Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

Filter by
Sorted by
Tagged with
1
vote
1answer
311 views

Cannot stop SELinux from blocking Apache accessing /usr/local/nagios/var/rw/nagios.cmd

I have a Centos 7 server running Nagios Core 4.3.4 with Apache 2.4.6 in our UAT environment. I have a second server in PROD that was set up with the same Ansible playbook. Nagios was built from ...
1
vote
1answer
209 views

Permissions on a folder stopping Nginx from starting

I am fairly new to Linux. I have a couple of websites that I want to host on my CentOS 7 VPS with Nginx. Nginx ought to start on start up, but it is failing due to some permissions issue, I know what ...
0
votes
2answers
2k views

chcon: can't apply partial context to unlabeled file

I get the following when trying to allow httpd to write to application specific directories. [xxx MISP]# chcon -t httpd_sys_rw_content_t /var/www/MISP/app/files chcon: can't apply partial context to ...
3
votes
1answer
590 views

What is map access in the context of SELinux

I am hitting an issue with SELinux where it tells me SELinux is preventing sh from map access on the file /bin/busybox. and then it tells me If you believe that sh should be allowed map access on ...
0
votes
0answers
214 views

SELinux setsebool command fails on Google compute engine

I am trying to setup my website (LAMP stack, CentOS 6.9) on Google compute engine. I use PHPMailer to send mails (Registration, Singup, Login, etc.) I have setup smtp & all that good stuff in G-...
0
votes
0answers
725 views

Selinux and cgi-bin -> permission denied.

Trying to get a hello-world Perl script to run in the standard cgi-bin location /var/www/cgi-bin/test.pl with RHEL 7. I get a permission denied in the httpd error log only when selinux set to ...
0
votes
1answer
65 views

What do “--”, “-d”, etc in file_contexts mean?

In /etc/selinux/targeted/contexts/files/file_contexts, some lines will have just two parts, with the context as the second part, but some will have three parts where the second part is --, -d, etc. ...
1
vote
2answers
197 views

MariaDB slave server shall connect to 127.0.0.1:3307 to reach master. SELinux says no. What do?

I have a MariaDB server on CentOS 7. The server shall play slave and replicate the a remote master server. The remote master server can be reached through an SSH tunnel. The SSH tunnel "inlet" is at ...
1
vote
0answers
564 views

SELinux is preventing /usr/sbin/abrtd from create access on the lnk_file .lock

I am getting this error on my CentOS 7 desktop. Following is the detailed log. SELinux is preventing /usr/sbin/abrtd from create access on the lnk_file .lock. ***** Plugin catchall (100. confidence)...
1
vote
2answers
533 views

Can't delete and remove SELinux context or ACL from a symlink in /usr/lib under root

I'm on Fedora 27 and experience problems with updating the packages by dnf update. The problem is exactly as described here: https://superuser.com/q/1005740/683161 I tried to delete symlink under /...
2
votes
1answer
561 views

Is there a C API to get a SELinux file context?

Is there a way in C to get the SELinux context of a file?
0
votes
0answers
175 views

Is there an option to log console output from package installation executed by kickstart?

I've built an ISO on top of CentOS 6 minimal that bundles some additional packages. Generally it works great, but some recent change I've made has broken it a little: the SELinux module I'm allegedly ...
3
votes
2answers
1k views

Weird audit2why message caused by SELinux

When I run audit2why to see why there is a failure when trying to upload files via SCP to folder /foo/bar on a remote server which results in access denied to folder /foo/bar, I get the following text:...
1
vote
0answers
26 views

Satellite 5.7 (Spacewalk 2.3.2) not allowing scripts to be run from upload

I'm trying to make my Satellite 5.7 server installation more secure. I'd like to turn off the function to run scripts from https://mysatserver/pub/upload/up without breaking Satellite. The dir looks ...
1
vote
0answers
231 views

Apache DBD with sqlite3

I'm trying to make apache load basic auth credentials from a sqlite3 database. The configuration I've tried (and many other variations) is: <VirtualHost *> ServerAdmin admin@example.com ...
2
votes
1answer
585 views

How to identify dac_override cause on Android?

I am working on some Android customizations and an app I am writing causes a dac_override which looks like so in dmesg: type=1400 audit(499405.329:16): avc: denied { dac_override } for pid=1103 comm=...
1
vote
1answer
168 views

How to view SELinux config file

OS: CentOS 7.4.1708 I'm testing SELinux but I can't figure out how to open the config file to view it. I'm sure this is simple but nothing seems to work. How do I do this? Attempt 1) I navigated ...
0
votes
4answers
1k views

Can I restrict a user with root privileges(with sudo) from accessing/deleting a specific file?

I want to keep a log-file on my computer. I also want to give privileges to a different account to do all sorts of system specific jobs such as mount volume/install packages etc. So that user has to ...
4
votes
1answer
651 views

How to install SELinux policy manpage?

How to install the manpage httpd_selinux on CentOS 7.4? It's not included in the packages httpd, httpd-tools, or httpd-manual. A yum whatprovides "*/httpd_selinux" search returned no results. (...
0
votes
0answers
1k views

systemctl throws error Error getting authority: Error initializing authority:

After upgrading from RHEL7.3 to 7.4 in VM and running systemctl disable xinetd command gives me the following error: Error getting authority: Error initializing authority: GDBus.Error:org.freedesktop....
8
votes
1answer
9k views

Core difference between SELinux and Apparmor

What is the core [or kernel level] difference of SELinux and Apparmor?
1
vote
1answer
3k views

Semanage command not found in Fedora 27 droplet from Digital Ocean

Just getting started with Selinux on a Fedora 27 droplet from Digital Ocean. Apparently the semanage command is not installed by default. Every tutorial I've read refers to this command. I need to set ...
2
votes
1answer
542 views

SELinux woes developing systemd extension

All, I'm developing a modification to systemd that will extend systemd-sleep to support calling user-defined scripts on suspend, hybrid-sleep, etc. similar to systemd-sleep. This is working quite ...
0
votes
1answer
251 views

Sanest/safest way to allow root-owned/run script to access file in /root under selinux

I have an autofs program-based map which I wrote, which auto-mounts CIFS shares, taking credentials from a file which is located within the ~/.smb folder of any given user. There can be multiple ...
2
votes
2answers
2k views

selinux is causing “nexus.service: Failed at step EXEC spawning /opt/nexus/bin/nexus: Permission denied” Fedora 26, nexus 3.06

After installing the latest version of nexus, currently 3.6.0, I'm able to start it by using the manual command /opt/nexus/bin/nexus start but when trying to start as a service (per directions ...
0
votes
1answer
124 views

Security mechanisms of Debian and CentOS [closed]

Are SELinux, FirewallD and Iptables preinstalled on Debian - Stretch (9 or 9.2) and CentOS (7.4-1708), or do I have to manually install them? Or where can I find it out? Thanks for all your answers.
1
vote
1answer
99 views

compgen and SELinux

I have an app, browser shell and I'm executing this command to get list of execuables (List all binaries from $PATH) compgen -A function -abck | sort | uniq and when I call this command It return ...
-2
votes
1answer
97 views

Is there a MAC for Linux that can stop a process on policy violations?

Is there a MAC that can SIGSTOP a process on policy violations so I can resume it with an updated policy to retry the syscall? This would be very handy in case of running interactive untrusted ...
0
votes
1answer
464 views

How to compile and apply SELinux policy

I'm student. I want to use the policy compiled from the source code. After compiling the policy, the following error statement is displayed. Please tell me how to compile and apply SELinux policy. ...
5
votes
2answers
5k views

Configure SELinux to allow daemons to use files in non-default locations

I have a daemon (apache/samba/vsftpd/...) running on SELinux enabled system and I need to allow it to use files in a non-default location. The standard file permissions are configured to allow access. ...
1
vote
0answers
531 views

Selinux is blocking clamd to open new ports for each Thread

SElinux Enforced on CentOS7 is blocking again clamAV on scanning file operations. Some months ago, I encountered the same issue which I posted here, which at the end I solved doing the following ...
4
votes
1answer
4k views

Cannot change permissions as root on a file owned by root

The problem is that I have PHP files that do not work in the browser. I suspect because the user is missing read permissions. The files are located in a dir called "ajax" drwxrwxrwx. 2 root root ...
2
votes
1answer
2k views

Sharing a mounted drive with samba on CentOS7

CentOS 7, samba issue: 0 Files/Folders when trying to share USB drive with EXT4 file system. Samba Configuration file: [global] workgroup = WORKGROUP server string = Samba Server %v netbios name = ...
2
votes
2answers
426 views

Spacewalk Install failed selinux

Hi I am trying to configure spacewalk on a Centos 7 box for my organization. I am following this guide; https://github.com/spacewalkproject/spacewalk/wiki/HowToInstall#installing-spacewalk I am ...
5
votes
1answer
913 views

Apache can't open file that is a symlink

I have a file: js/jquery.terminal-src.js: symbolic link to ../../repo/js/jquery.terminal-src.js and when I try to open it with browser using: http://localhost/projects/jcubic/terminal/test/js/...
0
votes
1answer
644 views

SELinux does not allow ps command in PHP

I use this piece of code to check if myservice is running in php. exec("ps -A | grep -i myservicename | grep -v grep 2>&1", $output);. $output is always empty. But after executing setenforce 0 ...
4
votes
1answer
2k views

SELinux and docker: allow access to X unix socket in /tmp/.X11-unix

How to allow access to a particular X unix socket for a particular docker container with SELinux enabled? I prefer a solution with a setup of docker run --security-opt. On fedora 25, I found the ...
1
vote
3answers
4k views

ping: socket: Permission denied

We are developing an admin UI for our product in PHP. It is hosted on Centos 7 and Apache web server. User should be able to ping an IP address using this UI. So we need to call exec(IPAddress) in PHP ...
1
vote
2answers
41 views

Give process permission to only a specific range of local ports

I am looking for a way to prevent a specific process from binding to anything outside of a specific range of local ports. Lets say localhost:50000 - localhost:50050 is an allowed range. I am NOT ...
2
votes
1answer
64 views

Running X without Access to /dev

I am trying to run X on an unrooted Moto Z Play. For that I installed GNURoot which is running a limited version of Debian. One of the limits is that I can't access /dev. This causes startx and also ...
0
votes
1answer
372 views

How to allow apache to serve a file written by rsyslogd (selinux)

I have a an application which is run as a systemd service on RHEL7 that makes use of the system journal for logging. To ease monitoring of this application I have configured rsyslogd to write logs ...
1
vote
1answer
2k views

SELinux prevents running command when using systemd on Fedora 25

I'm trying to run OpenVPN on a network namespace myns through systemd on Fedora 25. It looks like SELinux is preventing it from working. Looking at journalctl -xe, I think this is the relevant part: ...
2
votes
2answers
71 views

Why does selinux deny starting services from default_t?

A new top-level directory was created, gaining the default label for new top-level directories, default_t. SELinux denies starting a service if ExecStart is a program created in a new top-level ...
1
vote
1answer
33 views

SELinux alert: Why is the start chopped off the process name?

I have a service hdparm-noapm.service with ExecStart=/ansible-managed/sourcejedi.hdparm-noapm/hdparm.sh. Thanks to SELinux, it is denied. The SELinux error popup (sealert) says The source process: (...
4
votes
1answer
1k views

SELinux File Context, restorecon doesn't change 'user' Context

Using matchpathcon against a file (e.g. /usr/lib64/gconv/gconv-modules.cache) I get: /usr/lib64/gconv/gconv-modules.cache system_u:object_r:lib_t:s0 However: # ls -alZ /usr/lib64/gconv/gconv-...
0
votes
1answer
316 views

Selinux - Looking for some policy that is blocking clamd to open new ports for each Thread

Trying to keep SElinux Enforced on CentOS and allowing clamAV to scan files. But it seems that SElinux does not like the following behavior of clamd: Clamd is listening on a predefined TCP port ...
3
votes
1answer
766 views

How to setup recent stable SELinux policies in Debian 8.7?

I am following the step 12 of the guide here, but did not find any policies that are recent and stable, only "old" things there and unstable. Code and output masi@masi:~$ apt search SELinux | grep ...
0
votes
1answer
2k views

SELinux is preventing /usr/bin/bash from execute access on the file myfilename.sh in nginx via php-fpm

Background: I have two CentOS7 servers. Test & Prod. There is a script myfilename.sh in my website, which is executed in php by shell_exec. Script and all parent folders in both servers have ...
1
vote
0answers
245 views

SELinux User Role Gotchas

New security policy mandates that system administrators on RHEL systems must be mapped to either sysadm_U or staff_u role and 'normal' users must be mapped to user_u roles. Previous to this we ...
0
votes
2answers
2k views

Installed SELinux on Ubuntu 14.04 and system is not bootable now

I was trying to learn a bit about SELinux on my Ubuntu 14.04 and did not realize that it already had AppArmor which SELinux un-installs during its own installation process. I installed two packages ...