Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

Filter by
Sorted by
Tagged with
47
votes
6answers
197k views

How to disable SELinux without restart?

I need to disable SELinux but cannot restart the machine i followed this link where i get bellow command setenforce 0 But after running this command i checked for that sestatus SELinux status: ...
25
votes
4answers
85k views

httpd can't write to folder/file because of SELinux

Does anyone know which sebool it is to allow httpd write access to /home/user/html? When I disable SELinux echo 0 > /selinux/enforce I can write, so my problem is definitely related to SELinux. I ...
21
votes
1answer
1k views

Are SELinux rules enforced before or after standard linux permissions?

When SELinux is installed on a system are its rules enforced before or after the standard linux permissions? For example if a non-root linux user tries to write to a file with linux permission -rw-----...
20
votes
3answers
6k views

Myth or reality: SELinux can confine the root user?

I read or heard somewhere (maybe in LinuxCBT's SELinux course; but I'm not sure) that there are online Linux servers, for which the password of the root user is also given. The Linux server is ...
20
votes
2answers
8k views

What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?

I am planning to go back to Linux as a Desktop machine. I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server. What would be a good, ...
17
votes
2answers
4k views

Does SELinux provide enough extra security to be worth the hassle of learning/setting it up?

I recently installed Fedora 14 on my home pc and have been working on setting up different server related features such as apache, mysql, ftp, vpn, ssh, etc. I ran extremely quickly in to a barrier ...
16
votes
3answers
12k views

What roles do DAC (file permissions), ACL and MAC (SELinux) play in Linux file security?

I need some clarification/confirmation/elaboration on the different roles DAC, ACL and MAC play in Linux file security. After some research from the documentation, this is my understanding of the ...
13
votes
1answer
4k views

What is the proper way to set SELinux context in an RPM .spec?

I am trying to build an RPM that targets RHEL4 and 5. Right now I call chcon from %post but multiple Google entries say "that's not how you are supposed to do it" with very limited help on the right ...
12
votes
3answers
385 views

Prompt user on Linux security denial

Is it possible to make a Linux security module (eg. AppArmor, SELinux etc.) prompt the user, when an application wants to access classified files or folders (digital signatures, SSH keys, credit card ...
11
votes
8answers
5k views

How to prevent a process from writing files

I want to run a command on Linux in a way that it cannot create or open any files to write. It should still be able to read files as normal (so an empty chroot is not an option), and still be able to ...
10
votes
1answer
24k views

How do I configure SELinux to allow outbound connections from a CGI script?

I'm migrating to a new webserver which has SELinux set up (running Centos 5.5). I've got it set up so that it can execute CGI scripts with no problem, but some of the older Perl based scripts are ...
9
votes
2answers
24k views

SELinux httpd write access to a directory

I am new to SELinux. came from debian. I want to give httpd access to a directory. SELinux Alert Browser suggests: # grep httpd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp ...
9
votes
5answers
29k views

openvpn[]: Options error: In [CMD-LINE]:1: Error opening configuration file

when trying to service openvpn start Oct 12 14:02:01 ccushing1 openvpn[9091]: Options error: In [CMD-LINE]:1: Error opening configuration file: devnet-client-vm.conf running openvpn devnet-client-vm....
9
votes
3answers
33k views

chcon: can't apply partial context to unlabeled file '/usr/sbin/xrdp'

Whenever I'm trying to execute this line to configure SELinux to install xrdp from this tutorial: # chcon --type=bin_t /usr/sbin/xrdp # chcon --type=bin_t /usr/sbin/xrdp-sesman I get these errors: ...
9
votes
2answers
4k views

Make all SELinux contexts permanent

I've done a lot of chcon-ing lately,but if I understand it correctly, these will be erased on the next relabel. Is there any way to make the current contexts (preferably just under a certain directory)...
9
votes
2answers
4k views

LXC containers as a sandbox environment

I am currently starting a project evaluating untrusted programs (student assignments) in a secure sandbox environment. Main idea is to create a web app for GlassFish and Java wrapper around lxc-utils ...
9
votes
2answers
2k views

What is the best way to learn SELinux? [closed]

I want to learn SELinux to a high level, being able to understand the intricacies of domains, types and switching. What is the best way to go about this? I considered starting with Fedora and a good ...
9
votes
1answer
5k views

How to understand the security context in “ls -Z”?

After referring "man ls", it shows "ls -Z" can display the security context: -Z, --context Display security context so it fits on most displays. Displays only mode, user, group, security ...
9
votes
2answers
1k views

SELinux not allowing oddjobd-mkhomedir to create user home directory on a non-standard location

We are using SSSD to authenticate users on CentOS servers. oddjobd-mkhomedir works perfectly fine when the default home directory is /home, but on a particular server, we had to change default home ...
9
votes
1answer
23k views

chcon: can't apply partial context to unlabeled file while installing nagios with SELinux

I'm setting up Nagios core on CentOS with SELINUX=enforcing. I try to run chcon -R -t httpd_sys_content_t /usr/local/nagios/sbin/ as suggested in the manual, but I get this error messages: chcon: ...
9
votes
1answer
487 views

Wrong role and type on login

I'm on an Ubuntu 14.04 derivative, elementary OS Freya. I have installed and configured SELinux using the selinux-policy-default package, which contains a lot of modules. I've also added my user to ...
9
votes
1answer
5k views

What is the safe way to allow Java 7 to run on SELinux

Short version: What is the most secure way to allow Java 7 to run on (with?) SELinux? Long version: Sorry in advance if I use incorrect terminology. I'm really just a Java developer with a meager ...
8
votes
4answers
7k views

What can go wrong if we disable selinux [closed]

We inherited a bunch of used servers from another team. Some of them have SELinux enabled on it, some do not. Because of SELinux, we are having trouble setting up passwordless ssh, our webserver, ...
8
votes
1answer
8k views

Permission errors even though permissions are wide open

I installed anaconda on our new VM and I can't list its contents. I can change my directory to .../anaconda/ but when I type ls -l I get: ls: cannot open directory .: Permission denied However, when ...
8
votes
1answer
7k views

Why setsebool command of SELINUX taking so long and slow?

I have noticed the command setsebool take longer time than other linux commands. Such as: setsebool -P ftp_home_dir ON Out of curiosity I want to know why "setsebool" command needs such a long time ...
8
votes
1answer
179 views

Allow certain risky behaviour of a single program in a safe way in SELinux

I have a program running inside a Docker container that loads an .so file which alters the behaviour of the program through hooking and memory manipulation. This behaviour is blocked by SELinux with ...
8
votes
2answers
3k views

Hide processes from other users based on groups (under Linux)?

Is it possible to configure process hiding for certain user groups under a linux system? For example: Users from group X should not see processes owned by users from group Y in ps/top or under /proc. ...
8
votes
1answer
1k views

How do I set up the SELinux sandbox in Debian?

I've installed SELinux in Debian sid in order to use the sandbox that locks down apps to a restricted environment, but I can't get it to work. If I try to use the sandbox command in permissive mode ...
7
votes
2answers
10k views

SELinux is preventing NGINX from writing via PHP-FPM

I'm using a server to write into a NFS type mount-point via NGINX using php-fpm. At the very first step, it shows me the following error: 2017/01/16 11:32:59 [error] 55463#0: *22 FastCGI sent in ...
7
votes
1answer
11k views

Configuring SELINUX to allow logging to a file that's outside /var/log

I have a daemon that uses syslog(3) to log to a file that is not a descendant of /var/log. Currently, this requires that SELINUX be disabled. How can I configure an enabled SELINUX to allow this ...
7
votes
1answer
5k views

how to create a custom SELinux label

I wrote a service/single binary app that I'm trying to run on Fedora 24, it runs using systemd, the binary is deployed to /srv/bot this service/app I wrote needs to create/open/read and rename files ...
7
votes
1answer
483 views

What is the proper way to set SELinux context in an RPM .spec? (RHEL7 in 2018)

The RHEL7 supplied tomcat package supports multiple instances through the creation of directories and symlinks. Once such a multiple instance is created and packaged as an RPM, the extra instances ...
7
votes
1answer
2k views

SELinux re-labeling problem while attempting to run OpenVPN

I'm trying to run OpenVPN under Fedora 19 with selinux (selinux-policy-targeted) in enforcing mode, and I'm running into an AVC I'm not entirely sure how to handle. Starting OpenVPN from the command ...
6
votes
2answers
25k views

PHP on centos 6 not working

I have installed PHP, MySQL, Apache on CentOS 6, now I have restarted the Apache and mysql, to test PHP I have created a index.php on /var/www/html/test/ now once I go to localhost/test/index.php then ...
6
votes
1answer
16k views

How to label a newly created file with “system_u”?

I just created a blank conf file for freetds and noticed that the permissions are wrong: [root@box etc]# touch freetds.conf.new [root@box etc]# ll -lZ freetds.conf* -rw-r--r--. root root system_u:...
6
votes
1answer
8k views

How to copy SELinux context from one directory and apply it to another directory?

How can I copy SELinux context from one directory and apply it to another? Example use scenario is when creating a new local user outside of the default /home path, like this: $ sudo useradd -d /...
6
votes
3answers
2k views

Running Viber as another user while using “mine” X Server's microphine and speakers

I run Fedora with GNOME and recently installed Viber for linux. It's very good and all is working just fine. As Viber is not open-source software, I decided to run it as another user to make sure ...
6
votes
1answer
5k views

Which SELinux policies apply to haproxy?

I just bumped into another SELinux related problem. It would seem my haproxy wasn't allowed to open TCP connections to the backend and I was able to fix it quickly using Google. Now, I would like to ...
6
votes
2answers
6k views

SELinux preventing ssh via public key

I have user $USER which is a system user account with an authorized users file. When I have SELinux enabled I am unable to ssh into the server using the public key. If I setenabled 0, $USER can now ...
6
votes
2answers
14k views

Httpd can't access file even after setting httpd_sys_content_t

I'm currently learning SELinux. I was following the instructions in SELinux doc of RedHat. I indeed succeded after typing the following commands: mkdir /mywebsite //add something to /mywebsite/...
6
votes
1answer
5k views

Debian: unable to set up SELinux

I'm trying to set up SELinux on Debian 6 according to (the instructions reported on the Debian wiki). I've run this commands: apt-get install selinux-basics selinux-policy-default selinux-activate ...
6
votes
5answers
25k views

How to create Maildir directory with enough permissions for Postfix?

I have CentOS 5.5 with Postfix installed on it. I want to use local delivery agent with default setting, but I want it to store mail with Maildir directory style mailboxes. When I set the mailboxes ...
6
votes
1answer
2k views

SELinux interfering with host/guest file sharing using KVM

I'm running Fedora 17 with KVM and the virtual machine runs okay. I tried to follow this to get access to a file on the host system but SELinux prevents the VM from accessing any files other than ...
6
votes
1answer
1k views

Why does audit2why have nothing to do?

I know I have an issue with SElinux. So I am following a tutorial that will help me understand the nature of the file access problems I am having. That was I can still have SElinux enforce as supposed ...
6
votes
1answer
4k views

How do I edit a file and preserve its access control list / SELinux security context?

I'm on CentOS 6.2, and have a file with the alternate access method character displayed as a dot. ls -l myfile -rwxr-x---. 1 me mygroup 172 Aug 13 10:03 myfile ^ This dot. ...
6
votes
1answer
146 views

deny any writing to given app and its children

So I have a Python app (which spawns other processes) which I want to deny any writing. It seems like a job for SELinux. Could you describe the steps needed to accomplish this, or perhaps direct me to ...
6
votes
2answers
8k views

How can I configure SELinux when the semanage command isn't found?

I'm having a very hard time configuring SELinux to allow Sending mail. Looking into selinux documentation I've found I can manage ports via the semanage command, but the command can't be found. Is ...
6
votes
2answers
45 views

Is there a tool which can find which SELinux rule allowed a particular access to occur?

My system has a very complex SELinux policy. Is there a tool which can explain why a particular access was granted? Often when I search for a particular rule using text search I don't find it because ...
6
votes
2answers
4k views

groupadd failure while writing changes to /etc/group

I have been following this guide on installing debian-kit on my Sony Xperia Tablet Z and the installation goes fine until I try to apt-get install andromize which fails with the error groupadd: ...
5
votes
2answers
4k views

Configure SELinux to allow daemons to use files in non-default locations

I have a daemon (apache/samba/vsftpd/...) running on SELinux enabled system and I need to allow it to use files in a non-default location. The standard file permissions are configured to allow access. ...