Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

Filter by
Sorted by
Tagged with
1
vote
1answer
273 views

How to upgrade sudo from 1.8.19p1-1 to 1.8.19p1-2 on debian Stretch to avoid the “ Potential overwrite of arbitrary files” flaw?

I have the sudo 1.8.19p1-1 installed on debian Stretch. I need to install the 1.8.19p1-2 to avoid the Potential overwrite of arbitrary files flaw. Package Type Release Fixed Version ...
0
votes
1answer
62 views

Two Linux Installs Two Swap Spaces

I have two linux installs on my computer. Linux Mint 18 for general use and Subgraph OS because I think the concept sounds cool. I also have a Windows 10 partition for playing games that require ...
3
votes
1answer
150 views

How to access only world readable files in SElinux sandbox

I want to run programs made as student assignments in an SELinux sandbox (to check output and behaviour as a first part of grading the assignments without having to check very closely if some students ...
2
votes
1answer
143 views

Is listening-on connecting-to the same for SELinux?

According to semanage-port(1) ... -a does the same as --add -t does the same as --type -p does the same as --port and the command semanage port -a -t http_port_t -p tcp 81 allows Apache to LISTEN ...
6
votes
1answer
6k views

Which SELinux policies apply to haproxy?

I just bumped into another SELinux related problem. It would seem my haproxy wasn't allowed to open TCP connections to the backend and I was able to fix it quickly using Google. Now, I would like to ...
1
vote
0answers
632 views

Can't access SFTP with SELinux enabled

I've setup SFTP on CentOS 6.8. I've enabled SELinux, but I can't login using SFTP. I get a permission denied message. I did setsebool -P ssh_chroot_rw_homedirs on but didn't work and I'm still ...
1
vote
1answer
938 views

SELinux domain_auto_trans() [closed]

I am trying to get information on domain_auto_trans() function in SELinux. I tried to look in SELinux webpages, but couldn't find a clear definition of the function and its syntax. Can someone please ...
4
votes
1answer
2k views

Cannot disable SELinux in RHEL 7 [closed]

I'm trying to disable SELinux in a rhel7 env installed on aws ec2 instance. I edited the /etc/selinux/config file and set SELINUX=disabled and then I rebooted the system. after the reboot I ran ...
9
votes
2answers
2k views

SELinux not allowing oddjobd-mkhomedir to create user home directory on a non-standard location

We are using SSSD to authenticate users on CentOS servers. oddjobd-mkhomedir works perfectly fine when the default home directory is /home, but on a particular server, we had to change default home ...
1
vote
1answer
290 views

Force set a string as an SELinux context of a file

I wonder if it's possible to force set a given string (e.g. u:object_r:blah_blah_blah:s0) as the SELinux context of a file. Basically I'm going to root an Android x86 installation by placing files ...
6
votes
1answer
10k views

How to copy SELinux context from one directory and apply it to another directory?

How can I copy SELinux context from one directory and apply it to another? Example use scenario is when creating a new local user outside of the default /home path, like this: $ sudo useradd -d /...
0
votes
1answer
605 views

Apache 2.4 can't read user content even with correct security context and booleans set

I have a user's home directory at /data/test_user. I am using indexing to allow browsing this directory via web browser with Apache 2.4. However, all of a sudden I'm getting an issue where I can't see ...
1
vote
2answers
835 views

SELINUX_ERR op=security_bounded_transition

So, a vendor who really doesn't know *nix has a service manager and agent for Red Hat family hosts. (That is to say, the vendor isn't any help, here.) On Oracle Linux 7 with SELinux Enforcing, I can ...
1
vote
1answer
668 views

Create custom SELinux file context/type from CIL

I'd like to create a new context from my SELinux module (written using the CIL syntax) that will then beu sed for my application's log file so logrotate can access it. However, when I try to semodule -...
0
votes
1answer
871 views

Postfix unable to read ssl certs in default location due to SELinux policy on CentOS 6.7

I have installed and configured postfix to use ssl certifcates for sending external mail via a relay. This setup has worked on several other Ubuntu/Centos machines. I have my certificates in: /etc/...
2
votes
1answer
2k views

SELinux Prevents httpd Write Files

I recently setup a website on RHEL7. The SELinux is in Enforcing mode. However, whatever how I tune the context, it always prevents httpd from writing. Here is the audit.log: type=AVC msg=audit(...
3
votes
2answers
555 views

How do I dissect an SELinux SYSCALL message?

So, I have this trio of audit log entries type=AVC msg=audit(1488396169.095:2624951): avc: denied { setrlimit } for pid=16804 comm="bash" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:...
3
votes
0answers
821 views

SELinux prevents fstab auto mount

For a long time I have been running Fedora with disabled SELinux. Since it seems like SELinux is recommended to be running and in targeted mode for desktop use, I decided to enable it. I set it to ...
4
votes
1answer
65 views

How to use SELinux to reject applications' modifications to home directory?

I have grown to be annoyed by applications ignoring the XDG base directory specification. What's the best way to deny applications any changes to the home directory except in the specified ...
1
vote
0answers
59 views

Is it possible to add SELinux policy rule to restrict an application to a memory address range?

Is it possible to add SELinux policy rule to restrict an application to a specific virtual or physical memory address range? If so, which SELinux policy rule allows for a memory range to be specify? ...
22
votes
1answer
1k views

Are SELinux rules enforced before or after standard linux permissions?

When SELinux is installed on a system are its rules enforced before or after the standard linux permissions? For example if a non-root linux user tries to write to a file with linux permission -rw-----...
4
votes
1answer
545 views

Cannot attach to auto-started LXC containers in (Fedora) SELinux

Environment: I am running Fedora 24 with LXC (2.0.6) containers inside and SELinux enabled. Problem: Setting up Linux containers and starting them is all fine, and the same holds for attaching to a ...
7
votes
2answers
12k views

SELinux is preventing NGINX from writing via PHP-FPM

I'm using a server to write into a NFS type mount-point via NGINX using php-fpm. At the very first step, it shows me the following error: 2017/01/16 11:32:59 [error] 55463#0: *22 FastCGI sent in ...
0
votes
1answer
458 views

Does `mv --context` (for selinux, a.k.a. -Z) correctly apply labels recursively to directory contents?

mv -Z applies the default selinux context. Does it differ from all other invocations of mv, and work on all the files in a moved directory individually?
1
vote
1answer
1k views

Selinux on Fedora 25 is not letting me connect to a pptp vpn

I'm not currently in UK and I need to login to my free UK based Spotify account on Fedora 25, the country I'm in isn't supported by Spotify. I tried many free PPTP UK VPN services, they work on other ...
1
vote
1answer
3k views

How to disable all firewall rules and SElinux if runs on CentOS7

I try to connect a NIS server on CentOS 7.3 and a NIS client on raspbian 8.0 together. My problem is that raspbian does not want to bind the server. journalctl server the following entry: ...
0
votes
1answer
390 views

Cannot execute script after installing SELinux

I have script in /home/ubuntu/bin/ which I have added to the PATH variable. After installing SeLinux and enabling it in permissive mode it (SELINUX=permissive in/etc/selinux/config`), I am unable to ...
4
votes
1answer
40 views

How to change SELinux configuration persistently?

With setsebool <name_of_variable> <on/off> it is possible to change selinux configuration. However the changes are gone after reboot. How can we do these changes persistently?
2
votes
0answers
75 views

System-Level Network Security (Packet Classification and etc.) - SELinux and Libnftnl

I asked the same question in the Security forum, but since no respond did I get, I'm posting it here either. I read that Libnftnl is a userspace library providing a low-level netlink programming ...
5
votes
2answers
503 views

Different hash value of large rsynced file on centos and ubuntu?

I rsynced a large file from remote centos to local ubuntu with rsync -avzP user@<remote-ip>:/path/to/file . It reported the transfer went well: sent 30 bytes received 257,293,476 bytes 1,...
1
vote
1answer
260 views

Is it possible to enable an SELinux boolean in a policy module?

audit2allow creates fine-grained policy modules, but often hints that an existing boolean represents a superset of a policy line. For example: #!!!! This avc can be allowed using the boolean '...
0
votes
1answer
585 views

audit2allow asks for a path when setting up nginx

To setup nginx on centos7, I used to run: grep nginx /var/log/audit/audit.log | audit2allow -M nginxse and it worked fine, but apparently on an updated system, it is different. audit2allow complains:...
0
votes
1answer
1k views

How do I install and use Galera and MariaDB 10.1 on RHEL or CentOS with SELinux Enabled

How do I install and use Galera and MariaDB >= version 10.1 with TLS on RHEL 7 or CentOS 7 and keep SELinux enabled in enforcing mode without using SCL (software collections)?
4
votes
1answer
116 views

Is it possible to drop all write privileges in a shell for the current user

This is NOT for security purposes. Suppose I wanted to execute a shell script and, on a best effort basis, assume it left no side effects aside from things like auditd logging, avc reports, syslog, ...
2
votes
2answers
1k views

apache httpd is not able to connect to the internet

I run a Apache2 (httpd) server for Dokuwiki. Dokuwiki cannot use its upgrade or install plugin feature (see Question here). It seems that the user apache is not able to access the network/internet. ...
1
vote
1answer
141 views

How to limit ecryptfs access to a group of processes

I would like to have a script that does the following: Mounts an encrypted directory using ecryptfs Sets up permissions so that only a bash shell launched by it and any processes inheriting from ...
1
vote
3answers
76 views

How to design a mutiple level password security for one user

I am wondering if it was possible to have an enhanced version of PAM that implement a login with multiple level passwords. For instance, I am interesting requiring not 1 but 3 different passwords to ...
1
vote
1answer
331 views

SELinux: How do you create a custom label for files?

According to this link, how to create a custom SELinux label, they show that you can use sepolgen on /path/to/binary. But what if I'm not working on a binary? I want to make my directory to become a ...
1
vote
0answers
34 views

SELinux: How do you give access to only few processes to a /mnt/foo directory?

I am having so much trouble trying to make only very few processes allowed access for a specific mounted directory. Here are some of the questions for why I'm getting so lost. Assume that the mounted ...
1
vote
2answers
730 views

Why does “attr -l .” tell me about an “selinux” attribute that “attr -g selinux .” refuses to read?

I'm setting up a Fedora (Core) 24 system from scratch, and ran into this oddness: > sudo attr -l . Attribute "selinux" has a 41 byte value for . > sudo attr -g selinux . attr_get: No data ...
1
vote
1answer
1k views

selinux started blocking php “exec” calls after yum update

I've used the PHP exec command to issue lpr -P printer_name /var/www/html/somefile.pdf but after a RHEL system update (7.2 to 7.3), selinux has decided to start blocking these requests. selinux ...
0
votes
1answer
208 views

CentOS 7: Nesting SELinux rules

So, now that I've figured out that .ssh files need the ssh_home_t file context, now I need to figure out how to nest SELinux rules. My first problem is that I can't find any list of SELinux file ...
1
vote
1answer
957 views

Sharing / (root) Linux directory with Samba, CentOS 7

I'm using CentOS 7! I want to know if is possible share root / Linux directory. In root mode: # kwrite /etc/samba/smb.conf Here the line contents [global] workgroup = MyGroup server string = ...
1
vote
0answers
1k views

How do i add redis to selinux so that it's permissive?

I'm new to SELinux and CentOS, I have two vm's running a minimal centos7, I've configured firewall-cmd for the default redis port, but the only way I've been able to get the two vm's allowing redis to ...
10
votes
1answer
5k views

how to create a custom SELinux label

I wrote a service/single binary app that I'm trying to run on Fedora 24, it runs using systemd, the binary is deployed to /srv/bot this service/app I wrote needs to create/open/read and rename files ...
3
votes
1answer
2k views

systemd-nspawn OS container is unusable because I can't set the root password

I combined the detailed instructions from the original blog post, and the more up to date instructions from the man page (using dnf instead of yum). # sudo dnf -y --releasever=24 --installroot=$HOME/...
2
votes
0answers
358 views

SELinux: determine directory of denied file creation

Using SELinux, I got this AVC: type=AVC msg=audit(1472867145.344:215): avc: denied { create } for pid=2434 comm="google-chrome" name="63" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0....
2
votes
0answers
120 views

selinux user add becoming progressively slower

I've written a service that configures a machine with selinux users who can manage a single port. I'm trying to pre-seed that machine with 1000 users, but selinux is crawling to a halt around user ...
0
votes
1answer
293 views

Installing only a certain subpackage from src.RPM, Raspbian

Attempting to install setroubleshoot-server from source, as there are no ARM71 packages(error recieved from Alien rpm package installer when using arm7hl). Default compilation from an extracted src....
3
votes
2answers
1k views

SELINUX won't enable [closed]

I just checked to see if SELINUX was enabled on my server like this [root@fedora ~]# getenforce Disabled However, when I look at the /etc/selinux/config file I see this # This file controls the ...