The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

Filter by
Sorted by
Tagged with
2
votes
2answers
106 views

Real application of selinux [closed]

Almost all tutorial and most systems i have seen seem to disable selinux. Are there actual implementation of selinux security in real world ?
0
votes
0answers
133 views

“semanage port” command does not work

So, I was tasked to chagen SSH port in a CentOS server. As I did in the configuration file, the service failed to start, so after a little research I found that I should make some changes in selinux, ...
8
votes
1answer
203 views

Allow certain risky behaviour of a single program in a safe way in SELinux

I have a program running inside a Docker container that loads an .so file which alters the behaviour of the program through hooking and memory manipulation. This behaviour is blocked by SELinux with ...
1
vote
0answers
156 views

How to exclude a directory or partition on pmlogger scan?

As on the details below it look like that the cause of the problem is the pmlogger is spawning the find command. And its takes a long time for the find to scan all the files in one of my partition. ...
3
votes
0answers
273 views

Symbolic links do not allow SELinux type_transition

Trying to access symbolic link does not allow to use SELinux type_transition. I mean that I tried to implement scheme in which user has access to a symbolic link located in /usr/bin/ and which leads ...
1
vote
0answers
145 views

How to mount ecryptfs and preserve individual SELinux tag of underlying files?

I am trying to mount ecryptfs on a system that uses SELinux (e.g. Cent-OS), and I want to preserve the security tag of all individual underlying files. Using mount -o command I can set the security ...
2
votes
2answers
263 views

Selinux is blocking my external kernel module

I'm trying to insert an external kernel module in permanent mode. During the boot, my module is being loaded by systemd-modules-load service so long as Selinux is permissive. But I want to keep ...
-1
votes
2answers
139 views

SELinux is preventing $_POST variables on Amazon Linux 2

I began playing with RPM based OSes and I am really impressed. Amazon Linux doesn't include setroubleshoot in any of their repos. I want to use official repos for everything, otherwise I would ...
1
vote
1answer
304 views

In a custom module, is there a way to allow all permissions for files/directories?

I've written a custom selinux module that looks something like this: require { type my_app_t; type my_app_file_t; class file { getattr lock open read write execute execute_no_trans ioctl ...
4
votes
1answer
284 views

SELinux Interfering With sss_cache

System: HP Pavilion Power Laptop 15-cb0xx Intel i7-7700HQ w/ integrated graphics enabled (can't be turned off in bios) Fedora 28 NVIDIA GTX 1050 (mobile) I used the dnfdragora GUI to update about ...
1
vote
2answers
280 views

SELinux demands constant relabeling

I have installed SELinux on Ubuntu 18.04.1 LTS via # apt install selinux After the mandatory reboot, SELinux was constantly disabled until I added SELinux = 1 to /etc/default/grub and executed ...
0
votes
2answers
797 views

SELinux is preventing httpd from create access on the file

Whenever I upload a file via my web browser to my web sever, I see the following lines in /var/log/messages Nov 8 12:18:24 sn setroubleshoot: SELinux is preventing httpd from create access on the ...
0
votes
0answers
75 views

Why can't set my selinux status as enabled?

I had bought a vps ,installed centos7. rpm -qa | grep selinux libselinux-2.5-12.el7.x86_64 libselinux-utils-2.5-12.el7.x86_64 libselinux-python-2.5-12.el7.x86_64 No /etc/sysconfig/selinux and /etc/...
0
votes
1answer
247 views

How to run Java application in confined SELinux domain?

I am working with a Java app that has been labeled with its own SELinux type. Java executes it as unconfined_t instead of the labeled type. Java is labeled as bin_t (ls -Z /usr/lib/jvm/java-1.8.0-...
2
votes
0answers
163 views

Maintaining file's SELinux labels when copying them from one directory into another

Default behavior for copying files or sub-dirs from one directory to another is that the copied objects do not maintain their SELinux type (domain) which is opposite to objects which were moved. ...
1
vote
1answer
371 views

SELinux vs AppArmor applicability

I am going through some primers on LSM implementations so eventually I am digging a bit into AppArmor and SELinux. I am aware of this discussion but this does not make very clear one question I am ...
2
votes
1answer
74 views

Prevent Mount under Destination

I want to prevent all users (including root) from mounting anything under a specific destination (e.g. /tmp) by SELinux or any other Linux tool, is this possible? And how would it be done? Regarding ...
2
votes
1answer
167 views

How is SELinux loaded on boot?

I understand that a configuration file is in: /etc/selinux/config But how is it processed at boot? How does SELinux start, is it a daemon? Which startup script starts SELinux?
0
votes
1answer
460 views

How to extend SELinux policy to allow ntpd to use gps?

There is an attached device on the motherboard and the NTP service tries to read data from it (the attached device link is in /dev directory). Using SELinux enforcing, the service status errors that ...
2
votes
0answers
672 views

Yama LSM seems to do nothing. RHEL/Centos 7.5

The Yama security module is supposed to be able to prevent users from running the ptrace system call, yet even with kernel.yama.ptrace_scope set to 3, users can still run strace (which uses ptrace). ...
3
votes
1answer
200 views

Is it possible to prevent a change in SELinux status without a reboot?

I'd like to be able to prevent even a privileged user from changing the SELinux mode from enforcing to permissive without a reboot. It's too easy for a root user to run setenforce permissive, make ...
0
votes
1answer
343 views

CentOS Server file permissions

I am starting to learn server management with a CentOS Virtual Machine. I am trying to make a simple website. Because the Apache default file is in /var/www it is hard to write/make/change files. ...
1
vote
1answer
262 views

How to troubleshoot SELinux issues?

I suspect I have a problem in SELinux configuration: my issue goes away after disabling selinux using setenforce 0. I am using the default policy without any modifications. How can I pinpoint the ...
7
votes
1answer
671 views

What is the proper way to set SELinux context in an RPM .spec? (RHEL7 in 2018)

The RHEL7 supplied tomcat package supports multiple instances through the creation of directories and symlinks. Once such a multiple instance is created and packaged as an RPM, the extra instances ...
-4
votes
1answer
561 views

Temporarily disable SElinux [closed]

I want to temporarily disable SELinux on Centos 7. However, setenforce Permissive has no effect. # setenforce Permissive # sestatus SELinux status: enabled SELinuxfs mount: ...
-1
votes
1answer
258 views

SELinux - workaround using audit2allow?

I read carefully tutorial and got to explanations on using audit2allow which allows access for denied process. audit2allow tutorial After reading about audit2allow it seems that this tool can always ...
1
vote
1answer
204 views

I want allow user to execute *only* ping utility using SELinux

I did it already with rbash (restricted bash) but now I want to use SELinux. So I created new user and add him to guest_u: semanage login -a -s guest_u restricteduser also I forbid him to execute ...
1
vote
0answers
78 views

Are these SELinux messages suggestive of intrusion?

In the CentOS7 GUI, I have been seeing a smattering of messages such as: SELinux is preventing /usr/bin/smbd from getattr on the file ___. The files are for instance: /etc/default/grub /etc/rc.d/...
1
vote
1answer
750 views

SELinux Doesn't Switch to “Enforcing” Mode

I have a minimal CentOS 7.5.1804 (Core) system and trying to change SELinux mode from Disabled to Enforcing but when I tried to change mode using setenforce 1 command, I got an error message says: ...
0
votes
1answer
785 views

How to add exception in SELinux?

When SELinux is disabled, I have no issues, but when it's Enforced then I'm facing this [systemd] failed to get d-bus session: Failed to connect to socket /run/dbus/system_bus_socket: Permission ...
2
votes
2answers
145 views

Cannot list contents of directory with 0755 and owned by current user

The platform is a rooted Android 8.1 phone (Magisk) with the Termux Android terminal emulator and Linux environment app installed. I use this as a server on the go. After connecting a USB smart card ...
1
vote
1answer
154 views

Are both mitigations required when audit2allow suggests both restorecon and one type enforcement rule?

SELinux is permissive mode to help avoid operational issues during a transition to a new RHEL7 server deployment. Whilst some SELinux issues are fairly easy to review and resolve with a modicum of ...
0
votes
1answer
640 views

ssh_selinux_change_context: setcon failed with Invalid argument

I am trying to do ssh communication to an IP but I get the following error messages in logs. Jun 5 11:36:50 thetemplate my-sshd[26346]: Accepted password for user1 from 172.80.1.2 port 34278 ssh2 ...
1
vote
1answer
647 views

How do I get Brother printer drivers to work on Fedora?

I have two Brother printers : a QL-1050 label printer (USB-plugged) and an MFC-9330CDW (wifi). Both work fine with an Ubuntu laptop, but I struggle to get them to print under Fedora 28 (actually had ...
3
votes
1answer
1k views

restorecon does nothing on CentOS 7

On CentOS 7.5, Linux 3.10.0-862.3.2.el7.x86_64, I'm trying to understand how file contexts work. ls -Z, chcon and semanage seem to work as expected, but restorecon seems stubbornly silent. For ...
3
votes
2answers
114 views

Send email on SELinux violation

On my desktop I get a GNOME notification when an SELinux violation has occurred which makes debugging simple but for servers I do not have this. Is there any way I can set up SELinux so when there is ...
0
votes
2answers
910 views

SELinux blocks tomcat web application to load Java native library (JNI) from /tmp folder

I have a Centos 7 with Tomcat installed and tomcat user ls -l /var/lib/tomcat total 0 drwxrwxrwx. 5 root tomcat 84 Jul 3 13:18 webapps SELinux is enforcing and a Java web application which tries ...
2
votes
2answers
202 views

prohibit unconfined SELinux user (root) to install policy to a system

I am trying to write a SELinux policy which after its installation will prohibit for a unconfined (or another, which can be chosen) user any subsequent SELinux policy installation. It seems that there ...
1
vote
1answer
1k views

SELinux policy for Pi-Hole

I am running Fedora Server 28 for ARM on my Raspberry and during the installation of Pi-Hole I got a warning message about SELinux being set to 'Enforced' and that because of it I cannot use Pi-Hole's ...
1
vote
2answers
718 views

SELinux - How to avoid it preventing a process from write access on newly created files into folder

I'm hardly trying to correctly use selinux keeping it in enforced mode, but very often I encounter issues with it causing our application to work improperly. Our web application is java backend and ...
3
votes
1answer
1k views

Create a SELinux policy for a custom systemd service

I'm using Fedora Workstation 27 Live OS in which I want to run a custom service EnableBIOS.service along with OS boot. For this to work, I have to disable SELinux which is causing a problem in my ...
2
votes
2answers
2k views

Postfix and Apache: Permission denied on CentOS 7

I am setting up a CentOS 7 Server with Apache2, MySQL, PHP and Postfix (for sending emails over PHP) My problem at the moment is that I get the following error (at the error_log from Apache): ...
1
vote
1answer
225 views

Changing MySQL Temporary File - Permissions Error

At the moment, MySQL Server is using /tmp as it's temporary directory, and I'd like to change that, because it's running into storage issues. Following this post: https://encylia.com/2015/02/06/how-...
0
votes
0answers
73 views

Home dir of ftp user in /var/www

I am trying to make a web server with Centos 7, I am trying to give access to a certain user in the /var/www dir via ftp making that dir his home directory. I use vsftpd; this is my config file: ...
1
vote
1answer
103 views

SELinux denied clamscan to delete uploaded file on nginx server

On my nginx server, the uploaded files context are set as: -rw-rw-r--. nginx nginx system_u:object_r:httpd_sys_rw_content_t:s0 eicar.sh.pdf Right after upload, clamscan runs to verify the file using ...
2
votes
0answers
39 views

SELinux file permissions history [duplicate]

How can I see the history of file labels - who and when set them? Right now SELinux reports that my /etc/resolv.conf with content # Generated by NetworkManager is mislabeled. It is now unlabeled_t ...
1
vote
1answer
295 views

Cannot stop SELinux from blocking Apache accessing /usr/local/nagios/var/rw/nagios.cmd

I have a Centos 7 server running Nagios Core 4.3.4 with Apache 2.4.6 in our UAT environment. I have a second server in PROD that was set up with the same Ansible playbook. Nagios was built from ...
1
vote
1answer
202 views

Permissions on a folder stopping Nginx from starting

I am fairly new to Linux. I have a couple of websites that I want to host on my CentOS 7 VPS with Nginx. Nginx ought to start on start up, but it is failing due to some permissions issue, I know what ...
0
votes
2answers
2k views

chcon: can't apply partial context to unlabeled file

I get the following when trying to allow httpd to write to application specific directories. [xxx MISP]# chcon -t httpd_sys_rw_content_t /var/www/MISP/app/files chcon: can't apply partial context to ...
3
votes
1answer
552 views

What is map access in the context of SELinux

I am hitting an issue with SELinux where it tells me SELinux is preventing sh from map access on the file /bin/busybox. and then it tells me If you believe that sh should be allowed map access on ...