Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible role-based, mandatory access control (MAC) architecture on Linux through kernel modifications and user-tools. It is primarily used to confine system processes and users beyond the basic Discretionary Access Controls (DAC) mechanism or access-control list found on *nix systems.

Filter by
Sorted by
Tagged with
0 votes
1 answer
30 views

Selinux php-fpm httpd and mariadb socket connection

New note with important details I just ran a few version tests and resulted in the following: Alright, here’s my latest update: 10.5 works 10.6 doesn’t 10.7 works 10.8 work etc. I was hoping to use ...
  • 292
0 votes
2 answers
8 views

samba sharing nfs mounted folder and SELINUX

in RHEL 7.9, samba-4.10.16-19, nfs-utils-1.3.0, server A and server B both have SELINUX as enforcing from server A, the folder /data is NFS exported. on server B, mount A:/data /data successfully ...
  • 4,553
6 votes
1 answer
95 views

Firefox spamming SECCOMP events to journal/syslog - how to fix?

Since I updated to the snap-based Firefox on Ubuntu recently, I see it reporting SECCOMP_RET_TRAP messages to the journal whenever some application is drawing a canvas. And since applications drawing ...
  • 115
0 votes
0 answers
18 views

SELinux blocking port bind when command run via `sh -c '...'`

I am trying to start a systemd user unit. The unit is a podman container that attempts to bind a port. If I run systemctl --user start my-service, the container starts fine. If I run sh -c 'systemctl -...
0 votes
0 answers
47 views

SELnux errors in RHEL 8 : SELinux policy enabled , suEXEC mechanism enabled , No slotmem from mod_heartmonitor , OpenSSL/1.1.1k configured

Recently I installed SSL certificate for my linux rhel 8 server. Now, I am trying to load the application files it trows error [pid 3176151:tid 139812477512000] SELinux policy enabled; httpd ...
  • 1
0 votes
0 answers
30 views

restarting service remotely via snmp blocked by selinux/pam on Redhat8

I am having some trouble remotely starting/stopping/restarting a service through snmp. It seems to work fine with SElinux set in permissive but with it in enforcing mode it will fail with this type of ...
2 votes
0 answers
86 views

What SELinux setting is preventing Samba from displaying and allowing me access to shares?

I have a very basic /etc/samba/smb.conf configuration: [global] workgroup = WORKGROUP server string = Samba server (%v) on %h security = user passdb backend = tdbsam [...
  • 2,235
0 votes
1 answer
12 views

SELinux: Why do common utilities need to be compiled with custom flags

See: https://wiki.archlinux.org/title/SELinux#SELinux_aware_system_utilities Why are they compiled with SELinux? If they aren't, what happens?
1 vote
1 answer
34 views

mdadm raid6 has all 6 drives working, but was marked as failed after selinux blocked access during a system update

So, during a recent dnf update on my system, apparently according to the system logs at some point selinux suddenly disallowed write access to the kernel and it then marked the raid drive as "...
  • 81
1 vote
1 answer
53 views

SELinux is blocking VPN connections for non root users

I want (open)vpn connections to be available to all users, but if I'm not root are blocked by SELinux. I looked In var/log/audit/audit.log first in no permisive mode: type=AVC msg=audit(1659770552.275:...
3 votes
1 answer
52 views

File permissions not matching allowed operations...?

I have been having several issues with a CentOS 9 VM related to file permissions. I've never had this much trouble before, and I'm wondering if it has something to do with the security options and ...
  • 224
0 votes
0 answers
11 views

samba 4.16 interactions with Selinux

I upgraded my server a couple weeks ago to Centos 8 and everything to current levels. This apparently included upgrading Samba to 4.16.2. Nothing seemed amis but I did notice big lags streaming data ...
0 votes
1 answer
21 views

Turn off SELinux without logging in?

So I have a CentOS VM and changed SELinux to enforcing (which was a mistake), and after rebooting I couldn't login at all (even with root - there was a login loop where I kept getting sent back to the ...
0 votes
1 answer
46 views

How to set selinux file permissions on specific files?

I have a couple of files that I copied from one device to another and it's causing problems because the file permissions need to be changed. What I'm getting: $ ls -laZ ... drwxrwx--x 2 u0_a119 ...
  • 697
0 votes
0 answers
42 views

Yocto SELinux on read only file system

I am trying to enforce SELinux on a read only file system, my current status is I can boot and get to login prompt (either serial or SSH) when i try to login if I have SELinux in "enforcing" ...
  • 1
0 votes
0 answers
9 views

SELinux types for global object classes

I am new to SELinux and I understand the concepts that a certain process is running in a specific domain, and by the policy rules it can (or can't) act with a certain permission (or a whole set of ...
0 votes
0 answers
19 views

Can SELinux limit the scope of a binary which has capabilities set?

I would like to give my application (running unprivileged) a set of capabilities which allows it to: chown/delete some files not owned by it set quota for users but limit the scope of its "...
0 votes
1 answer
42 views

Does this prevent leaks out of homedirs without SELinux?

I would like to prevent certain users from leaking info out of their home dir trees, even if they chmod their home dir. In other words, I have users alice and bob, and I want to prevent alice from ...
0 votes
1 answer
22 views

SELinux issue with FTP/Samba/Home directory

I am setting up my home camera to record to my NAS server (CentOS 8 Stream). I am using FTP for the transfer. I installed vsftpd and created a dedicated user (ftpuser). I want the files to be ...
0 votes
0 answers
76 views

Script on ssh login triggered by pam_exec.so gets blocked by SELinux

I am trying to execute a custom script on every ssh login. Following several manuals on the internet (and the manpage of pam_exec.so), I added the following line to /etc/pam.d/sshd: session ...
0 votes
1 answer
26 views

My user (tom) has user_u , user_r and user_t via semanage but it still can perform sudo

My user (tom) is mapped to user_u user , user_r role and user_t domain via semanage [tom@localhost ~]$ id -Z user_u:user_r:user_t:s0 [tom@localhost ~]$ because I have made the "default" as ...
  • 3
0 votes
0 answers
30 views

why can unconfined_u user not have sysadm_r role and sysadm_t type

The semanage on my instance looks like the following: [root@localhost ~]# semanage login -l Login Name SELinux User MLS/MCS Range Service __default__ unconfined_u ...
  • 3
0 votes
1 answer
17 views

For fedora, how do I get the original text based source file of selinux policy file, as well as plaintext versions of other files, like .te files?

I've been trying to find the original source files for the Fedora selinux policies. The policy file is distributed as a binary file in the /etc/selinux/targeted/policy. Is there a way to get the ...
2 votes
0 answers
88 views

How to tell SELinux to allow a python script to do "everything"

I'm new to SELinux and it is giving me a headache. I have a python service that runs a python script on my home directory (my_script.py). I've been running the service, seeing what aspect of it ...
  • 121
1 vote
1 answer
273 views

How to allow a custom application with SELinux?

I have a Go application that has a basic systemd service that runs with the user web. NGiNX talks to it via reverse proxy, and it talks to the MySQL database on the same server. NGiNX and MySQL ...
0 votes
1 answer
120 views

/var/log/httpd permissions reset from 705 to 700 after reboot

After a reboot /var/log/httpd permissions reset from 705 to 700. Could this be a SELinux issue? OS is RHEL 8.
1 vote
1 answer
106 views

What does system_u means when assigned to a file?

What my question is : if there is a file assigned with system_u as SELinux that means only the user mapped to system_u/unconfined_u gets to access the file? if this label is assigned to an executable ...
0 votes
0 answers
111 views

Ubuntu 20.04 doesn't boot after setting SELinux to enforcing

I'm trying to set SELinux to enforcing on Ubuntu 20.04, and the steps I did are as follow: Install SELinux = sudo apt-get install policycoreutils selinux-utils selinux-basics -y Activate SELinux = ...
2 votes
0 answers
59 views

What are the reasons for the default behavior of restorecon in SELinux?

At one point when learning the administration of SELinux, the restorecon(8) program gave me a good headache. No matter how I tried to change the permanent file contexts with semanage-fcontext(8) and ...
0 votes
1 answer
401 views

Mounting lvm after fstab entry is not creating SElinux labels in the new lvm

On RHEL8, I created an lvm with ext4 filesystem. Added it to /etc/fstab but when I use mount -av, I get the following error: You just mounted an file system that supports labels which does not ...
  • 375
1 vote
0 answers
64 views

Cant install Selinux policy

I am trying to install selinux on my librem14 pureos machine, every time I run sudo apt-get install selinux-policy-default I get: dpkg: error processing package selinux-policy-default (--configure): ...
  • 11
0 votes
0 answers
25 views

Can't execute HIDS samhain with SELinux enabled

Trying to execute some HIDS Samhain commands raises SELinux permissions error (working in permissive mode, not in enforcing): --------- sh_readconf.c --- 433 --------- Could not open the local ...
  • 361
0 votes
0 answers
22 views

SELinux configuration to cache ssh key passphrase between reboots

I am using CentOS Stream 8. I added my ssh key to keychain: ssh-keygen -l eval `ssh-agent` ssh-add -k ~/.ssh/id_rsa # test connections ssh -T git@bitbucket.org ssh text passes in this terminal ...
  • 101
1 vote
0 answers
70 views

SELinux: allow socat to run on unreserved_port_t

I'm working on an embedded distro with SELinux. I am having this issue: root@unknown7:~# socat openssl-listen:7777,reuseaddr, stdio 2022/02/03 13:44:44 socat[2331] E bind(5, {AF=2 0.0.0.0:7777}, 16): ...
  • 361
1 vote
0 answers
130 views

initrc_t bash: /etc/init.d/network: /bin/bash: bad interpreter: Permission denied

on my CentOS 7.6 with SELinux enforcing I faced with the issue: uid=0(root) gid=0(root) groups=0(root) context=sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 #ls -lZ /etc/init.d/network -rwxr-x---. root ...
  • 259
2 votes
1 answer
84 views

Any way to make sysfs file immutable?

I'm trying to make /sys/fs/selinux/enforce always contain "1", and prevent it from being changed. I've been able to do this on /etc/selinux/config by running chattr +i /etc/selinux/config ...
3 votes
0 answers
433 views

set sshd SELinux security context

I'm working on my custom board and on my custom UNIX-like O.S. . When I connect using ssh and no root users a receve this SELinux error: A valid context for could not be obtained. where user is not ...
  • 31
0 votes
0 answers
108 views

block internet access to all applications except whitelisted

If blacklisting I'd use firejail, but since I want to whitelist and include preinstalled binaries, seems like SEL is the only potential choice. Essentially, could SEL be used to add a new type context ...
  • 13
1 vote
1 answer
64 views

Offline setting an SELinux boolean

I had an issue with an SELinux boolean, allow_ypbind that is wrongly set at 0 when starting my embedded Linux distro. I know that at runtime I may run a setsebool command to set it to 1. I need to ...
  • 361
0 votes
0 answers
365 views

How to enable SELinux on RaspberryPi's 5.10 BullsEye Lite OS

SELinux files appear on a fresh image of BullsEye 5.10 lite, RaspberryPi OS but I can not find any directions on how to enable it. This should be well documented but not found for the current ...
  • 1
0 votes
2 answers
172 views

su issues for non-root user if SELinux is on

I have a common user on my RHEL 7.6 server and when SELinux is off, su command works for it. But when SElinux is on, su command doesn't work anymore. In the PAM sources I found that #ifndef ...
  • 259
0 votes
0 answers
82 views

Preserving file permissions in a samba server secured with SELinux

I am trying to share a folder in my Fedora machine through samba secured with SELinux. I need my machine to have read/write permission to the shared folder while other machines to only have read ...
  • 21
0 votes
0 answers
236 views

How to enable Wireguard UDP port on SELinux

I have a wireguard tunnel on a RHEL 8 server and I would like to enable SELinux. In order to do that, Redhat docs suggest the following commnad: #> semanage port -a -t <type> -p udp <port&...
  • 175
0 votes
0 answers
33 views

SELinux: allow line for any application

It's possible to write for SELinux an allow line for every application? I.e. I am working on a Linux embedded distro and many applications need to explicitly allowed to make use of the pseudoterminal: ...
  • 361
0 votes
0 answers
28 views

why doesn't mkdir have a selinux policy file in android?

I have seen even toolbox (ls , rm.. etc) has selinux policy file. But, mkdir I don't see any selinux policy existing what is difference between these two ?
0 votes
1 answer
115 views

Not parsing all ini files in /etc/php.d

Oracle Linux Server release 8.5 Apache/2.4.37 (Oracle Linux) PHP 7.2.24 The specific INI file is 20-oci8.ini, using php -i in the command line, it shows that the INI file was parsed and an OCI8 ...
1 vote
0 answers
44 views

Mount disk of non-selinux machine on machine with selinux enabled

I have a backup server, which has selinux enabled. It has an external hard drive attached to it to store the backups (ext4). I also have a workstation which has selinux disabled. If I run rsync from ...
  • 813
0 votes
0 answers
50 views

shmat returns error (void *) -1 in selinux enabled rhel environment

as per the documentaion:- If SHM_RDONLY is specified in shmflg, the segment is attached for reading and the process must have read permission for the segment. Otherwise the segment is attached for ...
0 votes
2 answers
461 views

selinux blocks ping from php exec

Apache server running Centos7. I'm trying to execute a ping from PHP's 'exec' command but get "socket: permission denied". It works with selinux disabled. My linux knowledge is somewhat ...
  • 113
0 votes
0 answers
509 views

Is it possible to change the SElinux context of a running process?

If a process is already running with a certain SElinux context: system_u:system_r:typea_t Is it possible to change the context of this running process to: system_u:system_r:typeb_t Assuming that ...

1
2 3 4 5
12