Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

Filter by
Sorted by
Tagged with
8
votes
2answers
4k views

Hide processes from other users based on groups (under Linux)?

Is it possible to configure process hiding for certain user groups under a linux system? For example: Users from group X should not see processes owned by users from group Y in ps/top or under /proc. ...
5
votes
2answers
4k views

Configure SELinux to allow daemons to use files in non-default locations

I have a daemon (apache/samba/vsftpd/...) running on SELinux enabled system and I need to allow it to use files in a non-default location. The standard file permissions are configured to allow access. ...
20
votes
3answers
7k views

Myth or reality: SELinux can confine the root user?

I read or heard somewhere (maybe in LinuxCBT's SELinux course; but I'm not sure) that there are online Linux servers, for which the password of the root user is also given. The Linux server is ...
6
votes
1answer
4k views

How do I edit a file and preserve its access control list / SELinux security context?

I'm on CentOS 6.2, and have a file with the alternate access method character displayed as a dot. ls -l myfile -rwxr-x---. 1 me mygroup 172 Aug 13 10:03 myfile ^ This dot. ...
27
votes
4answers
88k views

httpd can't write to folder/file because of SELinux

Does anyone know which sebool it is to allow httpd write access to /home/user/html? When I disable SELinux echo 0 > /selinux/enforce I can write, so my problem is definitely related to SELinux. I ...
20
votes
2answers
8k views

What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?

I am planning to go back to Linux as a Desktop machine. I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server. What would be a good, ...
12
votes
8answers
5k views

How to prevent a process from writing files

I want to run a command on Linux in a way that it cannot create or open any files to write. It should still be able to read files as normal (so an empty chroot is not an option), and still be able to ...
6
votes
1answer
9k views

How to copy SELinux context from one directory and apply it to another directory?

How can I copy SELinux context from one directory and apply it to another? Example use scenario is when creating a new local user outside of the default /home path, like this: $ sudo useradd -d /...
2
votes
1answer
1k views

How to read/change SELinux context on mounted ext4 image from non-SELinux system?

I have a Linux system (Arch Linux) without SELinux support. I would not like to configure such support on my system. Now, I have an ext4 volume image which is known to have some SELinux context set on ...
9
votes
1answer
24k views

chcon: can't apply partial context to unlabeled file while installing nagios with SELinux

I'm setting up Nagios core on CentOS with SELINUX=enforcing. I try to run chcon -R -t httpd_sys_content_t /usr/local/nagios/sbin/ as suggested in the manual, but I get this error messages: chcon: ...
9
votes
3answers
36k views

chcon: can't apply partial context to unlabeled file '/usr/sbin/xrdp'

Whenever I'm trying to execute this line to configure SELinux to install xrdp from this tutorial: # chcon --type=bin_t /usr/sbin/xrdp # chcon --type=bin_t /usr/sbin/xrdp-sesman I get these errors: ...
1
vote
2answers
501 views

Can't delete and remove SELinux context or ACL from a symlink in /usr/lib under root

I'm on Fedora 27 and experience problems with updating the packages by dnf update. The problem is exactly as described here: https://superuser.com/q/1005740/683161 I tried to delete symlink under /...
0
votes
1answer
775 views

How to add exception in SELinux?

When SELinux is disabled, I have no issues, but when it's Enforced then I'm facing this [systemd] failed to get d-bus session: Failed to connect to socket /run/dbus/system_bus_socket: Permission ...
9
votes
2answers
25k views

SELinux httpd write access to a directory

I am new to SELinux. came from debian. I want to give httpd access to a directory. SELinux Alert Browser suggests: # grep httpd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp ...
13
votes
1answer
4k views

What is the proper way to set SELinux context in an RPM .spec?

I am trying to build an RPM that targets RHEL4 and 5. Right now I call chcon from %post but multiple Google entries say "that's not how you are supposed to do it" with very limited help on the right ...
8
votes
1answer
1k views

How do I set up the SELinux sandbox in Debian?

I've installed SELinux in Debian sid in order to use the sandbox that locks down apps to a restricted environment, but I can't get it to work. If I try to use the sandbox command in permissive mode ...
6
votes
1answer
5k views

Which SELinux policies apply to haproxy?

I just bumped into another SELinux related problem. It would seem my haproxy wasn't allowed to open TCP connections to the backend and I was able to fix it quickly using Google. Now, I would like to ...
9
votes
2answers
2k views

What is the best way to learn SELinux? [closed]

I want to learn SELinux to a high level, being able to understand the intricacies of domains, types and switching. What is the best way to go about this? I considered starting with Fedora and a good ...
9
votes
1answer
5k views

how to create a custom SELinux label

I wrote a service/single binary app that I'm trying to run on Fedora 24, it runs using systemd, the binary is deployed to /srv/bot this service/app I wrote needs to create/open/read and rename files ...
6
votes
3answers
2k views

Running Viber as another user while using “mine” X Server's microphine and speakers

I run Fedora with GNOME and recently installed Viber for linux. It's very good and all is working just fine. As Viber is not open-source software, I decided to run it as another user to make sure ...
2
votes
1answer
795 views

SELinux + MergerFS (fuse) not working well together

I have been trying now for several days to get my new server up and running. I am running CentOS with MergerFS to pool my drives and samba to host to my windows machines. All of this running in ...
4
votes
1answer
621 views

How to install SELinux policy manpage?

How to install the manpage httpd_selinux on CentOS 7.4? It's not included in the packages httpd, httpd-tools, or httpd-manual. A yum whatprovides "*/httpd_selinux" search returned no results. (...
3
votes
1answer
1k views

systemd-nspawn OS container is unusable because I can't set the root password

I combined the detailed instructions from the original blog post, and the more up to date instructions from the man page (using dnf instead of yum). # sudo dnf -y --releasever=24 --installroot=$HOME/...
8
votes
1answer
8k views

Permission errors even though permissions are wide open

I installed anaconda on our new VM and I can't list its contents. I can change my directory to .../anaconda/ but when I type ls -l I get: ls: cannot open directory .: Permission denied However, when ...
6
votes
1answer
5k views

Debian: unable to set up SELinux

I'm trying to set up SELinux on Debian 6 according to (the instructions reported on the Debian wiki). I've run this commands: apt-get install selinux-basics selinux-policy-default selinux-activate ...
4
votes
2answers
3k views

SELinux: allow a process to create any file in a certain directory

I have a script that, when invoked, will cause the contents of dmesg to be written to a file, with the file's name basically being a timestamp. SELinux prevents this. Following the advice of Fedora'...
3
votes
1answer
197 views

Is it possible to prevent a change in SELinux status without a reboot?

I'd like to be able to prevent even a privileged user from changing the SELinux mode from enforcing to permissive without a reboot. It's too easy for a root user to run setenforce permissive, make ...
0
votes
2answers
4k views

Disable SELinux in apache to stop warning

I keep getting this error when I restart httpd: DocumentRoot does not exist What else can I do besides disable editing /etc/sysconfig/selinux to fix it?
9
votes
1answer
5k views

What is the safe way to allow Java 7 to run on SELinux

Short version: What is the most secure way to allow Java 7 to run on (with?) SELinux? Long version: Sorry in advance if I use incorrect terminology. I'm really just a Java developer with a meager ...
7
votes
1answer
2k views

SELinux re-labeling problem while attempting to run OpenVPN

I'm trying to run OpenVPN under Fedora 19 with selinux (selinux-policy-targeted) in enforcing mode, and I'm running into an AVC I'm not entirely sure how to handle. Starting OpenVPN from the command ...
6
votes
1answer
8k views

Core difference between SELinux and Apparmor

What is the core [or kernel level] difference of SELinux and Apparmor?
5
votes
1answer
869 views

Apache can't open file that is a symlink

I have a file: js/jquery.terminal-src.js: symbolic link to ../../repo/js/jquery.terminal-src.js and when I try to open it with browser using: http://localhost/projects/jcubic/terminal/test/js/...
4
votes
2answers
551 views

How to change service type of well defined ports in SElinux (centOS 6.5)

I need to be able to run SSH on port 23 instead of 22 on CentOS 6.5. SElinux won't allow that, as it has it as tcp/23 defined in policy. Any steps on how can I go about changing service type from ...
3
votes
1answer
3k views

SELinux and chroot system call

TL; DR: This is a question about the final step, in a portable, developer-oriented rooting process, that works across all Android machines. It is not based on any exploit - it is something that we are ...
3
votes
1answer
1k views

SELinux “training” ( permissive mode logs )

Alright I've been skimming various articles and videos. They all say the same basic thing: start with the default policy, run in permissive to see what needs to be fixed. Then modify your policies to ...
3
votes
1answer
889 views

GDM will not start on boot, unable to login into graphical interface

I am running RHEL 5.8 . SELinux is enabled but in permissive mode. Here are some snippets from /var/log/messages on boot. kernel: type=1400 audit(1360613500.551:6): avc: denied { write } for pid=...
3
votes
3answers
4k views

How to permamently disable SYN-Cookies?

We run a site with big traffic surges and, because of that, SELinux usually thinks that the traffic is a SYN flood attack. We have this same problem on many different CentOS servers. Despite /etc/...
3
votes
2answers
1k views

SELINUX won't enable [closed]

I just checked to see if SELINUX was enabled on my server like this [root@fedora ~]# getenforce Disabled However, when I look at the /etc/selinux/config file I see this # This file controls the ...
2
votes
1answer
5k views

What's missing with my SELinux installation?

According to Introduction to SELinux, section 14.4.2, SELinux support is built into the standard kernels provided by Debian. The core Unix tools support SELinux without any modifications. I have ...
2
votes
0answers
376 views

User account mapped to SELinux staff_u account but unable to run sudo command

I have two user accounts in my virtual machine, anim and anim2. Both are part of the wheel group and can run su/sudo commands. I was reading on redhat how SELinux user staff_u can only run sudo ...
2
votes
0answers
161 views

Maintaining file's SELinux labels when copying them from one directory into another

Default behavior for copying files or sub-dirs from one directory to another is that the copied objects do not maintain their SELinux type (domain) which is opposite to objects which were moved. ...
2
votes
1answer
127 views

Is listening-on connecting-to the same for SELinux?

According to semanage-port(1) ... -a does the same as --add -t does the same as --type -p does the same as --port and the command semanage port -a -t http_port_t -p tcp 81 allows Apache to LISTEN ...
2
votes
1answer
2k views

/usr/sbin/sendmail: Permission denied

I am trying to setup the mail on my fedora 20. Every time I try to fire a test mail it tells me the permission is denied on /usr/sbin/sendmail. I checked the permissions and this is the output: [...
2
votes
1answer
2k views

Sharing a mounted drive with samba on CentOS7

CentOS 7, samba issue: 0 Files/Folders when trying to share USB drive with EXT4 file system. Samba Configuration file: [global] workgroup = WORKGROUP server string = Samba Server %v netbios name = ...
2
votes
1answer
253 views

How to troubleshoot Nginx permission denied in subdirectory?

I'm working on Fedora 29 Server. SELinux is in Enforcing mode. I'm having trouble getting Nginx to serve documents from a subdirectory below root. I need to know how to troubleshot it further because ...
1
vote
1answer
404 views

Which process/program create/write the file which I/O is redirected to?

When learning SELinux, I executed semanage fcontext -l > fcontext.txt under /root directory to dump massive fcontext information to a file. The funny result is: fcontext.txt was created, but the ...
1
vote
1answer
400 views

sshd[5589]: error: PAM: pam_open_session(): Cannot make/remove an entry for the specified session

I am working with a CentOS7 minimal install. I configured pam_radius with pam_script and was always able to ssh to the server using pubkey auth: that was on purpose. But after hardening the server ...
1
vote
1answer
255 views

How to troubleshoot SELinux issues?

I suspect I have a problem in SELinux configuration: my issue goes away after disabling selinux using setenforce 0. I am using the default policy without any modifications. How can I pinpoint the ...
0
votes
1answer
309 views

Selinux - Looking for some policy that is blocking clamd to open new ports for each Thread

Trying to keep SElinux Enforced on CentOS and allowing clamAV to scan files. But it seems that SElinux does not like the following behavior of clamd: Clamd is listening on a predefined TCP port ...
0
votes
1answer
427 views

Does `mv --context` (for selinux, a.k.a. -Z) correctly apply labels recursively to directory contents?

mv -Z applies the default selinux context. Does it differ from all other invocations of mv, and work on all the files in a moved directory individually?