Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

Filter by
Sorted by
Tagged with
1
vote
1answer
462 views

Altermime and SELINUX

I've setup an application called altermime (http://www.pldaniels.com/altermime/) for postfix (SMTP server) which alters emails midstream. I'm injecting a "X-ListUnsubscribe" header into every email ...
0
votes
0answers
67 views

After I enable SELinux, some devices node are unable to be accessed

I enable SELinux feature by configuring kernel (below shows what I changed): @@ -44,7 +44,10 @@ CONFIG_SYSVIPC=y CONFIG_SYSVIPC_SYSCTL=y # CONFIG_POSIX_MQUEUE is not set # CONFIG_FHANDLE is not ...
2
votes
1answer
25 views

How can I allow a given application to access a given folder and its content

I recently installed a game through Steam, but some of the assets of the game aren't loaded. After a few investigations on the web, the Windows users who had the same problem were adviced to turn off ...
1
vote
0answers
31 views

Running lightweight SELinux policy in production

I'd like to take advantage of SELinux ability to restrict a group of Linux processes. The group is unprivileged users with high enough UID (say, >1000). This I want to do on a shared hosting server, ...
1
vote
0answers
230 views

SELinux User Role Gotchas

New security policy mandates that system administrators on RHEL systems must be mapped to either sysadm_U or staff_u role and 'normal' users must be mapped to user_u roles. Previous to this we ...
0
votes
0answers
110 views

Allowing read write access to a directory under SELinux

Is it possible to allow ANY process to read/write to a directory under SELinux? What I'd like is proper 0777 access to a directory and I really don't care which processes read or write to it. I know ...
48
votes
6answers
198k views

How to disable SELinux without restart?

I need to disable SELinux but cannot restart the machine i followed this link where i get bellow command setenforce 0 But after running this command i checked for that sestatus SELinux status: ...
0
votes
0answers
282 views

SELinux is preventing /usr/sbin/nginx from execute access on the file /etc/ld.so.cache

I'm getting a weird SElinux issue where if I restart Nginx with sudo systemctl restart nginx and SElinux is enforcing the server jams up causing the website to crash and the servers CPU hits 70 - 90 ...
6
votes
2answers
47 views

Is there a tool which can find which SELinux rule allowed a particular access to occur?

My system has a very complex SELinux policy. Is there a tool which can explain why a particular access was granted? Often when I search for a particular rule using text search I don't find it because ...
0
votes
1answer
59 views

SElinux and TCP Traceroute

I need to run a TCP Traceroute in the browser but are getting a few SElinux alerts. I have tried creating a policy with audit2allow, e.g ausearch -c 'traceroute' --raw | audit2allow -M my-traceroute ...
2
votes
0answers
56 views

Change SE Linux context label of a specific folder inside a cifs mount

have cifs mount on my setup mounted via /etc/fstab with context set to system_u:object_r:cifs_t:s0. There are some specific folders that I want to override default context to set public_content_t so I ...
0
votes
1answer
619 views

How to disable SELINUX using grub?

I accidentally enabled SELINUX and reboot the system without knowing it's consequence. Now, I can't access the login system in my CENTOS 7 unit. What I've tried so far: https://serverfault.com/...
0
votes
1answer
164 views

SFTP SELinux ssh_chroot_full_access

I always configured SFTP on Centos 6 like this: https://www.linuxtechi.com/configure-chroot-sftp-in-linux/ Where in the comment this item appeared: setsebool -P ssh_chroot_full_access on From the ...
9
votes
2answers
1k views

SELinux not allowing oddjobd-mkhomedir to create user home directory on a non-standard location

We are using SSSD to authenticate users on CentOS servers. oddjobd-mkhomedir works perfectly fine when the default home directory is /home, but on a particular server, we had to change default home ...
0
votes
2answers
91 views

side effects of disabling selinux

A few days ago I ran into a big problem and asked it here and I found out that selinux was the cause of that. I have some virtual and physical machines with CentOS 6.7 or 6.9 as OS. They all have ...
6
votes
1answer
16k views

How to label a newly created file with “system_u”?

I just created a blank conf file for freetds and noticed that the permissions are wrong: [root@box etc]# touch freetds.conf.new [root@box etc]# ll -lZ freetds.conf* -rw-r--r--. root root system_u:...
1
vote
0answers
25 views

What combination of labels to use to let NGINX connect to socket in /home/user?

I'm running a uwsgi app that creates a unix socket in /home/user/myapp.sock and nginx has been given the right permissions to access the file, however, selinux isn't letting me connect to it: avc: ...
2
votes
2answers
1k views

apache httpd is not able to connect to the internet

I run a Apache2 (httpd) server for Dokuwiki. Dokuwiki cannot use its upgrade or install plugin feature (see Question here). It seems that the user apache is not able to access the network/internet. ...
0
votes
0answers
148 views

CentoOS 7 Samba Share USB NTFS

Cannot seem to find an answer which includes all of the specifics of my situation. I followed instructions in Sharing a mounted drive with samba on CentOS7, but still have a problem. I have CentOS 7 ...
2
votes
1answer
2k views

Sharing a mounted drive with samba on CentOS7

CentOS 7, samba issue: 0 Files/Folders when trying to share USB drive with EXT4 file system. Samba Configuration file: [global] workgroup = WORKGROUP server string = Samba Server %v netbios name = ...
2
votes
0answers
298 views

User account mapped to SELinux staff_u account but unable to run sudo command

I have two user accounts in my virtual machine, anim and anim2. Both are part of the wheel group and can run su/sudo commands. I was reading on redhat how SELinux user staff_u can only run sudo ...
1
vote
2answers
96 views

Real application of selinux [closed]

Almost all tutorial and most systems i have seen seem to disable selinux. Are there actual implementation of selinux security in real world ?
6
votes
2answers
6k views

SELinux preventing ssh via public key

I have user $USER which is a system user account with an authorized users file. When I have SELinux enabled I am unable to ssh into the server using the public key. If I setenabled 0, $USER can now ...
5
votes
1answer
7k views

Core difference between SELinux and Apparmor

What is the core [or kernel level] difference of SELinux and Apparmor?
1
vote
3answers
3k views

Configuring FTP server in redhat

I have installed vsftpd in redhat. Everything was file untill I fould that when I log into ftp server using: ftp localhost or fileZilla I get following errors: ERROR: - 500 OOPS: cannot change ...
0
votes
0answers
113 views

“semanage port” command does not work

So, I was tasked to chagen SSH port in a CentOS server. As I did in the configuration file, the service failed to start, so after a little research I found that I should make some changes in selinux, ...
1
vote
1answer
2k views

SELinux Prevents httpd Write Files

I recently setup a website on RHEL7. The SELinux is in Enforcing mode. However, whatever how I tune the context, it always prevents httpd from writing. Here is the audit.log: type=AVC msg=audit(...
8
votes
4answers
7k views

What can go wrong if we disable selinux [closed]

We inherited a bunch of used servers from another team. Some of them have SELinux enabled on it, some do not. Because of SELinux, we are having trouble setting up passwordless ssh, our webserver, ...
3
votes
0answers
230 views

Symbolic links do not allow SELinux type_transition

Trying to access symbolic link does not allow to use SELinux type_transition. I mean that I tried to implement scheme in which user has access to a symbolic link located in /usr/bin/ and which leads ...
1
vote
0answers
124 views

How to exclude a directory or partition on pmlogger scan?

As on the details below it look like that the cause of the problem is the pmlogger is spawning the find command. And its takes a long time for the find to scan all the files in one of my partition. ...
1
vote
0answers
133 views

How to mount ecryptfs and preserve individual SELinux tag of underlying files?

I am trying to mount ecryptfs on a system that uses SELinux (e.g. Cent-OS), and I want to preserve the security tag of all individual underlying files. Using mount -o command I can set the security ...
2
votes
2answers
234 views

Selinux is blocking my external kernel module

I'm trying to insert an external kernel module in permanent mode. During the boot, my module is being loaded by systemd-modules-load service so long as Selinux is permissive. But I want to keep ...
1
vote
2answers
461 views

Can't delete and remove SELinux context or ACL from a symlink in /usr/lib under root

I'm on Fedora 27 and experience problems with updating the packages by dnf update. The problem is exactly as described here: https://superuser.com/q/1005740/683161 I tried to delete symlink under /...
5
votes
1answer
1k views

What SELinux context should the script have to be ran by pam_exec?

I just installed Fedora 22 on my VPS and tried to make trivial thing -- run my informer script on every ssh login via pam_exec. But I was confronted with unexpected difficulties: pam_exec failed with ...
4
votes
1answer
249 views

SELinux Interfering With sss_cache

System: HP Pavilion Power Laptop 15-cb0xx Intel i7-7700HQ w/ integrated graphics enabled (can't be turned off in bios) Fedora 28 NVIDIA GTX 1050 (mobile) I used the dnfdragora GUI to update about ...
1
vote
1answer
232 views

In a custom module, is there a way to allow all permissions for files/directories?

I've written a custom selinux module that looks something like this: require { type my_app_t; type my_app_file_t; class file { getattr lock open read write execute execute_no_trans ioctl ...
-1
votes
2answers
114 views

SELinux is preventing $_POST variables on Amazon Linux 2

I began playing with RPM based OSes and I am really impressed. Amazon Linux doesn't include setroubleshoot in any of their repos. I want to use official repos for everything, otherwise I would ...
1
vote
2answers
235 views

SELinux demands constant relabeling

I have installed SELinux on Ubuntu 18.04.1 LTS via # apt install selinux After the mandatory reboot, SELinux was constantly disabled until I added SELinux = 1 to /etc/default/grub and executed ...
8
votes
1answer
7k views

Why setsebool command of SELINUX taking so long and slow?

I have noticed the command setsebool take longer time than other linux commands. Such as: setsebool -P ftp_home_dir ON Out of curiosity I want to know why "setsebool" command needs such a long time ...
0
votes
2answers
1k views

chcon: can't apply partial context to unlabeled file

I get the following when trying to allow httpd to write to application specific directories. [xxx MISP]# chcon -t httpd_sys_rw_content_t /var/www/MISP/app/files chcon: can't apply partial context to ...
5
votes
2answers
628 views

SELinux denied access

I keep receiving this message from SELinux in a bug report. I am running Fedora 13 and I am learning as I go. What might be causing this? Summary: SELinux is preventing /usr/sbin/semodule access to ...
2
votes
2answers
321 views

Enabling SELinux on RHEL

I am using RHEL 6.5 and I need to enable SELinux. I have tried following commands, but it does not work: $ setenforce 1 $ echo 1 > /selinux/enforce Note: I also tried editing /etc/selinux/config, ...
1
vote
0answers
568 views

Can't access SFTP with SELinux enabled

I've setup SFTP on CentOS 6.8. I've enabled SELinux, but I can't login using SFTP. I get a permission denied message. I did setsebool -P ssh_chroot_rw_homedirs on but didn't work and I'm still ...
0
votes
1answer
201 views

Deciphering a particular SELinux/AVC error

This SELinux avc error ( as generated by ausearch ) has me confused. time->Fri Nov 13 16:04:49 2015 type=PROCTITLE msg=audit(1447452289.136:242): proctitle="/opt/firefox/firefox" type=SYSCALL msg=...
0
votes
2answers
639 views

SELinux is preventing httpd from create access on the file

Whenever I upload a file via my web browser to my web sever, I see the following lines in /var/log/messages Nov 8 12:18:24 sn setroubleshoot: SELinux is preventing httpd from create access on the ...
0
votes
0answers
66 views

Why can't set my selinux status as enabled?

I had bought a vps ,installed centos7. rpm -qa | grep selinux libselinux-2.5-12.el7.x86_64 libselinux-utils-2.5-12.el7.x86_64 libselinux-python-2.5-12.el7.x86_64 No /etc/sysconfig/selinux and /etc/...
2
votes
2answers
2k views

Postfix and Apache: Permission denied on CentOS 7

I am setting up a CentOS 7 Server with Apache2, MySQL, PHP and Postfix (for sending emails over PHP) My problem at the moment is that I get the following error (at the error_log from Apache): ...
0
votes
1answer
218 views

How to run Java application in confined SELinux domain?

I am working with a Java app that has been labeled with its own SELinux type. Java executes it as unconfined_t instead of the labeled type. Java is labeled as bin_t (ls -Z /usr/lib/jvm/java-1.8.0-...
2
votes
0answers
141 views

Maintaining file's SELinux labels when copying them from one directory into another

Default behavior for copying files or sub-dirs from one directory to another is that the copied objects do not maintain their SELinux type (domain) which is opposite to objects which were moved. ...
2
votes
0answers
573 views

Yama LSM seems to do nothing. RHEL/Centos 7.5

The Yama security module is supposed to be able to prevent users from running the ptrace system call, yet even with kernel.yama.ptrace_scope set to 3, users can still run strace (which uses ptrace). ...