Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

Filter by
Sorted by
Tagged with
2
votes
0answers
118 views

netutils_t cannot open initrc_tmp_t files

I'm running SELinux (in permissive mode) on RHEL 6.5 and seeing a strange denied error in my audit.log. Supposedly, the netutils_t process type can manage files labeled with the initrc_tmp_t type, but ...
1
vote
1answer
82 views

How nginx is able to access its default virtual host files when selinux is enabled?

From what I can tell, nginx is running in httpd_t security context, while index.html, for instance, is of usr_t one: $ ps auxZ | grep 'nginx.*worker' system_u:system_r:httpd_t:s0 nginx 13734 0....
1
vote
1answer
1k views

How to determine current SELinux context within a script

I'm trying to get an existing application running under SELinux which is causing endless pain. Matters would be eased somewhat if I knew what contexts the various components were running in - users ...
2
votes
2answers
5k views

SELinux issue Full path required for exclude: net:[4026532292]

I am trying to set samba context on directory with following command and I am not sure what this error is about but I can not set the context on directory. semanage fcontext -a -t samba_share_t "/...
0
votes
1answer
283 views

running apache on fedora/selinux/no setroubleshoot messages on desktop

I have installed fedora 24 installed from scratch via iso image. I have httpd started and can see the default page if I access "localhost". Now I want to add a directory which should contain files ...
1
vote
0answers
53 views

How can I protect SELinux labels from being modified?

I'm running Fedora 23. I have SELinux enabled and enforced. I know that you can change a file's labels with restorecon and chcon (and possibly other programs). This is no doubt an avenue by which a ...
2
votes
0answers
141 views

Restrict /proc/mounts to avoid exposure of /run/user/

EDIT: Currently looking at this solution.. (namespaces), but still wouldn't mind any pointers for doing what I'm after another way. We have a custom SELinux policy on CentOS 7.2 which confines users ...
1
vote
1answer
830 views

Use SELinux to restrict a directory to a particular user

I have a couple of questions: (Sysadmins tasks) Here is what I asked to do Create user Tim and add him to the supplementary group Webdev (Create the group if it doesn't exist), also Set Tim's ...
0
votes
1answer
3k views

selinux blocking vsftpd directory listing

I am trying to get a better understanding of selinux and configuring a local ftp repository on Centos7. I installed vsftpd on my host. I created a repository on my host: /var/ftp/pub/centos7 EFI ...
0
votes
1answer
745 views

Failed to start PostgreSQL 9.5 with systemctl - SELinux

I've installed PG 9.5 (/usr/pgsql-9.5/) and when I start it manually with postgres -D it has no problems, but if I try to use systemctl I get an error. By looking to journalctl -xen output, I see: /...
1
vote
0answers
242 views

Cannot add group on RHEL desktop

Question: why does the groupadd fail here? Is it related to SELinux or maybe a bug? I found the mv /etc/group+ /etc/group problem via strace groupadd.. [root@notebook ~]# groupadd testing groupadd:...
5
votes
1answer
4k views

How to work out why Apache is attempting “execmem”?

I'm getting audit messages from SELinux saying that it denied Apache doing execmem: type=AVC msg=audit(05/06/16 19:51:43.058:181060) : avc: denied { execmem } for pid=123456 comm=httpd scontext=...
1
vote
1answer
156 views

SELinux restorecon

I am trying to export a Samba share and changing its SELinux fcontext to 'samba_share_t'. However in the guide that I follow after changing the fcontext, I need to run 'restorecon' over the exported ...
2
votes
0answers
154 views

SELINUX not installing on Hyper-V Debian Jessie VM [closed]

I'm currently trying to install SELinux on Debian Jessie VM. I'm following the instructions on the Debian website here Once I've completed the installation, I make a change to /etc/default/rcS to ...
1
vote
0answers
359 views

selinux on squashfs with overlayfs

Is it possible to use SELinux on a system with a squashfs root with an overlayfs overlay for read-write operations? On funtoo (gentoo), I booted with SELinux enabled in permissive mode to see what ...
1
vote
1answer
314 views

Restart a service through apache

I am using CentOS 6.6 I trying to call service command in PHP code exec("sudo -u kouser bash ./1.bash 2>&1",$output,$code); 1.bash #!/bin/bash sudo service httpd graceful The output of ...
1
vote
0answers
558 views

Can SELinux filter system calls?

Let's say I want to restrict use of the system call shutdown to /sbin/mount or filter the arguments that get passed to the system call mount. Can SELinux policy be used to achieve this?
1
vote
1answer
60 views

Standard Package updates of selinux-policy-*

I am wondering if after installing an update of a selinux-policy-* package you are using, do you need to reset all the labels in the system (i.e. fixfiles onboot) in order to keep the policy effective?...
2
votes
1answer
1k views

How to read/change SELinux context on mounted ext4 image from non-SELinux system?

I have a Linux system (Arch Linux) without SELinux support. I would not like to configure such support on my system. Now, I have an ext4 volume image which is known to have some SELinux context set on ...
2
votes
0answers
193 views

Benchmarking under SELinux Sandbox with Phoronix Test Suite

I would like to run the Phoronix Test Suite 6.2.2 under the SELinux sandbox on Fedora 23, but I can't execute it using $ sandbox ./phoronix-test-suite. I probably don't have the correct SELinux type. ...
2
votes
1answer
67 views

Adding fcontext to unconfined application

This feels like the most horrid twist of fate ever... A user is having me setup tomEE (apache-tomee-jaxrs-1.7.4). This is on a RHEL6 machine. I've installed from the tarball available from apache's ...
2
votes
2answers
859 views

SELinux, ProFTPd and the silent log

I need a FTP server on my machine, a Fedora 23. I want a simple setup, and I decided for ProFTPd and authentication with mod_auth_unix.c (this is just about my machine). I installed ProFTPd and ...
2
votes
0answers
138 views

Defining a group of ports for SELinux

At my organization, we use a piece of software for instrumenting and monitoring our servers. Since this piece of software neither supports SELinux nor SystemD, we are currently working on improving ...
1
vote
1answer
505 views

SELinux, MySQL, and shared memory

On an SELinux enabled Oracle Linux 6 host, I have a product using MySQL as its underlying database and, through the database, is trying to access /dev/shm. /dev/shm mounts with context tmpfs_t, by ...
0
votes
2answers
117 views

How to isolate my browser?

I want to protect my data against a browser exploit, by forbidding Firefox to access any file beside : ~/.mozilla/ ~/Downloads/ I tried to create another user account with which I would run Firefox ...
0
votes
1answer
151 views

SELinux crashed data system

I wanted to change the type of some data for SELinux and I made a typo and sent the following command into the prompt as the root user: semanage fcontext -a -t openvpn _etc_t / Now my system (CentOS ...
9
votes
3answers
36k views

chcon: can't apply partial context to unlabeled file '/usr/sbin/xrdp'

Whenever I'm trying to execute this line to configure SELinux to install xrdp from this tutorial: # chcon --type=bin_t /usr/sbin/xrdp # chcon --type=bin_t /usr/sbin/xrdp-sesman I get these errors: ...
1
vote
0answers
68 views

SELinux forbits ACPI/udev hook to use sudo

I have a ThinkPad X220 Tablet which has a twistable display. The thinkpad-scripts collection which I wrote with a friend hooks into the hardware event (as root) and then runs a script. This is the ...
1
vote
0answers
112 views

SELinux prevents auto-umount of ecryptfs

I'm running SELinux and ecryptfs on a Debian machine. When a user logs out, unfortunately it's home directory is not unmounted, and I get the following error in audit.log: type=USER_AVC msg=audit(...
1
vote
1answer
119 views

Filebased SELinux booleans

I'm trying to get numba running on my Debian server in SELinux enforcing mode. Numba is build on LLVMs jit compiler. The problem is, LLVM insists on having memory, which is writeable and executable at ...
5
votes
1answer
293 views

Share host directory between multiple containers vs. SELinux

Sharing a host directory with a docker container usually is easy enough: $ docker create -v /path/to/hostdir:/path/inside/container --name conta ... Things get more complicated, if SELinux is ...
1
vote
0answers
271 views

Selinux inode security struct allocation

i'm trying to understand allocation of inode_security_struct in Selinux. I looked for a source code of selinux and there is only one allocation of this struct on line 230 in hooks.c file. This ...
2
votes
1answer
798 views

SELinux + MergerFS (fuse) not working well together

I have been trying now for several days to get my new server up and running. I am running CentOS with MergerFS to pool my drives and samba to host to my windows machines. All of this running in ...
0
votes
1answer
622 views

Timeouts with authd on CentOS 7

I am currently trying to augment my mailsystem by allowing servers that received mails from me within the last ten seconds to perform ident lookups. While the needed iptables rules are working ...
4
votes
1answer
1k views

SELinux not allowing read files on ~/.cert

I'm new to Fedora 23 and SELinux. I use an OpenVPN client through NetworkManager. I stored all the files I needed OpenVPN to access (certificate, CA and private key) inside ~/.cert and ran updatecon -...
0
votes
1answer
1k views

Nvidia drivers not loading correctly on Fedora 23

I just installed the nvidia drivers on fedora 23 (kernels 4.2.3 and 4.3.5), and it worked fine for 1 or 2 restarts, but during my last few reboots, cinnamon has crashed and started in fallback mode (...
1
vote
1answer
566 views

selinux allow port 8332 porttype

selinux is blocking port 8332. Now I want to unlock it. But what porttype do I have to use for an rpc connection? This is the message I get: SELinux is preventing /usr/sbin/php-fpm from name_connect ...
2
votes
1answer
496 views

Recreating local selinux contexts after OS Reinstallation

We have added a few specific contexts to our SELinux via the "semanage fcontext ..." command. The patterns are stored in /etc/selinux/targetd/contexts/files/file_contexts.local. Assuming that we ...
1
vote
0answers
67 views

apply proper security labels during filesystem restore

When restoring a filesystem on a separate system (i.e., possibly a different system than the one where the filesystem was originally mounted and in use), I would like to apply the correct security ...
3
votes
1answer
2k views

SELinux is not logging anywhere

I have SELinux in permissive mode enabled on CentOS7 system. But it doesn't seem to produce any logs. No new files in /var/log/audit, grep -i selinux /var/log/messages* finds nothing. sestatus ...
2
votes
1answer
686 views

Can using chcon to essentially bypass selinux be less secure than setting selinux to permissive?

I was wondering if it is possible to make a CentOS 7 server less secure by using chcon than it would be if SELinux were in Permissive mode. I am essentially trying to set up Phusion Passenger with ...
2
votes
1answer
766 views

User cron jobs are not being executed any more (perhaps SELinux)

I have the following output as a user running crontab -l: #Ansible: backup-external chaos */20 * * * * flock --nonblock /home/mu/.cache/backup-external.lock backup-external chaos */20 * * * * /home/...
0
votes
2answers
764 views

Apache2 home directory on Fedora

I want to serve docs on my dev server from my home directory. This is a private laptop, so I'm not really concerned with security as far as you are with most servers / web hosting situations. The ...
6
votes
2answers
2k views

Why does audit2why have nothing to do?

I know I have an issue with SElinux. So I am following a tutorial that will help me understand the nature of the file access problems I am having. That was I can still have SElinux enforce as supposed ...
9
votes
1answer
529 views

Wrong role and type on login

I'm on an Ubuntu 14.04 derivative, elementary OS Freya. I have installed and configured SELinux using the selinux-policy-default package, which contains a lot of modules. I've also added my user to ...
0
votes
1answer
481 views

Suitable permissions for owncloud /data directory using nginx under centos

Having the following software: nginx web server centos 7.1 OS owncloud 8 Application https Web Browsing Protocol PHP-FPM After resolving the issue of /config directory permissions, we reached this ...
2
votes
1answer
41 views

SELinux error while installing Awesome WM packages

After installing Awesome wm packages: awesome.x86_64 rancid.x86_64 vicious.noarch I'm getting an error in SELinux Troubleshooter: The source process: useradd Attempted this access: create ...
1
vote
1answer
46 views

Do I need to create a module for a new program or just use an existing one?

We have been developing a program at work to be run on a CentOS image. This program is very critical for us, so we need it to run in a very secure context. So, I was thinking of using SELinux to ...
2
votes
0answers
542 views

Unable to emerge SystemD on Hardened/SELinux

I'm on the hardened/linux/amd64/selinux profile on a recent Stage 3 of Gentoo amd64. I'm trying to install SystemD, and I see the following: > emerge -aq sys-apps/ The following mask changes are ...
1
vote
2answers
658 views

Where does samba_share_t come from

I have samba installed, selinux in enforcing mode, samba shares works fine. But I am not sure where samba_share_t is defined? semanage fcontext -l | grep samba_share_t does not return anything. ...