Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

Filter by
Sorted by
Tagged with
2
votes
2answers
202 views

prohibit unconfined SELinux user (root) to install policy to a system

I am trying to write a SELinux policy which after its installation will prohibit for a unconfined (or another, which can be chosen) user any subsequent SELinux policy installation. It seems that there ...
1
vote
2answers
706 views

SELinux - How to avoid it preventing a process from write access on newly created files into folder

I'm hardly trying to correctly use selinux keeping it in enforced mode, but very often I encounter issues with it causing our application to work improperly. Our web application is java backend and ...
0
votes
1answer
2k views

SELinux is preventing /usr/bin/bash from execute access on the file myfilename.sh in nginx via php-fpm

Background: I have two CentOS7 servers. Test & Prod. There is a script myfilename.sh in my website, which is executed in php by shell_exec. Script and all parent folders in both servers have ...
1
vote
1answer
103 views

SELinux denied clamscan to delete uploaded file on nginx server

On my nginx server, the uploaded files context are set as: -rw-rw-r--. nginx nginx system_u:object_r:httpd_sys_rw_content_t:s0 eicar.sh.pdf Right after upload, clamscan runs to verify the file using ...
3
votes
1answer
1k views

Create a SELinux policy for a custom systemd service

I'm using Fedora Workstation 27 Live OS in which I want to run a custom service EnableBIOS.service along with OS boot. For this to work, I have to disable SELinux which is causing a problem in my ...
4
votes
1answer
2k views

Permission problems. Can't retrieve inbox messages from dovecot

I got a VPS server at a webhoster which has CentOS 6.6 as operating system. Because I have multiple domains which are used by various people, this server is going to serve multiple roles: nameserver (...
0
votes
0answers
71 views

Home dir of ftp user in /var/www

I am trying to make a web server with Centos 7, I am trying to give access to a certain user in the /var/www dir via ftp making that dir his home directory. I use vsftpd; this is my config file: ...
2
votes
0answers
38 views

SELinux file permissions history [duplicate]

How can I see the history of file labels - who and when set them? Right now SELinux reports that my /etc/resolv.conf with content # Generated by NetworkManager is mislabeled. It is now unlabeled_t ...
1
vote
1answer
199 views

Permissions on a folder stopping Nginx from starting

I am fairly new to Linux. I have a couple of websites that I want to host on my CentOS 7 VPS with Nginx. Nginx ought to start on start up, but it is failing due to some permissions issue, I know what ...
3
votes
1answer
547 views

What is map access in the context of SELinux

I am hitting an issue with SELinux where it tells me SELinux is preventing sh from map access on the file /bin/busybox. and then it tells me If you believe that sh should be allowed map access on ...
0
votes
0answers
212 views

SELinux setsebool command fails on Google compute engine

I am trying to setup my website (LAMP stack, CentOS 6.9) on Google compute engine. I use PHPMailer to send mails (Registration, Singup, Login, etc.) I have setup smtp & all that good stuff in G-...
0
votes
0answers
676 views

Selinux and cgi-bin -> permission denied.

Trying to get a hello-world Perl script to run in the standard cgi-bin location /var/www/cgi-bin/test.pl with RHEL 7. I get a permission denied in the httpd error log only when selinux set to ...
0
votes
1answer
63 views

What do “--”, “-d”, etc in file_contexts mean?

In /etc/selinux/targeted/contexts/files/file_contexts, some lines will have just two parts, with the context as the second part, but some will have three parts where the second part is --, -d, etc. ...
1
vote
2answers
187 views

MariaDB slave server shall connect to 127.0.0.1:3307 to reach master. SELinux says no. What do?

I have a MariaDB server on CentOS 7. The server shall play slave and replicate the a remote master server. The remote master server can be reached through an SSH tunnel. The SSH tunnel "inlet" is at ...
1
vote
0answers
536 views

SELinux is preventing /usr/sbin/abrtd from create access on the lnk_file .lock

I am getting this error on my CentOS 7 desktop. Following is the detailed log. SELinux is preventing /usr/sbin/abrtd from create access on the lnk_file .lock. ***** Plugin catchall (100. confidence)...
0
votes
4answers
1k views

Can I restrict a user with root privileges(with sudo) from accessing/deleting a specific file?

I want to keep a log-file on my computer. I also want to give privileges to a different account to do all sorts of system specific jobs such as mount volume/install packages etc. So that user has to ...
8
votes
1answer
1k views

How do I set up the SELinux sandbox in Debian?

I've installed SELinux in Debian sid in order to use the sandbox that locks down apps to a restricted environment, but I can't get it to work. If I try to use the sandbox command in permissive mode ...
2
votes
1answer
523 views

Is there a C API to get a SELinux file context?

Is there a way in C to get the SELinux context of a file?
0
votes
0answers
160 views

Is there an option to log console output from package installation executed by kickstart?

I've built an ISO on top of CentOS 6 minimal that bundles some additional packages. Generally it works great, but some recent change I've made has broken it a little: the SELinux module I'm allegedly ...
20
votes
2answers
8k views

What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?

I am planning to go back to Linux as a Desktop machine. I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server. What would be a good, ...
1
vote
0answers
26 views

Satellite 5.7 (Spacewalk 2.3.2) not allowing scripts to be run from upload

I'm trying to make my Satellite 5.7 server installation more secure. I'd like to turn off the function to run scripts from https://mysatserver/pub/upload/up without breaking Satellite. The dir looks ...
1
vote
0answers
215 views

Apache DBD with sqlite3

I'm trying to make apache load basic auth credentials from a sqlite3 database. The configuration I've tried (and many other variations) is: <VirtualHost *> ServerAdmin admin@example.com ...
1
vote
1answer
167 views

How to view SELinux config file

OS: CentOS 7.4.1708 I'm testing SELinux but I can't figure out how to open the config file to view it. I'm sure this is simple but nothing seems to work. How do I do this? Attempt 1) I navigated ...
1
vote
1answer
3k views

Semanage command not found in Fedora 27 droplet from Digital Ocean

Just getting started with Selinux on a Fedora 27 droplet from Digital Ocean. Apparently the semanage command is not installed by default. Every tutorial I've read refers to this command. I need to set ...
1
vote
2answers
657 views

Where does samba_share_t come from

I have samba installed, selinux in enforcing mode, samba shares works fine. But I am not sure where samba_share_t is defined? semanage fcontext -l | grep samba_share_t does not return anything. ...
0
votes
0answers
1k views

systemctl throws error Error getting authority: Error initializing authority:

After upgrading from RHEL7.3 to 7.4 in VM and running systemctl disable xinetd command gives me the following error: Error getting authority: Error initializing authority: GDBus.Error:org.freedesktop....
10
votes
5answers
32k views

openvpn[]: Options error: In [CMD-LINE]:1: Error opening configuration file

when trying to service openvpn start Oct 12 14:02:01 ccushing1 openvpn[9091]: Options error: In [CMD-LINE]:1: Error opening configuration file: devnet-client-vm.conf running openvpn devnet-client-vm....
7
votes
2answers
11k views

SELinux is preventing NGINX from writing via PHP-FPM

I'm using a server to write into a NFS type mount-point via NGINX using php-fpm. At the very first step, it shows me the following error: 2017/01/16 11:32:59 [error] 55463#0: *22 FastCGI sent in ...
2
votes
1answer
476 views

SELinux woes developing systemd extension

All, I'm developing a modification to systemd that will extend systemd-sleep to support calling user-defined scripts on suspend, hybrid-sleep, etc. similar to systemd-sleep. This is working quite ...
0
votes
1answer
232 views

Sanest/safest way to allow root-owned/run script to access file in /root under selinux

I have an autofs program-based map which I wrote, which auto-mounts CIFS shares, taking credentials from a file which is located within the ~/.smb folder of any given user. There can be multiple ...
0
votes
1answer
122 views

Security mechanisms of Debian and CentOS [closed]

Are SELinux, FirewallD and Iptables preinstalled on Debian - Stretch (9 or 9.2) and CentOS (7.4-1708), or do I have to manually install them? Or where can I find it out? Thanks for all your answers.
-2
votes
1answer
96 views

Is there a MAC for Linux that can stop a process on policy violations?

Is there a MAC that can SIGSTOP a process on policy violations so I can resume it with an updated policy to retry the syscall? This would be very handy in case of running interactive untrusted ...
1
vote
1answer
95 views

compgen and SELinux

I have an app, browser shell and I'm executing this command to get list of execuables (List all binaries from $PATH) compgen -A function -abck | sort | uniq and when I call this command It return ...
0
votes
1answer
452 views

How to compile and apply SELinux policy

I'm student. I want to use the policy compiled from the source code. After compiling the policy, the following error statement is displayed. Please tell me how to compile and apply SELinux policy. ...
1
vote
0answers
521 views

Selinux is blocking clamd to open new ports for each Thread

SElinux Enforced on CentOS7 is blocking again clamAV on scanning file operations. Some months ago, I encountered the same issue which I posted here, which at the end I solved doing the following ...
4
votes
1answer
3k views

Cannot change permissions as root on a file owned by root

The problem is that I have PHP files that do not work in the browser. I suspect because the user is missing read permissions. The files are located in a dir called "ajax" drwxrwxrwx. 2 root root ...
0
votes
1answer
360 views

How to allow apache to serve a file written by rsyslogd (selinux)

I have a an application which is run as a systemd service on RHEL7 that makes use of the system journal for logging. To ease monitoring of this application I have configured rsyslogd to write logs ...
5
votes
2answers
482 views

Different hash value of large rsynced file on centos and ubuntu?

I rsynced a large file from remote centos to local ubuntu with rsync -avzP user@<remote-ip>:/path/to/file . It reported the transfer went well: sent 30 bytes received 257,293,476 bytes 1,...
9
votes
1answer
24k views

chcon: can't apply partial context to unlabeled file while installing nagios with SELinux

I'm setting up Nagios core on CentOS with SELINUX=enforcing. I try to run chcon -R -t httpd_sys_content_t /usr/local/nagios/sbin/ as suggested in the manual, but I get this error messages: chcon: ...
2
votes
2answers
415 views

Spacewalk Install failed selinux

Hi I am trying to configure spacewalk on a Centos 7 box for my organization. I am following this guide; https://github.com/spacewalkproject/spacewalk/wiki/HowToInstall#installing-spacewalk I am ...
0
votes
1answer
614 views

SELinux does not allow ps command in PHP

I use this piece of code to check if myservice is running in php. exec("ps -A | grep -i myservicename | grep -v grep 2>&1", $output);. $output is always empty. But after executing setenforce 0 ...
5
votes
1answer
869 views

Apache can't open file that is a symlink

I have a file: js/jquery.terminal-src.js: symbolic link to ../../repo/js/jquery.terminal-src.js and when I try to open it with browser using: http://localhost/projects/jcubic/terminal/test/js/...
1
vote
1answer
270 views

Force set a string as an SELinux context of a file

I wonder if it's possible to force set a given string (e.g. u:object_r:blah_blah_blah:s0) as the SELinux context of a file. Basically I'm going to root an Android x86 installation by placing files ...
4
votes
1answer
1k views

SELinux and docker: allow access to X unix socket in /tmp/.X11-unix

How to allow access to a particular X unix socket for a particular docker container with SELinux enabled? I prefer a solution with a setup of docker run --security-opt. On fedora 25, I found the ...
1
vote
1answer
632 views

Create custom SELinux file context/type from CIL

I'd like to create a new context from my SELinux module (written using the CIL syntax) that will then beu sed for my application's log file so logrotate can access it. However, when I try to semodule -...
27
votes
4answers
88k views

httpd can't write to folder/file because of SELinux

Does anyone know which sebool it is to allow httpd write access to /home/user/html? When I disable SELinux echo 0 > /selinux/enforce I can write, so my problem is definitely related to SELinux. I ...
1
vote
2answers
39 views

Give process permission to only a specific range of local ports

I am looking for a way to prevent a specific process from binding to anything outside of a specific range of local ports. Lets say localhost:50000 - localhost:50050 is an allowed range. I am NOT ...
2
votes
1answer
64 views

Running X without Access to /dev

I am trying to run X on an unrooted Moto Z Play. For that I installed GNURoot which is running a limited version of Debian. One of the limits is that I can't access /dev. This causes startx and also ...
17
votes
3answers
12k views

What roles do DAC (file permissions), ACL and MAC (SELinux) play in Linux file security?

I need some clarification/confirmation/elaboration on the different roles DAC, ACL and MAC play in Linux file security. After some research from the documentation, this is my understanding of the ...
9
votes
2answers
25k views

SELinux httpd write access to a directory

I am new to SELinux. came from debian. I want to give httpd access to a directory. SELinux Alert Browser suggests: # grep httpd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp ...