Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

Filter by
Sorted by
Tagged with
0
votes
0answers
7 views

Should every SELinux denial event result in an accompanying AVC?

On a currently running system that heavily is using docker containers, I noticed that running the daemon with selinux-enforcing:true, I obtained an (previously unseen) error message in my audit log. ...
1
vote
1answer
31 views

Why does SELinux (with Enforcing=1) allow binding to low (or any) ports, by default?

I assume that Selinux defaults, based on the documentation, mandate that basically all port operations would be blocked and logged as AVCs. I have an SELinux enforcing enabled VM, created with ...
2
votes
1answer
450 views

How to identify dac_override cause on Android?

I am working on some Android customizations and an app I am writing causes a dac_override which looks like so in dmesg: type=1400 audit(499405.329:16): avc: denied { dac_override } for pid=1103 comm=...
5
votes
1answer
996 views

selinux, dovecot and sieve

I've just started learning to configure SELINUX and this morning on my CentOS 6.4 x64 system, with postfix/dovecot/mysql installed, I woke up to the following selinux issue found 1 alerts in /var/log/...
0
votes
0answers
746 views

Cannot label F2FS (SELinux)

I'm running Arch Linux [testing] x86_64 For some reasons, I can't relabel my root file system (F2FS) with SELinux (custom kernel compiled, using refpolicy) Kernel ver $ uname -a ...
1
vote
2answers
629 views

Why does “attr -l .” tell me about an “selinux” attribute that “attr -g selinux .” refuses to read?

I'm setting up a Fedora (Core) 24 system from scratch, and ran into this oddness: > sudo attr -l . Attribute "selinux" has a 41 byte value for . > sudo attr -g selinux . attr_get: No data ...
5
votes
2answers
1k views

SELinux is preventing /opt/google/chrome/chrome-sandbox from write access on which file?

I keep getting the following error ever since upgrading to Chrome google-chrome-stable-42.0.2311.90-1.x86_64. SELinux is preventing /opt/google/chrome/chrome-sandbox from write access on the file ...
1
vote
0answers
21 views

How to run single application in permissive mode and remaing all in enforcement mode for SEAndroid?

I want to allow single application to run in permissive and keep enforcing mode for all other applications in SEAndroid. How to do this?
4
votes
2answers
3k views

SELinux + logrotate + prerotate = Permission Denied

I have what (should) be a fairly straightforward task: Migrate a set of custom log files to a database at night. I use logrotate (cron.daily) with a simple prerotate task /var/log/myapplog/*.log { ...
0
votes
0answers
58 views

Permission denied for imjournal: rename()

after disabling and enabling SELinux the Apache and MySQL cannot start, this error shows in messages.log: imjournal: rename() failed for new path: '/var/lib/rsyslog/imjournal.state': Permission ...
0
votes
1answer
46 views

SElinux configuration of symlinked /etc/my.cnf -> /app/program/my.cnf

Please advise me of whether it is possible to configure SElinux context in a way that MariaDB would pick it up. current configuration: ls -lZ /etc/my.cnf lrwxrwxrwx. root root system_u:object_r:...
1
vote
1answer
36 views

How to disable dontaudit denials in SEAndroid

My application is working in permissive mode, but not in Enforcing mode for SEAndroid. Here i cleared (allowed) all denials,so now there is no denial logs coming in my logcat logs.So it might be ...
0
votes
1answer
2k views

selinux blocking vsftpd directory listing

I am trying to get a better understanding of selinux and configuring a local ftp repository on Centos7. I installed vsftpd on my host. I created a repository on my host: /var/ftp/pub/centos7 EFI ...
-1
votes
1answer
45 views

Rsyslog in not logging due to Selinux, is my workaround ok

I have these two parameters in /etc/rsyslog.conf $ModLoad imjournal # provides access to the systemd journal ... # Turn off message reception via local log socket; # local messages are retrieved ...
0
votes
1answer
118 views

sshd[5589]: error: PAM: pam_open_session(): Cannot make/remove an entry for the specified session

I am working with a CentOS7 minimal install. I configured pam_radius with pam_script and was always able to ssh to the server using pubkey auth: that was on purpose. But after hardening the server ...
4
votes
1answer
71 views

SELinux: running a custom shell binary from /etc/passwd

----- Problem -------- I have CentOS 7.6 running on my system. I want to invoke a custom shell instead of standard shell in the /etc/passwd file. I have SELinux enabled, and for some reason sshd_t ...
3
votes
2answers
755 views

Weird audit2why message caused by SELinux

When I run audit2why to see why there is a failure when trying to upload files via SCP to folder /foo/bar on a remote server which results in access denied to folder /foo/bar, I get the following text:...
2
votes
1answer
48 views

Selinux causing sshd to fail when using AuthorizedKeysCommand

I have been following Gitlab's guide to enable Fast lookup of authorized SSH keys. Guide instructs to use AuthorizedKeysCommand. Authorized command is calling local https server. This command chain ...
0
votes
2answers
170 views

Website cannot write to files or create directories

I've been trying to install TeemIP for about 6+ months now and I've never been able to figure out this issue on Centos7. The error I get is the following: The directory '/var/www/teemip/public_html/...
4
votes
1answer
2k views

How to create an SELinux exception for individual files

I use a monitoring tool and on one of my systems that is checked remotely, it calls up a script, which in turn runs systemctl to check the status of a service. This was not working until I put SELinux ...
2
votes
0answers
20 views

selinux restorecon on systems without selinux like ubuntu [duplicate]

recently i had to change two files on a fedora raw image mounted via loopback on ubuntu, which usually runs in a kvm on the ubuntu host. That made a lot of troubles with selinux after booting from the ...
4
votes
3answers
97 views

Why do selinux policies apply to commands (e.g: logrotate) running from cronjobs, but not when run directly from command line?

Why do selinux policies apply to commands (e.g: logrotate) running from cronjobs, but not when run directly from command line? When I run logrotate manually from the command line, it works perfectly. ...
2
votes
1answer
5k views

What's missing with my SELinux installation?

According to Introduction to SELinux, section 14.4.2, SELinux support is built into the standard kernels provided by Debian. The core Unix tools support SELinux without any modifications. I have ...
8
votes
1answer
177 views

Allow certain risky behaviour of a single program in a safe way in SELinux

I have a program running inside a Docker container that loads an .so file which alters the behaviour of the program through hooking and memory manipulation. This behaviour is blocked by SELinux with ...
2
votes
2answers
5k views

SELinux issue Full path required for exclude: net:[4026532292]

I am trying to set samba context on directory with following command and I am not sure what this error is about but I can not set the context on directory. semanage fcontext -a -t samba_share_t "/...
0
votes
1answer
36 views

SELinuxs policy.conf configuration

I'm trying to configure SELinux on my home pc. During installation /etc/selinux/policy file had not been created thus I was not able to configure custom policy with checkpolicy. So I've copied it from ...
3
votes
1answer
670 views

How to get mount information of host inside a docker container

I need the mountpoints of all disks attached to a host inside a docker container. The mount information is available in /proc/1/mounts file, but I cannot access that file on all OS. When I run the ...
5
votes
3answers
14k views

How to mount NFS 3 volumes on Fedora 17?

I installed the package nfs-utils and tried it via: # mount -t nfs server:/mnt /mnt mount.nfs: rpc.statd is not running but is required for remote locking. mount.nfs: Either use '-o nolock' to keep ...
1
vote
1answer
254 views

Cannot stop SELinux from blocking Apache accessing /usr/local/nagios/var/rw/nagios.cmd

I have a Centos 7 server running Nagios Core 4.3.4 with Apache 2.4.6 in our UAT environment. I have a second server in PROD that was set up with the same Ansible playbook. Nagios was built from ...
4
votes
1answer
1k views

SELinux not allowing read files on ~/.cert

I'm new to Fedora 23 and SELinux. I use an OpenVPN client through NetworkManager. I stored all the files I needed OpenVPN to access (certificate, CA and private key) inside ~/.cert and ran updatecon -...
9
votes
3answers
32k views

chcon: can't apply partial context to unlabeled file '/usr/sbin/xrdp'

Whenever I'm trying to execute this line to configure SELinux to install xrdp from this tutorial: # chcon --type=bin_t /usr/sbin/xrdp # chcon --type=bin_t /usr/sbin/xrdp-sesman I get these errors: ...
1
vote
3answers
397 views

setroubleshootd excessive cpu and memory usage

I have Centos 7 fresh install and I see setroubleshootd with high CPU usage. How can I fix this? What is this process doing?
5
votes
1answer
4k views

How to work out why Apache is attempting “execmem”?

I'm getting audit messages from SELinux saying that it denied Apache doing execmem: type=AVC msg=audit(05/06/16 19:51:43.058:181060) : avc: denied { execmem } for pid=123456 comm=httpd scontext=...
5
votes
4answers
3k views

Selinux is denying access to mysqld

I have a script that dumps a mysql database. It then compresses the file and this gets stored in my home folder by using cron. The problem is I seem to be getting an error message. mysqldump: ...
3
votes
1answer
43 views

Is there a way to specify file name using wildcards in selinux type_transition rules?

This kind of rules works perfect if filename matches exactly one specified at the end of rule, but not with wildcards. The star in the example below does not work. Well, actually it does, but it is ...
3
votes
1answer
884 views

GDM will not start on boot, unable to login into graphical interface

I am running RHEL 5.8 . SELinux is enabled but in permissive mode. Here are some snippets from /var/log/messages on boot. kernel: type=1400 audit(1360613500.551:6): avc: denied { write } for pid=...
1
vote
1answer
1k views

selinux started blocking php “exec” calls after yum update

I've used the PHP exec command to issue lpr -P printer_name /var/www/html/somefile.pdf but after a RHEL system update (7.2 to 7.3), selinux has decided to start blocking these requests. selinux ...
2
votes
1answer
51 views

How to create a SELinux policy module with existing output from audit2allow?

I know the standard way of creating a SELinux policy module, like cat <auditlog_file> | audit2allow -M <module_name> However, is there a way to create a policy module if all I have is ...
2
votes
1answer
134 views

How to troubleshoot Nginx permission denied in subdirectory?

I'm working on Fedora 29 Server. SELinux is in Enforcing mode. I'm having trouble getting Nginx to serve documents from a subdirectory below root. I need to know how to troubleshot it further because ...
2
votes
1answer
186 views

SELinux is preventing /usr/sbin/php-fpm from lock access on the file cert9.db

I have an selinux alert for the file /var/cache/nginx/.pki/nssdb/cert9.db., but I don't know what label I should give to it. The selinux report suggests hundreds of labels, but which is the correct ...
0
votes
0answers
255 views

Unable to restart Polkit service in Centos 7

I am unable to start nscd.service on centos 7 the error is polkit service is not running. Below is error. ** (pkttyagent:27796): WARNING **: Unable to register authentication agent: GDBus.Error:org....
2
votes
1answer
1k views

selinux is causing “nexus.service: Failed at step EXEC spawning /opt/nexus/bin/nexus: Permission denied” Fedora 26, nexus 3.06

After installing the latest version of nexus, currently 3.6.0, I'm able to start it by using the manual command /opt/nexus/bin/nexus start but when trying to start as a service (per directions ...
2
votes
2answers
1k views

how do i build / apply an selinux policy file, on redhat 7?

I'm trying to install RabbitMQ on Redhat Linux 7 (RHEL7). I followed the instructions on the RabbitMQ site, and it installed fine. However, it won't run because SELinux is preventing Erlang from ...
0
votes
1answer
192 views

Ansible modules copy/template errors for Linux 5 hosts using python26 ,python binding libselinux-python needed

We have some 50 odd linux 5 hosts, and to manage that we use ansible. Problem :- Ansible modules copy/template errors for Linux 5 hosts using python26 ,python binding libselinux-python needed ...
1
vote
0answers
184 views

Having issue with nscd.service in Centos 7. Error Failed to start Name Service Cache Daemon [closed]

I am running Centos 7 server. I am unable to start "nscd.service". Error shows "Failed to start Name Service Cache Daemon". Please provide me with solution?
1
vote
1answer
461 views

Altermime and SELINUX

I've setup an application called altermime (http://www.pldaniels.com/altermime/) for postfix (SMTP server) which alters emails midstream. I'm injecting a "X-ListUnsubscribe" header into every email ...
0
votes
0answers
55 views

After I enable SELinux, some devices node are unable to be accessed

I enable SELinux feature by configuring kernel (below shows what I changed): @@ -44,7 +44,10 @@ CONFIG_SYSVIPC=y CONFIG_SYSVIPC_SYSCTL=y # CONFIG_POSIX_MQUEUE is not set # CONFIG_FHANDLE is not ...
2
votes
1answer
23 views

How can I allow a given application to access a given folder and its content

I recently installed a game through Steam, but some of the assets of the game aren't loaded. After a few investigations on the web, the Windows users who had the same problem were adviced to turn off ...
1
vote
0answers
27 views

Running lightweight SELinux policy in production

I'd like to take advantage of SELinux ability to restrict a group of Linux processes. The group is unprivileged users with high enough UID (say, >1000). This I want to do on a shared hosting server, ...
1
vote
0answers
222 views

SELinux User Role Gotchas

New security policy mandates that system administrators on RHEL systems must be mapped to either sysadm_U or staff_u role and 'normal' users must be mapped to user_u roles. Previous to this we ...