Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible role-based, mandatory access control (MAC) architecture on Linux through kernel modifications and user-tools. It is primarily used to confine system processes and users beyond the basic Discretionary Access Controls (DAC) mechanism or access-control list found on *nix systems.

Filter by
Sorted by
Tagged with
0
votes
1answer
15 views

restorecon not setting fcontext created using semanage

I think there is a gap in my understanding of how to change one file's context permantently. After reading through https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/...
1
vote
2answers
199 views

SELinux restorecon

I am trying to export a Samba share and changing its SELinux fcontext to 'samba_share_t'. However in the guide that I follow after changing the fcontext, I need to run 'restorecon' over the exported ...
0
votes
1answer
29 views

How to set selinux labels for a folder hierarchy accessed server side by NFS, Apache, and SaMBa daemons simultaneously?

The Mandatory Access Controls or MAC labels are different for NFS which are different for httpd, and different yet again for SaMBa. What is the proper way nowadays to label a SINGLE shared filesystem ...
2
votes
3answers
237 views

SELinux blocking qemu / libvirt from accessing ISO

I am unable to get selinux to allow libvirt to access images and ISO files outside of the default libvirt directory. What makes it more frustrating is that audit2allow and setroubleshooter does not ...
1
vote
1answer
21 views

SELinux is blocking connections from Amavis back into itself: no way in/out?

Running a fresh CentOS8 install here, MTA is Postfix with Amavis hooked in. I want to have Amavis inject messages from ORIGINATING (incoming submissions from port 587/Postfix through 10026/Amavis) ...
2
votes
1answer
5k views

What's missing with my SELinux installation?

According to Introduction to SELinux, section 14.4.2, SELinux support is built into the standard kernels provided by Debian. The core Unix tools support SELinux without any modifications. I have ...
-1
votes
2answers
112 views

How to restrict anyone (Root user also) to modify file in Linux?

I am developing one security base software for LINUX platform using C and CPP. I want to restrict all users even ROOT user also to modify the file. i.e No one can modify the file. Modifying means No ...
2
votes
1answer
41 views

Cannot disable SELinux by modifying the config file and rebooting

I'm trying to disable SELinux on a virtual environment (because a software component we use recommends it, not because I want to) I have tried setting its status to "disabled" in /etc/selinux/config ...
0
votes
1answer
1k views

Ansible modules copy/template errors for Linux 5 hosts using python26 ,python binding libselinux-python needed

We have some 50 odd linux 5 hosts, and to manage that we use ansible. Problem :- Ansible modules copy/template errors for Linux 5 hosts using python26 ,python binding libselinux-python needed ...
2
votes
1answer
965 views

Cannot execute semanage fcontext --add under Fedora 21 using policy targeted

I cannot add a file contexts to the running SELinux policy using semanage under Fedora 21. When executing the semanage fcontext --add command, I receive an OSError: mf@vienna ~ % sudo semanage ...
1
vote
0answers
52 views

Fedora 30 : Ensure No Device Files are Unlabeled by SELinux

While hardening Fedora 30, I encountered this measure on open-scap.org and actually the command : sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n" returns on my system ...
0
votes
2answers
42 views

selinux prevents pam_exec command from being executed

I am trying to setup my computer to notify me every time a user logs in (via ssh, via gdm or tty). Right now I am setting up sshd and I added this to /etc/pam.d/sshd: session optional pam_exec.so /...
3
votes
2answers
199 views

/etc/pam.d/ rules for ssh and login

In /etc/pam.d/, the configuration files for sshd and login have some rules for selinux. Can I simply disable those lines, when I am not using selinux ? I would like to simplify the pam rules. ...
0
votes
1answer
142 views

Allow SCP in RHEL CentOS 7 selinux

running rhel 7.6 (or centos 7.6) With selinux = enforcing doing an ssh in to or out of the system works, but doing a scp to the RHEL selinux system does not work. On the RHEL system if I do ...
2
votes
2answers
2k views

selinux is causing “nexus.service: Failed at step EXEC spawning /opt/nexus/bin/nexus: Permission denied” Fedora 26, nexus 3.06

After installing the latest version of nexus, currently 3.6.0, I'm able to start it by using the manual command /opt/nexus/bin/nexus start but when trying to start as a service (per directions ...
5
votes
1answer
1k views

selinux, dovecot and sieve

I've just started learning to configure SELINUX and this morning on my CentOS 6.4 x64 system, with postfix/dovecot/mysql installed, I woke up to the following selinux issue found 1 alerts in /var/log/...
1
vote
1answer
275 views

Is it possible to enable an SELinux boolean in a policy module?

audit2allow creates fine-grained policy modules, but often hints that an existing boolean represents a superset of a policy line. For example: #!!!! This avc can be allowed using the boolean '...
5
votes
2answers
1k views

SELinux is preventing /opt/google/chrome/chrome-sandbox from write access on which file?

I keep getting the following error ever since upgrading to Chrome google-chrome-stable-42.0.2311.90-1.x86_64. SELinux is preventing /opt/google/chrome/chrome-sandbox from write access on the file ...
0
votes
0answers
21 views

Restrict directory access to single process using apparmour

I'm going to create program creating directory and granting privileges to this directory to program request of creating this directory. Each directory, created by my program, will be putted in one ...
5
votes
4answers
290 views

Why do selinux policies apply to commands (e.g: logrotate) running from cronjobs, but not when run directly from command line?

Why do selinux policies apply to commands (e.g: logrotate) running from cronjobs, but not when run directly from command line? When I run logrotate manually from the command line, it works perfectly. ...
0
votes
1answer
66 views

Bash rm /proc/sys/net/ipv4/icmp_echo_ignore_all: Permission denied

I have created this file /proc/sys/net/ipv4/icmp_echo_ignore_all couple of months ago on my centos 7 server to disable ping requests permanently and now I can not undo this! I'm logged in as root ...
2
votes
1answer
542 views

Can't modify or delete SELinux user

I was playing around with user_u in the targeted policy on RHEL 6.5. I'm logged in as root in the unconfined context, so I have full ability to change anything I want. I've also switched to ...
0
votes
1answer
20 views

Selinux and Docker file creation context

I'm working on a container that I want to add a static mount of -v /home/_username:/home/_username but I want to avoid using the z or Z mount options. I've been able to use audit2allow to create a ...
0
votes
1answer
3k views

selinux blocking vsftpd directory listing

I am trying to get a better understanding of selinux and configuring a local ftp repository on Centos7. I installed vsftpd on my host. I created a repository on my host: /var/ftp/pub/centos7 EFI ...
2
votes
1answer
15 views

Get SELinux permisison list associated with socket base

This shows the permissions associated with the tcp_socket class: > seinfo -c tcp_socket -x Classes: 1 class tcp_socket inherits socket { connectto name_connect ...
3
votes
1answer
239 views

How to set SELinux in permissive mode without reboot?

I am on Fedora 29 and SELinux is currently disabled. I am trying to put into permissive mode using setenforce permissive, but always get setenforce: SELinux is disabled this output and then status ...
1
vote
1answer
984 views

Sharing / (root) Linux directory with Samba, CentOS 7

I'm using CentOS 7! I want to know if is possible share root / Linux directory. In root mode: # kwrite /etc/samba/smb.conf Here the line contents [global] workgroup = MyGroup server string = ...
1
vote
0answers
96 views

selinux preventing init_t access to httpd_sys_content_t

I have a systemd service file that runs a script. It is getting blocked by selinux: type=AVC msg=audit(1570329687.437:218): avc: denied { execute } for pid=1079 comm="(index.sh)" name="make_index....
0
votes
2answers
2k views

How to disable SELINUX using grub?

I accidentally enabled SELINUX and reboot the system without knowing it's consequence. Now, I can't access the login system in my CENTOS 7 unit. What I've tried so far: https://serverfault.com/...
1
vote
2answers
671 views

SELinux disabled, net.ipv4.tcp_syncookies and nfs

OS is RHEL 6.2. I appear to be having an issue with SELinux. I've disabled it in /etc/sysconfig/selinux, however, when my host starts the command sestatus show that I'm in permissive mode. Searches ...
3
votes
3answers
4k views

How to permamently disable SYN-Cookies?

We run a site with big traffic surges and, because of that, SELinux usually thinks that the traffic is a SYN flood attack. We have this same problem on many different CentOS servers. Despite /etc/...
3
votes
3answers
11k views

MySQL permission denied error even after setting security context for SELinux on VM

I have MySQL installed on CentOS (detail versions given below). My OS is a VM machine and not a physical machine, the directory /data/mysql is a local disk (virtual). I suspect I might need to do some ...
4
votes
1answer
2k views

How to create an SELinux exception for individual files

I use a monitoring tool and on one of my systems that is checked remotely, it calls up a script, which in turn runs systemctl to check the status of a service. This was not working until I put SELinux ...
0
votes
1answer
26 views

SElinux package removes grub-efi

ON my linux mint 19.2 machine, I am trying to set up Selinux. But when i install selinux package, it removes grub-efi. When I try to reinstall grub-efi, it removes selinux Does this mean selinux is ...
0
votes
1answer
62 views

What does “permissive” statement mean in SELinux policy type enforcement (.te) file?

I'm defining a new type mynewtype_t. There is a line which was automatically generated with the permissive keyword. $ sepolicy generate --init /bin/sh Failed to retrieve rpm info for selinux-policy ...
0
votes
1answer
44 views

GoogleAuthenticator PAM Module Permissions Issue — VPN with MFA in AWS EC2 running CentOS

Full Disclosure: I am writing this question to then answer it myself. I searched the internet for a full day at work and was not able to find a solution that worked for me. I even compiled my own ...
0
votes
0answers
35 views

How to setup an SELinux policy to allow only a specific context permission to 'execheap'

I want to enable the dynamic core in DOSBox but this is incompatible with SELinux as unconfined_t by default is not allowed to execute from the heap. The SELinux troubleshooter suggests: You must ...
1
vote
1answer
36 views

Docker without SELinux makes ERR_NETWORK_CHANGED errors in Chromium

I had errors from SELinux when using files inside docker, so I've edited the file /etc/sysconfig/docker to disable SELinux for docker, after restart I was keep gettings errors ERR_NETWORK_CHANGED ...
0
votes
0answers
103 views

How to prevent SELinux errors from inside docker conainers

I've run docker container like this: mkdir ~/tmp docker run -ti --rm --name test -v /home/kuba/tmp:/root/tmp ubuntu:14.04 bash and after writing /root/tmp/file.txt file (inside docker container) I'...
2
votes
0answers
26 views

semodule fails to install module

I run Fedora Atomic host 29, with SELinux enforced. The box is a few week old and run smoothly, until recently when it comes to SELinux. Trying to solve some errors with this command: # cat /var/log/...
3
votes
1answer
269 views

rsync daemon with enforcing selinux policy rsync_export_all_ro still prevents access to files under /var/spool/postfix/private/

I have a number of Debian-based systems that get backed up regularly using rsync. For a number of reasons I have had to deploy a small CentOS 7 server, and I want to add it to my backup schedule. It ...
1
vote
1answer
294 views

Changing MySQL Temporary File - Permissions Error

At the moment, MySQL Server is using /tmp as it's temporary directory, and I'd like to change that, because it's running into storage issues. Following this post: https://encylia.com/2015/02/06/how-...
2
votes
2answers
76 views

SELinux security context of parent directories

I'm using a RHEL machine with SELinux enabled. I'd like to change the logfile position of auditd to /mydir/log/audit.log. I can apply the security context system_u:object_r:auditd_log_t:s0 to this ...
3
votes
1answer
900 views

GDM will not start on boot, unable to login into graphical interface

I am running RHEL 5.8 . SELinux is enabled but in permissive mode. Here are some snippets from /var/log/messages on boot. kernel: type=1400 audit(1360613500.551:6): avc: denied { write } for pid=...
7
votes
2answers
2k views

Why does audit2why have nothing to do?

I know I have an issue with SElinux. So I am following a tutorial that will help me understand the nature of the file access problems I am having. That was I can still have SElinux enforce as supposed ...
0
votes
0answers
22 views

Should every SELinux denial event result in an accompanying AVC?

On a currently running system that heavily is using docker containers, I noticed that running the daemon with selinux-enforcing:true, I obtained an (previously unseen) error message in my audit log. ...
1
vote
1answer
64 views

Why does SELinux (with Enforcing=1) allow binding to low (or any) ports, by default?

I assume that Selinux defaults, based on the documentation, mandate that basically all port operations would be blocked and logged as AVCs. I have an SELinux enforcing enabled VM, created with ...
2
votes
1answer
653 views

How to identify dac_override cause on Android?

I am working on some Android customizations and an app I am writing causes a dac_override which looks like so in dmesg: type=1400 audit(499405.329:16): avc: denied { dac_override } for pid=1103 comm=...
0
votes
0answers
877 views

Cannot label F2FS (SELinux)

I'm running Arch Linux [testing] x86_64 For some reasons, I can't relabel my root file system (F2FS) with SELinux (custom kernel compiled, using refpolicy) Kernel ver $ uname -a ...
1
vote
2answers
761 views

Why does “attr -l .” tell me about an “selinux” attribute that “attr -g selinux .” refuses to read?

I'm setting up a Fedora (Core) 24 system from scratch, and ran into this oddness: > sudo attr -l . Attribute "selinux" has a 41 byte value for . > sudo attr -g selinux . attr_get: No data ...