted ...
OneAndOnly's user avatar
0 votes
1 answer
92 views

Error when rebuilding SELinux policy after adding rule to type enforcement (.te) file

I am going through this guide which allows me to create a custom SELinux policy for an application and restrict unconfined access to the kernel system files. On Step 9, I need to add a rule to the ...
siralbert's user avatar
  • 117
0 votes
1 answer
83 views

Recreate selinux .te file from loaded policy

I don't have the original .te file or .mod or .pp files for a custom pp I created from audit2allow -a output. The policy is currently running on the server and I would like to get the original te ...
Emanuele Buttice's user avatar
0 votes
2 answers
73 views

how to modify the selinux labels of a file

In RHEL 8.9, in /etc/systemd/system/ I created a custom.service file, using vi as root. In doing so it has these labels by default as shown by ls -ldZ -rw-r--r--. 1 root root unconfined_u:object_r:...
ron's user avatar
  • 7,264
0 votes
1 answer
30 views

Who is setting SELinux context in default configuation

I see the SELinux context set for almost all the files in the root file system. This is our customized Linux image built from kernel 4.19 with userland packages including systemd service to manage ...
pitnal's user avatar
  • 101
0 votes
0 answers
80 views

Who sets the dot permission in ls -l output at build time in linux?

We have a custom build of Linux and user-land applications which contains libselinux, attr, OpenSSH, systemd, docker-ce and few more applications. We have a rpm based build system similar to fedora. ...
Prajval Badiger's user avatar
0 votes
1 answer
80 views

User not changing SElinux context (SELinux User)

I've added multiple users to SELinux user contexts: # semanage login -l Login Name SELinux User MLS/MCS Range Service __default__ unconfined_u s0-s0:c0....
user1098490's user avatar
3 votes
1 answer
143 views

SELinux does not log denial

SELinux does not allow auditd to start the process (named myplagin) and does not log the reason in the /var/log/audit/audit.log. The only mention of the denial I found in the /var/log/messages: ...
ibse's user avatar
  • 341
0 votes
1 answer
57 views

Why does NetworkManager ignore config files when SELinux is enabled?

I'm trying to set up a system based on AlmaLinux 9.2, to use SELinux and NetworkManager, with a read-only rootfs. For various reasons, I want to keep my 'keyfiles' on a separate partition. I have ...
Popup's user avatar
  • 646
1 vote
1 answer
28 views

Does SELinux file relabelling start anew if it is interrupted during boot phase?

SELinux relabelling can continue very long during boot phase. What happens when this process is interrupted by yet another boot? Does SELinux start relabelling from the beginning if it could not ...
Thomas's user avatar
  • 23
0 votes
0 answers
168 views

SElinux denies to access file in /proc

My audit plugin process needs to be able to iterate through /proc and read /proc/pid/stat files, but SElinux refuses this. Process context of my plugin: ps auxZ | grep -i myplugin system_u:system_r:...
ibse's user avatar
  • 341
-1 votes
1 answer
109 views

My machine always connect to some strange foreign IP addresses

My machine installed Centos 6.4 without any special online services. Recently, my machine caused congestion on LAN. I'm a newbie to Linux, so I'm very confused. I do not know what happened. Also maybe ...
nghia nguyen's user avatar
1 vote
0 answers
480 views

Configure SELinux to allow qemu/virt-manager and samba to both read/write to the same folder?

Problem summary I have a local folder that is shared under samba but if I try to allow qemu (via user session) to access it via virtio-9p, I get an error (SELinux avc). Works fine with SELinux ...
zpangwin's user avatar
  • 891
1 vote
1 answer
105 views

SELINUX policy not applying

I have a Fedora Server v39 (minimal install) running as a VM (host is also Fedora Server v39). I have shared a host directory with the VM using virtiofs and mapped it to /etc/wireguard in the VM. drwx-...
Christian's user avatar
  • 2,205
1 vote
1 answer
184 views

Wireguard cant read wg0.conf on share

I have a virtual fedora server running using libvirt and have shared a directory from the host using virtiofs. hostshare /etc/wireguard virtiofs rw,relatime 0 0 The dir in the guest is mapped to /etc/...
Christian's user avatar
  • 2,205
2 votes
1 answer
66 views

pam_exec cannot call systemctl due to SELinux

I'm trying to execute a script every time an SSH session starts and ends, on CentOS 7. This script should start/stop a systemd service. This is my setup: In /etc/pam.d/sshd, I added the following ...
flyx's user avatar
  • 131
1 vote
0 answers
169 views

How can I get away from "mount point busy" after using semanage?

I'm trying to label a port for SELinux (RHEL 8.8) using semanage: semanage port -a -t mylabel_port_t -p tcp 2345 This seems to work fine. But after running this command, it is impossible to remount ...
LisaHH's user avatar
  • 11
0 votes
0 answers
137 views

restorecon fails with permission denied on ~user .ssh

I discovered this when trying to do an ssh-copy-id. I was getting the error 'restorecon: could not set context for /home/rit/.ssh'. The premissions look correct. [rit@host ~]$ ls -ld .ssh drwx------. ...
Jeff Gaer's user avatar
  • 101
0 votes
2 answers
618 views

podman fails with 'Error relocating' / 'RELRO protection failed'; ~/.local/share/containers a link to a different location

Trying to run any pods on Podman fails, after an SELinux relabeling $ podman run -ti alpine Error relocating /lib/ld-musl-x86_64.so.1: RELRO protection failed: No error information Error relocating /...
caxcaxcoatl's user avatar
1 vote
1 answer
223 views

how can i make a dbus connection from a sandbox to pipewire

How can i create a DBUS connection to PipeWire (to communicate with the sound daemon) from a SElinux sandbox?
ministry's user avatar
1 vote
0 answers
176 views

selinux user_u staff_u .bash_profile permission denied on ssh login

A security rule states RHEL must prevent non-privileged users from executing privileged functions, including disabling, circumventing, or altering implemented security safeguards/countermeasures. All ...
ron's user avatar
  • 7,264
1 vote
0 answers
226 views

SELinux policy for Android emulator

The Google Android emulator requires execheap permissions, otherwise it segfaults when SElinux is in enforcing mode. For those who are not familiar with the Android emulator: It uses a forked version ...
a.ilchinger's user avatar
0 votes
0 answers
48 views

selinux and systemctl start versus service start

From https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/getting-started-with-selinux_using-selinux 1.4. SELinux architecture and packages Important: To avoid ...
ron's user avatar
  • 7,264
1 vote
0 answers
828 views

How can I assume user 1000 inside of a docker container on linux?

I am trying to use AFL++ to fuzz a target application on Fedora 36. I followed the instructions listed on this page by pulling down and running the AFL++ container and building it, and then creating ...
the_endian's user avatar
0 votes
2 answers
297 views

After a problematic software update OS boots only with SELinux disabled

I have Fedora 38. The last software update messed up my system. It became unbootable. The reason probably was in having duplicate packages. I managed to fix dnf check errors by dnf remove --duplicates ...
RCKT's user avatar
  • 11
0 votes
0 answers
195 views

How to use tmpfs in MariaDB when SELinux is enforced?

Running AlmaLinux 9.2 and MariaDB 10.11. Trying to use in my.cnf: tmpdir = /dev/shm This works fine when PHP-FPM is connecting using TCP port. Now trying to use faster Socket (/var/lib/mysql/mysql....
ivp's user avatar
  • 1
0 votes
1 answer
259 views

How can I get SELinux to allow runc to transition to container_t?

I am referencing this page and following these simple instructions on Fedora 36: docker pull aflplusplus/aflplusplus: docker run -ti -v /location/of/your/target:/src aflplusplus/aflplusplus However, ...
the_endian's user avatar
1 vote
0 answers
103 views

What is /dev/selinux?

Is there a device node called /dev/selinux Android 13 init crashes with the following [ 1.417333] (7)[1:init]selinux: SELinux: Loaded file_contexts [ 1.417341] (7)[1:init]selinux: [ 1....
Bret Joseph's user avatar
1 vote
1 answer
4k views

selinux context for ExecStart of custom systemd service

I have a Type=simple /etc/systemd/system/custom.service. It has ExecStart=/root/scripts/custom.sh. I use this to make various administration things happen automatically after boot. It has worked well ...
ron's user avatar
  • 7,264
2 votes
0 answers
742 views

selinux allowing custom systemd service

in RHEL 8.8, I have a custom /etc/systemd/system/custom.service. [Unit] Description=custom [Service] Type=simple ExecStart=/root/scripts/custom.sh [Install] WantedBy=default.target my /root/scripts/...
ron's user avatar
  • 7,264
1 vote
1 answer
532 views

Where is the mapping between SElinux source and target contexts

I am learning about SELinux and have a question: There doesn't appear to be a direct correlation between the fields of the source and the target. For example Apache may run with Type httpd_t and the ...
Johan's user avatar
  • 4,198
1 vote
0 answers
141 views

SELinux sandboxed firefox has no audio

Running firefox in a SELinux sandbox using this script: Random variables for directories, Allowing multiple instances SEhome=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 8 | head -n 1) SEtemp=$(...
ministry's user avatar
1 vote
0 answers
960 views

Systemd service fails to run firewall-cmd

I recently set up wireguard on my Fedora-38 machine and started it using systemctl start wg-quick@wg0 which worked perfectly fine until now. When I start the service I see the following error message: ...
minils's user avatar
  • 163
0 votes
1 answer
28 views

Locked out of ssh with TFA from selinux

I have a debian bullseye headless home server. I recently found out about, and installed, selinux. I have been reading multiple wiki and tutorials to learn how it works and how to configure it. I have ...
Èl Sea's user avatar
  • 43
0 votes
0 answers
631 views

configure SELinux for Wordpress on Apache, Almalinux

I have an issue with SELinux that when enforcing (enabled) causes Wordpress on Apache to throw errors in the header like: Warning: An unexpected error occurred. Something may be wrong with WordPress....
TexasTim's user avatar
1 vote
0 answers
75 views

How would you assign read-only permissions to run ls -l /proc/{pid}/fd for processes you don't own using SELinux in Android

I am developing an application on Android as a non-root user.  However, I need read access to all the /proc/{pid}/fd files so as to check the inode numbers from the symlink under fd. How do I do that ...
Mahavir Surana's user avatar
0 votes
0 answers
66 views

SELINUX add process_type access to file_type

nslcd.service cannot start because SELINUX is enabled. It doesn't allow nslcd to access /etc/openldap/certs/*. The permissions on the files in that directory are: -r--r--r--. 1 root root system_u:...
John Miller's user avatar
0 votes
0 answers
311 views

RHEL 9.1 - SELinux is preventing /usr/local/bin/php from read access on the file /web/inc/init_db.inc.php

i want to solve this problem what SELinux says. SELinux is preventing /usr/local/bin/php from read access on the file /web/inc/init_db.inc.php. output from console is: [root@rhel ~]# ausearch -c 'php'...
ArchMatt's user avatar
0 votes
0 answers
332 views

How to transfer selinux file context respectively to the full copy?

I have an image with files marked with their SELinux context: system_u:object_r:net_conf_t:s0 for example. I also have a second image with the same files, but without the preserved context (the ...
caiiiok254's user avatar

1
2 3 4 5
13