Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

Filter by
Sorted by
Tagged with
0
votes
1answer
716 views

Postfix unable to read ssl certs in default location due to SELinux policy on CentOS 6.7

I have installed and configured postfix to use ssl certifcates for sending external mail via a relay. This setup has worked on several other Ubuntu/Centos machines. I have my certificates in: /etc/...
1
vote
1answer
2k views

SELinux Prevents httpd Write Files

I recently setup a website on RHEL7. The SELinux is in Enforcing mode. However, whatever how I tune the context, it always prevents httpd from writing. Here is the audit.log: type=AVC msg=audit(...
3
votes
2answers
502 views

How do I dissect an SELinux SYSCALL message?

So, I have this trio of audit log entries type=AVC msg=audit(1488396169.095:2624951): avc: denied { setrlimit } for pid=16804 comm="bash" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:...
3
votes
0answers
729 views

SELinux prevents fstab auto mount

For a long time I have been running Fedora with disabled SELinux. Since it seems like SELinux is recommended to be running and in targeted mode for desktop use, I decided to enable it. I set it to ...
4
votes
1answer
62 views

How to use SELinux to reject applications' modifications to home directory?

I have grown to be annoyed by applications ignoring the XDG base directory specification. What's the best way to deny applications any changes to the home directory except in the specified ...
1
vote
0answers
53 views

Is it possible to add SELinux policy rule to restrict an application to a memory address range?

Is it possible to add SELinux policy rule to restrict an application to a specific virtual or physical memory address range? If so, which SELinux policy rule allows for a memory range to be specify? ...
21
votes
1answer
1k views

Are SELinux rules enforced before or after standard linux permissions?

When SELinux is installed on a system are its rules enforced before or after the standard linux permissions? For example if a non-root linux user tries to write to a file with linux permission -rw-----...
4
votes
1answer
460 views

Cannot attach to auto-started LXC containers in (Fedora) SELinux

Environment: I am running Fedora 24 with LXC (2.0.6) containers inside and SELinux enabled. Problem: Setting up Linux containers and starting them is all fine, and the same holds for attaching to a ...
7
votes
2answers
10k views

SELinux is preventing NGINX from writing via PHP-FPM

I'm using a server to write into a NFS type mount-point via NGINX using php-fpm. At the very first step, it shows me the following error: 2017/01/16 11:32:59 [error] 55463#0: *22 FastCGI sent in ...
0
votes
1answer
386 views

Does `mv --context` (for selinux, a.k.a. -Z) correctly apply labels recursively to directory contents?

mv -Z applies the default selinux context. Does it differ from all other invocations of mv, and work on all the files in a moved directory individually?
1
vote
1answer
1k views

Selinux on Fedora 25 is not letting me connect to a pptp vpn

I'm not currently in UK and I need to login to my free UK based Spotify account on Fedora 25, the country I'm in isn't supported by Spotify. I tried many free PPTP UK VPN services, they work on other ...
1
vote
1answer
3k views

How to disable all firewall rules and SElinux if runs on CentOS7

I try to connect a NIS server on CentOS 7.3 and a NIS client on raspbian 8.0 together. My problem is that raspbian does not want to bind the server. journalctl server the following entry: ...
0
votes
1answer
311 views

Cannot execute script after installing SELinux

I have script in /home/ubuntu/bin/ which I have added to the PATH variable. After installing SeLinux and enabling it in permissive mode it (SELINUX=permissive in/etc/selinux/config`), I am unable to ...
4
votes
1answer
39 views

How to change SELinux configuration persistently?

With setsebool <name_of_variable> <on/off> it is possible to change selinux configuration. However the changes are gone after reboot. How can we do these changes persistently?
2
votes
0answers
70 views

System-Level Network Security (Packet Classification and etc.) - SELinux and Libnftnl

I asked the same question in the Security forum, but since no respond did I get, I'm posting it here either. I read that Libnftnl is a userspace library providing a low-level netlink programming ...
5
votes
2answers
457 views

Different hash value of large rsynced file on centos and ubuntu?

I rsynced a large file from remote centos to local ubuntu with rsync -avzP user@<remote-ip>:/path/to/file . It reported the transfer went well: sent 30 bytes received 257,293,476 bytes 1,...
1
vote
0answers
206 views

Is it possible to enable an SELinux boolean in a policy module?

audit2allow creates fine-grained policy modules, but often hints that an existing boolean represents a superset of a policy line. For example: #!!!! This avc can be allowed using the boolean '...
0
votes
1answer
498 views

audit2allow asks for a path when setting up nginx

To setup nginx on centos7, I used to run: grep nginx /var/log/audit/audit.log | audit2allow -M nginxse and it worked fine, but apparently on an updated system, it is different. audit2allow complains:...
0
votes
1answer
1k views

How do I install and use Galera and MariaDB 10.1 on RHEL or CentOS with SELinux Enabled

How do I install and use Galera and MariaDB >= version 10.1 with TLS on RHEL 7 or CentOS 7 and keep SELinux enabled in enforcing mode without using SCL (software collections)?
4
votes
1answer
111 views

Is it possible to drop all write privileges in a shell for the current user

This is NOT for security purposes. Suppose I wanted to execute a shell script and, on a best effort basis, assume it left no side effects aside from things like auditd logging, avc reports, syslog, ...
1
vote
2answers
1k views

apache httpd is not able to connect to the internet

I run a Apache2 (httpd) server for Dokuwiki. Dokuwiki cannot use its upgrade or install plugin feature (see Question here). It seems that the user apache is not able to access the network/internet. ...
1
vote
1answer
124 views

How to limit ecryptfs access to a group of processes

I would like to have a script that does the following: Mounts an encrypted directory using ecryptfs Sets up permissions so that only a bash shell launched by it and any processes inheriting from ...
1
vote
3answers
69 views

How to design a mutiple level password security for one user

I am wondering if it was possible to have an enhanced version of PAM that implement a login with multiple level passwords. For instance, I am interesting requiring not 1 but 3 different passwords to ...
1
vote
1answer
262 views

SELinux: How do you create a custom label for files?

According to this link, how to create a custom SELinux label, they show that you can use sepolgen on /path/to/binary. But what if I'm not working on a binary? I want to make my directory to become a ...
1
vote
0answers
34 views

SELinux: How do you give access to only few processes to a /mnt/foo directory?

I am having so much trouble trying to make only very few processes allowed access for a specific mounted directory. Here are some of the questions for why I'm getting so lost. Assume that the mounted ...
1
vote
2answers
630 views

Why does “attr -l .” tell me about an “selinux” attribute that “attr -g selinux .” refuses to read?

I'm setting up a Fedora (Core) 24 system from scratch, and ran into this oddness: > sudo attr -l . Attribute "selinux" has a 41 byte value for . > sudo attr -g selinux . attr_get: No data ...
1
vote
1answer
1k views

selinux started blocking php “exec” calls after yum update

I've used the PHP exec command to issue lpr -P printer_name /var/www/html/somefile.pdf but after a RHEL system update (7.2 to 7.3), selinux has decided to start blocking these requests. selinux ...
0
votes
1answer
192 views

CentOS 7: Nesting SELinux rules

So, now that I've figured out that .ssh files need the ssh_home_t file context, now I need to figure out how to nest SELinux rules. My first problem is that I can't find any list of SELinux file ...
1
vote
1answer
813 views

Sharing / (root) Linux directory with Samba, CentOS 7

I'm using CentOS 7! I want to know if is possible share root / Linux directory. In root mode: # kwrite /etc/samba/smb.conf Here the line contents [global] workgroup = MyGroup server string = ...
1
vote
0answers
1k views

How do i add redis to selinux so that it's permissive?

I'm new to SELinux and CentOS, I have two vm's running a minimal centos7, I've configured firewall-cmd for the default redis port, but the only way I've been able to get the two vm's allowing redis to ...
7
votes
1answer
5k views

how to create a custom SELinux label

I wrote a service/single binary app that I'm trying to run on Fedora 24, it runs using systemd, the binary is deployed to /srv/bot this service/app I wrote needs to create/open/read and rename files ...
3
votes
1answer
1k views

systemd-nspawn OS container is unusable because I can't set the root password

I combined the detailed instructions from the original blog post, and the more up to date instructions from the man page (using dnf instead of yum). # sudo dnf -y --releasever=24 --installroot=$HOME/...
2
votes
0answers
353 views

SELinux: determine directory of denied file creation

Using SELinux, I got this AVC: type=AVC msg=audit(1472867145.344:215): avc: denied { create } for pid=2434 comm="google-chrome" name="63" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0....
2
votes
0answers
119 views

selinux user add becoming progressively slower

I've written a service that configures a machine with selinux users who can manage a single port. I'm trying to pre-seed that machine with 1000 users, but selinux is crawling to a halt around user ...
0
votes
1answer
257 views

Installing only a certain subpackage from src.RPM, Raspbian

Attempting to install setroubleshoot-server from source, as there are no ARM71 packages(error recieved from Alien rpm package installer when using arm7hl). Default compilation from an extracted src....
3
votes
2answers
976 views

SELINUX won't enable [closed]

I just checked to see if SELINUX was enabled on my server like this [root@fedora ~]# getenforce Disabled However, when I look at the /etc/selinux/config file I see this # This file controls the ...
0
votes
1answer
469 views

Hacking attempt, process running under 'apache' user

Our system blocked an hacking attempt coming from a local process running under the apache system user. Process not allowed. { "USER": "apache 16", "PID": "617", "%CPU": "0.0", "%MEM": "0.0 80", "...
2
votes
1answer
768 views

How does restorecon handle links?

I noticed that the rule /usr/sbin/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0) labels /usr/sbin/shutdown shutdown_exec_t when /usr/sbin is a directory. But it doesn't restore the ...
8
votes
4answers
7k views

What can go wrong if we disable selinux [closed]

We inherited a bunch of used servers from another team. Some of them have SELinux enabled on it, some do not. Because of SELinux, we are having trouble setting up passwordless ssh, our webserver, ...
6
votes
1answer
16k views

How to label a newly created file with “system_u”?

I just created a blank conf file for freetds and noticed that the permissions are wrong: [root@box etc]# touch freetds.conf.new [root@box etc]# ll -lZ freetds.conf* -rw-r--r--. root root system_u:...
2
votes
0answers
112 views

netutils_t cannot open initrc_tmp_t files

I'm running SELinux (in permissive mode) on RHEL 6.5 and seeing a strange denied error in my audit.log. Supposedly, the netutils_t process type can manage files labeled with the initrc_tmp_t type, but ...
1
vote
1answer
79 views

How nginx is able to access its default virtual host files when selinux is enabled?

From what I can tell, nginx is running in httpd_t security context, while index.html, for instance, is of usr_t one: $ ps auxZ | grep 'nginx.*worker' system_u:system_r:httpd_t:s0 nginx 13734 0....
1
vote
1answer
1k views

How to determine current SELinux context within a script

I'm trying to get an existing application running under SELinux which is causing endless pain. Matters would be eased somewhat if I knew what contexts the various components were running in - users ...
2
votes
2answers
5k views

SELinux issue Full path required for exclude: net:[4026532292]

I am trying to set samba context on directory with following command and I am not sure what this error is about but I can not set the context on directory. semanage fcontext -a -t samba_share_t "/...
0
votes
1answer
253 views

running apache on fedora/selinux/no setroubleshoot messages on desktop

I have installed fedora 24 installed from scratch via iso image. I have httpd started and can see the default page if I access "localhost". Now I want to add a directory which should contain files ...
1
vote
0answers
51 views

How can I protect SELinux labels from being modified?

I'm running Fedora 23. I have SELinux enabled and enforced. I know that you can change a file's labels with restorecon and chcon (and possibly other programs). This is no doubt an avenue by which a ...
2
votes
0answers
133 views

Restrict /proc/mounts to avoid exposure of /run/user/

EDIT: Currently looking at this solution.. (namespaces), but still wouldn't mind any pointers for doing what I'm after another way. We have a custom SELinux policy on CentOS 7.2 which confines users ...
1
vote
1answer
771 views

Use SELinux to restrict a directory to a particular user

I have a couple of questions: (Sysadmins tasks) Here is what I asked to do Create user Tim and add him to the supplementary group Webdev (Create the group if it doesn't exist), also Set Tim's ...
0
votes
1answer
2k views

selinux blocking vsftpd directory listing

I am trying to get a better understanding of selinux and configuring a local ftp repository on Centos7. I installed vsftpd on my host. I created a repository on my host: /var/ftp/pub/centos7 EFI ...
0
votes
1answer
705 views

Failed to start PostgreSQL 9.5 with systemctl - SELinux

I've installed PG 9.5 (/usr/pgsql-9.5/) and when I start it manually with postgres -D it has no problems, but if I try to use systemctl I get an error. By looking to journalctl -xen output, I see: /...