Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

120 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
1answer
290 views

Sandboxing a binary on linux

I am trying to understand various options I have to restrict/sandbox a binary in Linux. I see that I can use namespaces and cgroups like docker does. I could use SELinux like this link suggests. Which ...
5
votes
2answers
1k views

SELinux is preventing /opt/google/chrome/chrome-sandbox from write access on which file?

I keep getting the following error ever since upgrading to Chrome google-chrome-stable-42.0.2311.90-1.x86_64. SELinux is preventing /opt/google/chrome/chrome-sandbox from write access on the file ...
5
votes
1answer
996 views

selinux, dovecot and sieve

I've just started learning to configure SELINUX and this morning on my CentOS 6.4 x64 system, with postfix/dovecot/mysql installed, I woke up to the following selinux issue found 1 alerts in /var/log/...
4
votes
1answer
466 views

Cannot attach to auto-started LXC containers in (Fedora) SELinux

Environment: I am running Fedora 24 with LXC (2.0.6) containers inside and SELinux enabled. Problem: Setting up Linux containers and starting them is all fine, and the same holds for attaching to a ...
4
votes
1answer
111 views

Is it possible to drop all write privileges in a shell for the current user

This is NOT for security purposes. Suppose I wanted to execute a shell script and, on a best effort basis, assume it left no side effects aside from things like auditd logging, avc reports, syslog, ...
4
votes
1answer
2k views

How to create an SELinux exception for individual files

I use a monitoring tool and on one of my systems that is checked remotely, it calls up a script, which in turn runs systemctl to check the status of a service. This was not working until I put SELinux ...
4
votes
0answers
338 views

Relocation in a docker volume: svirt_sandbox_file_t and texrel_shlib_t

I run a Docker container with a volume that contains a executable and shared library which requires relocation. I get: error while loading shared libraries: /opt/J9/bin/libj9thr24.so: cannot restore ...
4
votes
1answer
2k views

SSH AuthorizedKeysCommand and SELinux

I'm trying to use the SSH AuthorizedKeysCommand in a CentOS 6.5 machine, but I'm encountering an SELinux error. When I switch SELinux to permissive mode - using setenforce 0 - it works, but when I ...
4
votes
1answer
6k views

SELinux - allowing rsyslog open/read access to some files

So I've got three files I need rsyslog to open in order to forward the entries to another server. SELinux is preventing this with the following error: type=AVC msg=audit(1371186588.768:1324460): avc:...
3
votes
0answers
212 views

Symbolic links do not allow SELinux type_transition

Trying to access symbolic link does not allow to use SELinux type_transition. I mean that I tried to implement scheme in which user has access to a symbolic link located in /usr/bin/ and which leads ...
3
votes
0answers
735 views

SELinux prevents fstab auto mount

For a long time I have been running Fedora with disabled SELinux. Since it seems like SELinux is recommended to be running and in targeted mode for desktop use, I decided to enable it. I set it to ...
3
votes
1answer
884 views

GDM will not start on boot, unable to login into graphical interface

I am running RHEL 5.8 . SELinux is enabled but in permissive mode. Here are some snippets from /var/log/messages on boot. kernel: type=1400 audit(1360613500.551:6): avc: denied { write } for pid=...
2
votes
1answer
23 views

How can I allow a given application to access a given folder and its content

I recently installed a game through Steam, but some of the assets of the game aren't loaded. After a few investigations on the web, the Windows users who had the same problem were adviced to turn off ...
2
votes
0answers
50 views

Change SE Linux context label of a specific folder inside a cifs mount

have cifs mount on my setup mounted via /etc/fstab with context set to system_u:object_r:cifs_t:s0. There are some specific folders that I want to override default context to set public_content_t so I ...
2
votes
0answers
252 views

User account mapped to SELinux staff_u account but unable to run sudo command

I have two user accounts in my virtual machine, anim and anim2. Both are part of the wheel group and can run su/sudo commands. I was reading on redhat how SELinux user staff_u can only run sudo ...
2
votes
0answers
138 views

Maintaining file's SELinux labels when copying them from one directory into another

Default behavior for copying files or sub-dirs from one directory to another is that the copied objects do not maintain their SELinux type (domain) which is opposite to objects which were moved. ...
2
votes
0answers
511 views

Yama LSM seems to do nothing. RHEL/Centos 7.5

The Yama security module is supposed to be able to prevent users from running the ptrace system call, yet even with kernel.yama.ptrace_scope set to 3, users can still run strace (which uses ptrace). ...
2
votes
2answers
180 views

prohibit unconfined SELinux user (root) to install policy to a system

I am trying to write a SELinux policy which after its installation will prohibit for a unconfined (or another, which can be chosen) user any subsequent SELinux policy installation. It seems that there ...
2
votes
1answer
456 views

How to identify dac_override cause on Android?

I am working on some Android customizations and an app I am writing causes a dac_override which looks like so in dmesg: type=1400 audit(499405.329:16): avc: denied { dac_override } for pid=1103 comm=...
2
votes
1answer
1k views

selinux is causing “nexus.service: Failed at step EXEC spawning /opt/nexus/bin/nexus: Permission denied” Fedora 26, nexus 3.06

After installing the latest version of nexus, currently 3.6.0, I'm able to start it by using the manual command /opt/nexus/bin/nexus start but when trying to start as a service (per directions ...
2
votes
0answers
70 views

System-Level Network Security (Packet Classification and etc.) - SELinux and Libnftnl

I asked the same question in the Security forum, but since no respond did I get, I'm posting it here either. I read that Libnftnl is a userspace library providing a low-level netlink programming ...
2
votes
0answers
353 views

SELinux: determine directory of denied file creation

Using SELinux, I got this AVC: type=AVC msg=audit(1472867145.344:215): avc: denied { create } for pid=2434 comm="google-chrome" name="63" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0....
2
votes
0answers
119 views

selinux user add becoming progressively slower

I've written a service that configures a machine with selinux users who can manage a single port. I'm trying to pre-seed that machine with 1000 users, but selinux is crawling to a halt around user ...
2
votes
0answers
114 views

netutils_t cannot open initrc_tmp_t files

I'm running SELinux (in permissive mode) on RHEL 6.5 and seeing a strange denied error in my audit.log. Supposedly, the netutils_t process type can manage files labeled with the initrc_tmp_t type, but ...
2
votes
0answers
133 views

Restrict /proc/mounts to avoid exposure of /run/user/

EDIT: Currently looking at this solution.. (namespaces), but still wouldn't mind any pointers for doing what I'm after another way. We have a custom SELinux policy on CentOS 7.2 which confines users ...
2
votes
0answers
184 views

Benchmarking under SELinux Sandbox with Phoronix Test Suite

I would like to run the Phoronix Test Suite 6.2.2 under the SELinux sandbox on Fedora 23, but I can't execute it using $ sandbox ./phoronix-test-suite. I probably don't have the correct SELinux type. ...
2
votes
1answer
63 views

Adding fcontext to unconfined application

This feels like the most horrid twist of fate ever... A user is having me setup tomEE (apache-tomee-jaxrs-1.7.4). This is on a RHEL6 machine. I've installed from the tarball available from apache's ...
2
votes
0answers
518 views

Unable to emerge SystemD on Hardened/SELinux

I'm on the hardened/linux/amd64/selinux profile on a recent Stage 3 of Gentoo amd64. I'm trying to install SystemD, and I see the following: > emerge -aq sys-apps/ The following mask changes are ...
2
votes
1answer
869 views

Cannot execute semanage fcontext --add under Fedora 21 using policy targeted

I cannot add a file contexts to the running SELinux policy using semanage under Fedora 21. When executing the semanage fcontext --add command, I receive an OSError: mf@vienna ~ % sudo semanage ...
2
votes
0answers
186 views

What is SELinux's regex type?

I'm trying to locate all files on my system matching an SELinux file context (fcontext). These contexts are specified using some regex, and I'd like to use find -regex ... to the same effect. However, ...
2
votes
1answer
420 views

SELinux Enforcing is preventing logging into another user account?

I am using Debian 6 with SELinux enabled. After enabling "enforcing" mode in SElinux, I have tried to login into another user account by 'login' command. But, I have been restricted by selinux. ...
2
votes
0answers
176 views

Acpid event denied by SELinux, how can I savely allow the event without opening security holes?

I installed Fedora (3.17.2-200.fc20.x86_64) on my new Notebook (Lenovo Yoga Pad) and wanted to add this script to trigger whenever I flip over my screen. The script triggered whith the event is ...
2
votes
0answers
656 views

After enabling SELinux (permissive mode) on Debian Wheezy, gdm3 does not finish loading

I recently enabled SELinux on my Debian Wheezy system, in permissive mode (I have confirmed that it is indeed operating in permissive mode). However, after the file labelling double-reboot, gdm3 doesn'...
2
votes
1answer
5k views

What's missing with my SELinux installation?

According to Introduction to SELinux, section 14.4.2, SELinux support is built into the standard kernels provided by Debian. The core Unix tools support SELinux without any modifications. I have ...
2
votes
0answers
1k views

How does SELinux / SEAndroid prevent or allow pseudo terminal allocation?

I'm trying to resolve an SSH connection issue on an Android phone running SELinux in "Enforcing" mode. The problem is that any SSH connection that tries to allocate a pseudo-terminal (/dev/pts etc) is ...
2
votes
0answers
662 views

How to do restorecon -f recursively?

I have tried both with a file and using standard input, and it seems it is impossible to get restorecon -r -f [file|-] to do anything at all. Is this possible?
2
votes
2answers
433 views

403 Forbidden on Sub-Folders

I decided to do a LAMP install to start getting more familiar with it (as our company is moving more towards nix these days). Everything went great and PHPMyAdmin, MySQL, Apache/PHP all seem to be ...
1
vote
0answers
21 views

How to run single application in permissive mode and remaing all in enforcement mode for SEAndroid?

I want to allow single application to run in permissive and keep enforcing mode for all other applications in SEAndroid. How to do this?
1
vote
1answer
41 views

How to disable dontaudit denials in SEAndroid

My application is working in permissive mode, but not in Enforcing mode for SEAndroid. Here i cleared (allowed) all denials,so now there is no denial logs coming in my logcat logs.So it might be ...
1
vote
0answers
28 views

Running lightweight SELinux policy in production

I'd like to take advantage of SELinux ability to restrict a group of Linux processes. The group is unprivileged users with high enough UID (say, >1000). This I want to do on a shared hosting server, ...
1
vote
0answers
25 views

What combination of labels to use to let NGINX connect to socket in /home/user?

I'm running a uwsgi app that creates a unix socket in /home/user/myapp.sock and nginx has been given the right permissions to access the file, however, selinux isn't letting me connect to it: avc: ...
1
vote
0answers
116 views

How to exclude a directory or partition on pmlogger scan?

As on the details below it look like that the cause of the problem is the pmlogger is spawning the find command. And its takes a long time for the find to scan all the files in one of my partition. ...
1
vote
0answers
129 views

How to mount ecryptfs and preserve individual SELinux tag of underlying files?

I am trying to mount ecryptfs on a system that uses SELinux (e.g. Cent-OS), and I want to preserve the security tag of all individual underlying files. Using mount -o command I can set the security ...
1
vote
2answers
214 views

SELinux demands constant relabeling

I have installed SELinux on Ubuntu 18.04.1 LTS via # apt install selinux After the mandatory reboot, SELinux was constantly disabled until I added SELinux = 1 to /etc/default/grub and executed ...
1
vote
1answer
139 views

I want allow user to execute *only* ping utility using SELinux

I did it already with rbash (restricted bash) but now I want to use SELinux. So I created new user and add him to guest_u: semanage login -a -s guest_u restricteduser also I forbid him to execute ...
1
vote
0answers
74 views

Are these SELinux messages suggestive of intrusion?

In the CentOS7 GUI, I have been seeing a smattering of messages such as: SELinux is preventing /usr/bin/smbd from getattr on the file ___. The files are for instance: /etc/default/grub /etc/rc.d/...
1
vote
0answers
188 views

Changing MySQL Temporary File - Permissions Error

At the moment, MySQL Server is using /tmp as it's temporary directory, and I'd like to change that, because it's running into storage issues. Following this post: https://encylia.com/2015/02/06/how-...
1
vote
0answers
484 views

SELinux is preventing /usr/sbin/abrtd from create access on the lnk_file .lock

I am getting this error on my CentOS 7 desktop. Following is the detailed log. SELinux is preventing /usr/sbin/abrtd from create access on the lnk_file .lock. ***** Plugin catchall (100. confidence)...
1
vote
0answers
26 views

Satellite 5.7 (Spacewalk 2.3.2) not allowing scripts to be run from upload

I'm trying to make my Satellite 5.7 server installation more secure. I'd like to turn off the function to run scripts from https://mysatserver/pub/upload/up without breaking Satellite. The dir looks ...
1
vote
0answers
188 views

Apache DBD with sqlite3

I'm trying to make apache load basic auth credentials from a sqlite3 database. The configuration I've tried (and many other variations) is: <VirtualHost *> ServerAdmin admin@example.com ...