Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

Filter by
Sorted by
Tagged with
1
vote
1answer
250 views

How to upgrade sudo from 1.8.19p1-1 to 1.8.19p1-2 on debian Stretch to avoid the “ Potential overwrite of arbitrary files” flaw?

I have the sudo 1.8.19p1-1 installed on debian Stretch. I need to install the 1.8.19p1-2 to avoid the Potential overwrite of arbitrary files flaw. Package Type Release Fixed Version ...
2
votes
0answers
119 views

selinux user add becoming progressively slower

I've written a service that configures a machine with selinux users who can manage a single port. I'm trying to pre-seed that machine with 1000 users, but selinux is crawling to a halt around user ...
0
votes
1answer
59 views

Two Linux Installs Two Swap Spaces

I have two linux installs on my computer. Linux Mint 18 for general use and Subgraph OS because I think the concept sounds cool. I also have a Windows 10 partition for playing games that require ...
3
votes
0answers
755 views

SELinux prevents fstab auto mount

For a long time I have been running Fedora with disabled SELinux. Since it seems like SELinux is recommended to be running and in targeted mode for desktop use, I decided to enable it. I set it to ...
3
votes
1answer
699 views

SELinux: chcon to a type, ls -Z shows another one

When I do chcon -v -t httpd_sys_script_ro_t a_folder_at_home/ And then: ls -dZ I got: DACs user grp unconfined_u:object_r:httpd_sys_content_t:s0 a_folder_at_home/ In case of error I would have ...
2
votes
1answer
124 views

Is listening-on connecting-to the same for SELinux?

According to semanage-port(1) ... -a does the same as --add -t does the same as --type -p does the same as --port and the command semanage port -a -t http_port_t -p tcp 81 allows Apache to LISTEN ...
6
votes
1answer
5k views

Which SELinux policies apply to haproxy?

I just bumped into another SELinux related problem. It would seem my haproxy wasn't allowed to open TCP connections to the backend and I was able to fix it quickly using Google. Now, I would like to ...
11
votes
8answers
5k views

How to prevent a process from writing files

I want to run a command on Linux in a way that it cannot create or open any files to write. It should still be able to read files as normal (so an empty chroot is not an option), and still be able to ...
1
vote
1answer
793 views

SELinux domain_auto_trans() [closed]

I am trying to get information on domain_auto_trans() function in SELinux. I tried to look in SELinux webpages, but couldn't find a clear definition of the function and its syntax. Can someone please ...
1
vote
0answers
348 views

What do the dark colored packages mean in dnf list output? [closed]

I want to install an older version of selinux in order to install nvidia driver, dnf list shows there is an old package 3.13.1-225.11.fc25, how can I install that ? I tried dnf install selinux-policy-...
3
votes
1answer
7k views

SELinux Write access for vsftpd and samba

This should be easy enough I think, but I'm new to SELinux. I have a CentOS 6 file server. I have some LVM file systems at /var/media and I want to use both Samba and FTP to share them with a Windows ...
6
votes
1answer
8k views

How to copy SELinux context from one directory and apply it to another directory?

How can I copy SELinux context from one directory and apply it to another? Example use scenario is when creating a new local user outside of the default /home path, like this: $ sudo useradd -d /...
0
votes
1answer
406 views

Does `mv --context` (for selinux, a.k.a. -Z) correctly apply labels recursively to directory contents?

mv -Z applies the default selinux context. Does it differ from all other invocations of mv, and work on all the files in a moved directory individually?
0
votes
1answer
529 views

Apache 2.4 can't read user content even with correct security context and booleans set

I have a user's home directory at /data/test_user. I am using indexing to allow browsing this directory via web browser with Apache 2.4. However, all of a sudden I'm getting an issue where I can't see ...
1
vote
2answers
777 views

SELINUX_ERR op=security_bounded_transition

So, a vendor who really doesn't know *nix has a service manager and agent for Red Hat family hosts. (That is to say, the vendor isn't any help, here.) On Oracle Linux 7 with SELinux Enforcing, I can ...
0
votes
1answer
750 views

Postfix unable to read ssl certs in default location due to SELinux policy on CentOS 6.7

I have installed and configured postfix to use ssl certifcates for sending external mail via a relay. This setup has worked on several other Ubuntu/Centos machines. I have my certificates in: /etc/...
0
votes
1answer
1k views

How do I install and use Galera and MariaDB 10.1 on RHEL or CentOS with SELinux Enabled

How do I install and use Galera and MariaDB >= version 10.1 with TLS on RHEL 7 or CentOS 7 and keep SELinux enabled in enforcing mode without using SCL (software collections)?
2
votes
4answers
3k views

How do I find/list all files on filesystem with a certain SELinux “fcontext”

I'm having trouble finding information on what command, presumably from setools, I should use to find all the files on my filesystem that are labeled by SELinux with a certain file-context (fcontext). ...
4
votes
1answer
62 views

How to use SELinux to reject applications' modifications to home directory?

I have grown to be annoyed by applications ignoring the XDG base directory specification. What's the best way to deny applications any changes to the home directory except in the specified ...
3
votes
2answers
518 views

How do I dissect an SELinux SYSCALL message?

So, I have this trio of audit log entries type=AVC msg=audit(1488396169.095:2624951): avc: denied { setrlimit } for pid=16804 comm="bash" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:...
1
vote
1answer
1k views

Selinux on Fedora 25 is not letting me connect to a pptp vpn

I'm not currently in UK and I need to login to my free UK based Spotify account on Fedora 25, the country I'm in isn't supported by Spotify. I tried many free PPTP UK VPN services, they work on other ...
2
votes
1answer
1k views

How to read/change SELinux context on mounted ext4 image from non-SELinux system?

I have a Linux system (Arch Linux) without SELinux support. I would not like to configure such support on my system. Now, I have an ext4 volume image which is known to have some SELinux context set on ...
1
vote
0answers
55 views

Is it possible to add SELinux policy rule to restrict an application to a memory address range?

Is it possible to add SELinux policy rule to restrict an application to a specific virtual or physical memory address range? If so, which SELinux policy rule allows for a memory range to be specify? ...
21
votes
1answer
1k views

Are SELinux rules enforced before or after standard linux permissions?

When SELinux is installed on a system are its rules enforced before or after the standard linux permissions? For example if a non-root linux user tries to write to a file with linux permission -rw-----...
2
votes
1answer
446 views

Recreating local selinux contexts after OS Reinstallation

We have added a few specific contexts to our SELinux via the "semanage fcontext ..." command. The patterns are stored in /etc/selinux/targetd/contexts/files/file_contexts.local. Assuming that we ...
1
vote
1answer
3k views

How to disable all firewall rules and SElinux if runs on CentOS7

I try to connect a NIS server on CentOS 7.3 and a NIS client on raspbian 8.0 together. My problem is that raspbian does not want to bind the server. journalctl server the following entry: ...
3
votes
1answer
942 views

Restrict applications to access certain hardware (webcam, microphone…)

If I tell applications like VLC or Audacity to record from my webcam or microphone, they just wake the hardware if sleeping and do their work without my interference. Although this is a good thing, I'...
0
votes
1answer
332 views

Cannot execute script after installing SELinux

I have script in /home/ubuntu/bin/ which I have added to the PATH variable. After installing SeLinux and enabling it in permissive mode it (SELINUX=permissive in/etc/selinux/config`), I am unable to ...
4
votes
1answer
39 views

How to change SELinux configuration persistently?

With setsebool <name_of_variable> <on/off> it is possible to change selinux configuration. However the changes are gone after reboot. How can we do these changes persistently?
2
votes
0answers
71 views

System-Level Network Security (Packet Classification and etc.) - SELinux and Libnftnl

I asked the same question in the Security forum, but since no respond did I get, I'm posting it here either. I read that Libnftnl is a userspace library providing a low-level netlink programming ...
0
votes
1answer
196 views

CentOS 7: Nesting SELinux rules

So, now that I've figured out that .ssh files need the ssh_home_t file context, now I need to figure out how to nest SELinux rules. My first problem is that I can't find any list of SELinux file ...
1
vote
0answers
215 views

Is it possible to enable an SELinux boolean in a policy module?

audit2allow creates fine-grained policy modules, but often hints that an existing boolean represents a superset of a policy line. For example: #!!!! This avc can be allowed using the boolean '...
0
votes
1answer
525 views

audit2allow asks for a path when setting up nginx

To setup nginx on centos7, I used to run: grep nginx /var/log/audit/audit.log | audit2allow -M nginxse and it worked fine, but apparently on an updated system, it is different. audit2allow complains:...
2
votes
2answers
475 views

How to use chcon without selinux?

On my system I don't have selinux set up, but I have a removeable disk containing an EXT4 filesystem from a machine that does use selinux. I need to change a file's context on that filesystem. chcon ...
1
vote
1answer
1k views

How to determine current SELinux context within a script

I'm trying to get an existing application running under SELinux which is causing endless pain. Matters would be eased somewhat if I knew what contexts the various components were running in - users ...
1
vote
1answer
285 views

SELinux: How do you create a custom label for files?

According to this link, how to create a custom SELinux label, they show that you can use sepolgen on /path/to/binary. But what if I'm not working on a binary? I want to make my directory to become a ...
1
vote
1answer
130 views

How to limit ecryptfs access to a group of processes

I would like to have a script that does the following: Mounts an encrypted directory using ecryptfs Sets up permissions so that only a bash shell launched by it and any processes inheriting from ...
1
vote
3answers
70 views

How to design a mutiple level password security for one user

I am wondering if it was possible to have an enhanced version of PAM that implement a login with multiple level passwords. For instance, I am interesting requiring not 1 but 3 different passwords to ...
1
vote
0answers
34 views

SELinux: How do you give access to only few processes to a /mnt/foo directory?

I am having so much trouble trying to make only very few processes allowed access for a specific mounted directory. Here are some of the questions for why I'm getting so lost. Assume that the mounted ...
3
votes
2answers
424 views

Backup seLinux system running strict

I have a cron job that is backing up a SELinux system running in strict mode. The problem is that SELinux wants to deny access to to the backup script since it wants access to every single file on the ...
9
votes
2answers
2k views

What is the best way to learn SELinux? [closed]

I want to learn SELinux to a high level, being able to understand the intricacies of domains, types and switching. What is the best way to go about this? I considered starting with Fedora and a good ...
2
votes
1answer
10k views

chcon: failed to change context of `/etc/oddjobd.conf.d' to `unconfined_u:object_r:oddjob_t:s0': Permission denied

A friend of mine had trouble with SELinux. The server is configured with SELinux in enforcing mode, using the targeted policy. When using Puppet, restorecon or chcon, he had errors like this, even if ...
2
votes
1answer
774 views

SELinux + MergerFS (fuse) not working well together

I have been trying now for several days to get my new server up and running. I am running CentOS with MergerFS to pool my drives and samba to host to my windows machines. All of this running in ...
1
vote
0answers
1k views

How do i add redis to selinux so that it's permissive?

I'm new to SELinux and CentOS, I have two vm's running a minimal centos7, I've configured firewall-cmd for the default redis port, but the only way I've been able to get the two vm's allowing redis to ...
8
votes
1answer
5k views

how to create a custom SELinux label

I wrote a service/single binary app that I'm trying to run on Fedora 24, it runs using systemd, the binary is deployed to /srv/bot this service/app I wrote needs to create/open/read and rename files ...
2
votes
0answers
355 views

SELinux: determine directory of denied file creation

Using SELinux, I got this AVC: type=AVC msg=audit(1472867145.344:215): avc: denied { create } for pid=2434 comm="google-chrome" name="63" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0....
3
votes
1answer
1k views

systemd-nspawn OS container is unusable because I can't set the root password

I combined the detailed instructions from the original blog post, and the more up to date instructions from the man page (using dnf instead of yum). # sudo dnf -y --releasever=24 --installroot=$HOME/...
17
votes
2answers
4k views

Does SELinux provide enough extra security to be worth the hassle of learning/setting it up?

I recently installed Fedora 14 on my home pc and have been working on setting up different server related features such as apache, mysql, ftp, vpn, ssh, etc. I ran extremely quickly in to a barrier ...
0
votes
1answer
265 views

Installing only a certain subpackage from src.RPM, Raspbian

Attempting to install setroubleshoot-server from source, as there are no ARM71 packages(error recieved from Alien rpm package installer when using arm7hl). Default compilation from an extracted src....
1
vote
2answers
876 views

why isn't .htaccess redirecting requests on CentOS 7?

A web app running on CentOS 7 with Apache 2.4 recently changed its domain name from olddomain.com to newdomain.com. The structure of the app at the newdomain.com is different than on the olddomain....