Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

Filter by
Sorted by
Tagged with
1
vote
1answer
156 views

How to view SELinux config file

OS: CentOS 7.4.1708 I'm testing SELinux but I can't figure out how to open the config file to view it. I'm sure this is simple but nothing seems to work. How do I do this? Attempt 1) I navigated ...
0
votes
4answers
945 views

Can I restrict a user with root privileges(with sudo) from accessing/deleting a specific file?

I want to keep a log-file on my computer. I also want to give privileges to a different account to do all sorts of system specific jobs such as mount volume/install packages etc. So that user has to ...
4
votes
1answer
539 views

How to install SELinux policy manpage?

How to install the manpage httpd_selinux on CentOS 7.4? It's not included in the packages httpd, httpd-tools, or httpd-manual. A yum whatprovides "*/httpd_selinux" search returned no results. (...
0
votes
0answers
1k views

systemctl throws error Error getting authority: Error initializing authority:

After upgrading from RHEL7.3 to 7.4 in VM and running systemctl disable xinetd command gives me the following error: Error getting authority: Error initializing authority: GDBus.Error:org.freedesktop....
5
votes
1answer
7k views

Core difference between SELinux and Apparmor

What is the core [or kernel level] difference of SELinux and Apparmor?
1
vote
1answer
3k views

Semanage command not found in Fedora 27 droplet from Digital Ocean

Just getting started with Selinux on a Fedora 27 droplet from Digital Ocean. Apparently the semanage command is not installed by default. Every tutorial I've read refers to this command. I need to set ...
2
votes
1answer
416 views

SELinux woes developing systemd extension

All, I'm developing a modification to systemd that will extend systemd-sleep to support calling user-defined scripts on suspend, hybrid-sleep, etc. similar to systemd-sleep. This is working quite ...
0
votes
1answer
198 views

Sanest/safest way to allow root-owned/run script to access file in /root under selinux

I have an autofs program-based map which I wrote, which auto-mounts CIFS shares, taking credentials from a file which is located within the ~/.smb folder of any given user. There can be multiple ...
2
votes
1answer
1k views

selinux is causing “nexus.service: Failed at step EXEC spawning /opt/nexus/bin/nexus: Permission denied” Fedora 26, nexus 3.06

After installing the latest version of nexus, currently 3.6.0, I'm able to start it by using the manual command /opt/nexus/bin/nexus start but when trying to start as a service (per directions ...
0
votes
1answer
116 views

Security mechanisms of Debian and CentOS [closed]

Are SELinux, FirewallD and Iptables preinstalled on Debian - Stretch (9 or 9.2) and CentOS (7.4-1708), or do I have to manually install them? Or where can I find it out? Thanks for all your answers.
1
vote
1answer
92 views

compgen and SELinux

I have an app, browser shell and I'm executing this command to get list of execuables (List all binaries from $PATH) compgen -A function -abck | sort | uniq and when I call this command It return ...
-2
votes
1answer
96 views

Is there a MAC for Linux that can stop a process on policy violations?

Is there a MAC that can SIGSTOP a process on policy violations so I can resume it with an updated policy to retry the syscall? This would be very handy in case of running interactive untrusted ...
0
votes
1answer
407 views

How to compile and apply SELinux policy

I'm student. I want to use the policy compiled from the source code. After compiling the policy, the following error statement is displayed. Please tell me how to compile and apply SELinux policy. ...
5
votes
2answers
4k views

Configure SELinux to allow daemons to use files in non-default locations

I have a daemon (apache/samba/vsftpd/...) running on SELinux enabled system and I need to allow it to use files in a non-default location. The standard file permissions are configured to allow access. ...
1
vote
0answers
503 views

Selinux is blocking clamd to open new ports for each Thread

SElinux Enforced on CentOS7 is blocking again clamAV on scanning file operations. Some months ago, I encountered the same issue which I posted here, which at the end I solved doing the following ...
4
votes
1answer
3k views

Cannot change permissions as root on a file owned by root

The problem is that I have PHP files that do not work in the browser. I suspect because the user is missing read permissions. The files are located in a dir called "ajax" drwxrwxrwx. 2 root root ...
2
votes
1answer
2k views

Sharing a mounted drive with samba on CentOS7

CentOS 7, samba issue: 0 Files/Folders when trying to share USB drive with EXT4 file system. Samba Configuration file: [global] workgroup = WORKGROUP server string = Samba Server %v netbios name = ...
2
votes
2answers
390 views

Spacewalk Install failed selinux

Hi I am trying to configure spacewalk on a Centos 7 box for my organization. I am following this guide; https://github.com/spacewalkproject/spacewalk/wiki/HowToInstall#installing-spacewalk I am ...
5
votes
1answer
794 views

Apache can't open file that is a symlink

I have a file: js/jquery.terminal-src.js: symbolic link to ../../repo/js/jquery.terminal-src.js and when I try to open it with browser using: http://localhost/projects/jcubic/terminal/test/js/...
0
votes
1answer
550 views

SELinux does not allow ps command in PHP

I use this piece of code to check if myservice is running in php. exec("ps -A | grep -i myservicename | grep -v grep 2>&1", $output);. $output is always empty. But after executing setenforce 0 ...
4
votes
1answer
1k views

SELinux and docker: allow access to X unix socket in /tmp/.X11-unix

How to allow access to a particular X unix socket for a particular docker container with SELinux enabled? I prefer a solution with a setup of docker run --security-opt. On fedora 25, I found the ...
1
vote
3answers
3k views

ping: socket: Permission denied

We are developing an admin UI for our product in PHP. It is hosted on Centos 7 and Apache web server. User should be able to ping an IP address using this UI. So we need to call exec(IPAddress) in PHP ...
1
vote
2answers
37 views

Give process permission to only a specific range of local ports

I am looking for a way to prevent a specific process from binding to anything outside of a specific range of local ports. Lets say localhost:50000 - localhost:50050 is an allowed range. I am NOT ...
2
votes
1answer
64 views

Running X without Access to /dev

I am trying to run X on an unrooted Moto Z Play. For that I installed GNURoot which is running a limited version of Debian. One of the limits is that I can't access /dev. This causes startx and also ...
0
votes
1answer
326 views

How to allow apache to serve a file written by rsyslogd (selinux)

I have a an application which is run as a systemd service on RHEL7 that makes use of the system journal for logging. To ease monitoring of this application I have configured rsyslogd to write logs ...
1
vote
1answer
2k views

SELinux prevents running command when using systemd on Fedora 25

I'm trying to run OpenVPN on a network namespace myns through systemd on Fedora 25. It looks like SELinux is preventing it from working. Looking at journalctl -xe, I think this is the relevant part: ...
2
votes
2answers
64 views

Why does selinux deny starting services from default_t?

A new top-level directory was created, gaining the default label for new top-level directories, default_t. SELinux denies starting a service if ExecStart is a program created in a new top-level ...
1
vote
1answer
32 views

SELinux alert: Why is the start chopped off the process name?

I have a service hdparm-noapm.service with ExecStart=/ansible-managed/sourcejedi.hdparm-noapm/hdparm.sh. Thanks to SELinux, it is denied. The SELinux error popup (sealert) says The source process: (...
4
votes
1answer
1k views

SELinux File Context, restorecon doesn't change 'user' Context

Using matchpathcon against a file (e.g. /usr/lib64/gconv/gconv-modules.cache) I get: /usr/lib64/gconv/gconv-modules.cache system_u:object_r:lib_t:s0 However: # ls -alZ /usr/lib64/gconv/gconv-...
1
vote
0answers
195 views

SELinux Block Apache [closed]

I got this error message on audit.log : type=AVC msg=audit(1499174880.632:7148): avc: denied { execute } for pid=49368 comm="httpd" name="phantomjs" dev="dm-11" ino=692068 scontext=system_u:...
0
votes
1answer
295 views

Selinux - Looking for some policy that is blocking clamd to open new ports for each Thread

Trying to keep SElinux Enforced on CentOS and allowing clamAV to scan files. But it seems that SElinux does not like the following behavior of clamd: Clamd is listening on a predefined TCP port ...
3
votes
1answer
706 views

How to setup recent stable SELinux policies in Debian 8.7?

I am following the step 12 of the guide here, but did not find any policies that are recent and stable, only "old" things there and unstable. Code and output masi@masi:~$ apt search SELinux | grep ...
0
votes
1answer
1k views

SELinux is preventing /usr/bin/bash from execute access on the file myfilename.sh in nginx via php-fpm

Background: I have two CentOS7 servers. Test & Prod. There is a script myfilename.sh in my website, which is executed in php by shell_exec. Script and all parent folders in both servers have ...
1
vote
0answers
223 views

SELinux User Role Gotchas

New security policy mandates that system administrators on RHEL systems must be mapped to either sysadm_U or staff_u role and 'normal' users must be mapped to user_u roles. Previous to this we ...
0
votes
2answers
1k views

Installed SELinux on Ubuntu 14.04 and system is not bootable now

I was trying to learn a bit about SELinux on my Ubuntu 14.04 and did not realize that it already had AppArmor which SELinux un-installs during its own installation process. I installed two packages ...
1
vote
1answer
247 views

How to upgrade sudo from 1.8.19p1-1 to 1.8.19p1-2 on debian Stretch to avoid the “ Potential overwrite of arbitrary files” flaw?

I have the sudo 1.8.19p1-1 installed on debian Stretch. I need to install the 1.8.19p1-2 to avoid the Potential overwrite of arbitrary files flaw. Package Type Release Fixed Version ...
0
votes
1answer
59 views

Two Linux Installs Two Swap Spaces

I have two linux installs on my computer. Linux Mint 18 for general use and Subgraph OS because I think the concept sounds cool. I also have a Windows 10 partition for playing games that require ...
3
votes
1answer
136 views

How to access only world readable files in SElinux sandbox

I want to run programs made as student assignments in an SELinux sandbox (to check output and behaviour as a first part of grading the assignments without having to check very closely if some students ...
2
votes
1answer
121 views

Is listening-on connecting-to the same for SELinux?

According to semanage-port(1) ... -a does the same as --add -t does the same as --type -p does the same as --port and the command semanage port -a -t http_port_t -p tcp 81 allows Apache to LISTEN ...
6
votes
1answer
5k views

Which SELinux policies apply to haproxy?

I just bumped into another SELinux related problem. It would seem my haproxy wasn't allowed to open TCP connections to the backend and I was able to fix it quickly using Google. Now, I would like to ...
1
vote
0answers
553 views

Can't access SFTP with SELinux enabled

I've setup SFTP on CentOS 6.8. I've enabled SELinux, but I can't login using SFTP. I get a permission denied message. I did setsebool -P ssh_chroot_rw_homedirs on but didn't work and I'm still ...
1
vote
0answers
338 views

What do the dark colored packages mean in dnf list output? [closed]

I want to install an older version of selinux in order to install nvidia driver, dnf list shows there is an old package 3.13.1-225.11.fc25, how can I install that ? I tried dnf install selinux-policy-...
1
vote
1answer
740 views

SELinux domain_auto_trans() [closed]

I am trying to get information on domain_auto_trans() function in SELinux. I tried to look in SELinux webpages, but couldn't find a clear definition of the function and its syntax. Can someone please ...
4
votes
1answer
2k views

Cannot disable SELinux in RHEL 7 [closed]

I'm trying to disable SELinux in a rhel7 env installed on aws ec2 instance. I edited the /etc/selinux/config file and set SELINUX=disabled and then I rebooted the system. after the reboot I ran ...
9
votes
2answers
1k views

SELinux not allowing oddjobd-mkhomedir to create user home directory on a non-standard location

We are using SSSD to authenticate users on CentOS servers. oddjobd-mkhomedir works perfectly fine when the default home directory is /home, but on a particular server, we had to change default home ...
1
vote
1answer
231 views

Force set a string as an SELinux context of a file

I wonder if it's possible to force set a given string (e.g. u:object_r:blah_blah_blah:s0) as the SELinux context of a file. Basically I'm going to root an Android x86 installation by placing files ...
6
votes
1answer
8k views

How to copy SELinux context from one directory and apply it to another directory?

How can I copy SELinux context from one directory and apply it to another? Example use scenario is when creating a new local user outside of the default /home path, like this: $ sudo useradd -d /...
0
votes
1answer
501 views

Apache 2.4 can't read user content even with correct security context and booleans set

I have a user's home directory at /data/test_user. I am using indexing to allow browsing this directory via web browser with Apache 2.4. However, all of a sudden I'm getting an issue where I can't see ...
1
vote
2answers
751 views

SELINUX_ERR op=security_bounded_transition

So, a vendor who really doesn't know *nix has a service manager and agent for Red Hat family hosts. (That is to say, the vendor isn't any help, here.) On Oracle Linux 7 with SELinux Enforcing, I can ...
1
vote
1answer
559 views

Create custom SELinux file context/type from CIL

I'd like to create a new context from my SELinux module (written using the CIL syntax) that will then beu sed for my application's log file so logrotate can access it. However, when I try to semodule -...