Hot answers tagged

59

sestatus is showing the current mode as permissive. In permissive mode, SELinux will not block anything, but merely warns you. The line will show enforcing when it's actually blocking. I don't believe it's possible to completely disable SELinux without a reboot.


32

None of them, at least not by itself. You must either give the directory structure a context of httpd_sys_rw_content_t, or give them a context of public_content_rw_t and enable allow_httpd_anon_write and/or allow_httpd_sys_script_anon_write. See the httpd_selinux(8) man page for details.


30

I see the terms to search for now are MAC and DAC. DAC is the standard permission system. MAC is the system used by SELinux. The answer to quote one source is: It is important to remember that SELinux policy rules are checked after DAC rules. SELinux policy rules are not used if DAC rules deny access first. This diagram shows: References: https://...


18

When a process performs an operation to a file, the Linux kernel performs the check in the following order: Discretionary Access Control (DAC) or user dictated access control. This includes both classic UNIX style permission checks and POSIX Access Control Lists (ACL). Classical UNIX checks compare the current process UID and GID versus the UID and GID of ...


17

Reality: yes, SELinux can confine the root user. This is possible because SELinux do not actually care about the current Unix user: all it sees is a supplementary metadata called the context (which includes, among other fields, a domain field) and which lets SELinux decides whether the requested action can be authorized or not. What one usually conceives ...


17

Here's how to permanently change the context of a directory: # install semanage if you don't already have it: yum install policycoreutils-python # give the directory a new default context. The part at the end is a regex. semanage fcontext -a -t httpd_sys_rw_content_t "/path/to/directory(/.*)?" # apply the default context to the directory restorecon -R /...


14

SELinux is a security feature of the operating system. It is designed to help protect some parts of the server from other parts. For example, if you run a web server and have some "vulnerable" code that allows for an attacker to run arbitrary commands then SELinux can help mitigate this, by preventing your web server from accessing files it's not allowed ...


14

Background SELinux adds another layer of permission checks on Linux systems. On SELinux enabled systems regular DAC permissions are checked first, and if they permit access, SELinux policy is consulted. If SELinux policy denies access, a log entry is generated in audit log in /var/log/audit/audit.log or in dmesg if auditd isn't running on the system. ...


13

Note the . at the end of the permissions (drwxrwxrwx.): that means there's an SELinux context involved. You need to get that right for your user to be able to list the contents of the directory. To see the contexts for your directory, run sudo ls -alZ (the -Z option shows the SELinux contexts required). The CentOS wiki has a good page on SELinux. You'll ...


12

Disabling SELinux without reboot is not possible. But I guess making it in permissive mode is going to satifsy your requirement. The output of sestatus shows SELinux is enabled but also shows it is in Permissive mode, which is what you just did with the setenforce command.


12

A "temporary" label change is done via the chcon command: bash-4.2# touch freetds.conf.new bash-4.2# ls -lZ freetds.conf.new -rw-r--r--. root root unconfined_u:object_r:etc_t:s0 freetds.conf.new bash-4.2# chcon -t etc_t -u system_u freetds.conf.new bash-4.2# ls -lZ freetds.conf.new -rw-r--r--. root root system_u:object_r:etc_t:s0 freetds.conf.new ...


10

You might want to run fixfiles -R openvpn restore An ls -alZ should give you something like this (showing your files are in the correct selinux context now): [root@server openvpn]# ls -alZ /etc/openvpn/ drwxr-xr-x. root root system_u:object_r:openvpn_etc_t:s0 . drwxr-xr-x. root root system_u:object_r:etc_t:s0 .. drwxr-xr-x. root root ...


10

If your SELinux config is ok, it seems that this error occured because server configuration. If you have installed php, then make sure that it is loaded by apache and apache is associated with php handler. LoadModule php5_module modules/libphp5.so AddType application/x-httpd-php .php And you should check your .htaccess. It may have some ...


10

On CentOS 7: echo 0 > /sys/fs/selinux/enforce


9

How about creating an empty chroot, then bind-mount the main filesystem as read-only inside the chroot? Should probably be something like this to create a read-only bind-mount: mount --bind /foo/ /path/to/chroot/ mount -o remount,ro /path/to/chroot/ You can bind-mount other directories which you want the jail to have write access to as well. Be careful if ...


9

First, you can stop SELinux from working by misconfiguring it. That does nothing to disable any backdoor, though. Then you can stop SELinux from doing anything by configuring it at runtime. If you run setenforce 0, SELinux stops enforcing security restrictions. It's still active, though. All you've done is potentially make your system less secure by ...


9

With the starting point of running sepolgen /path/to/binary which gives you: app.fc app.sh app.if app.spec app.te To create a new SELinux file context to apply to a parent directory that holds files your program/daemon will modify, you edit the app.te file and add : type app_var_t; files_type(app_var_t) The first line declares the new type and the ...


8

Although it is better to label the files and folders with the httpd_sys_rw_content_t where needed, for completeness I figured I'd mention that you can also change the seboolean httpd_unified to 1 to make SELinux ignore this particular context requirement, which is still much better than disabling SELinux as many on the internet would advise. From the man ...


8

The elegant way would be using richacls. But that is not an official part of the kernel yet and thus may be difficult to use for you. An easy workaround would be to use the samba parameters directory mask and force directory security mode to render newly created directories useless (inaccessible) to the users so that they learn not to create directories. ...


8

If you look at the context set for the directory /var/log you'll noticed the following things. First, the directory /var/log has the following selinux context set: $ ls -Z /var | grep "log$" drwxr-xr-x. root root system_u:object_r:var_log_t:s0 log Second, the log file, /var/log/messages, has no additional context: $ ls -Z /var/log/messages -rw------...


8

Sorry, I have found the reason. This is totally because of the SSL CERT problem. Not really because of above notices. How do I do was that I enabled the Apache Detailed Logs and then that's the real move. It shows what really is happening, by showing the Failure at the loading of mod_ssl module, while starting the Apache. Then I realized it is because of ...


8

There are varying views of SELinux. In many cases, some applications do not play well with SELinux so that this decision is moot (Oracle is one example). Generally, SELinux is a protecting mechanism to put yet another obstacle in the way of a bad guy wanting to subvert your system. In my previous roles as Systems Administrator at large companies ... I ...


8

This is simply done using the -a and -e flags as in: semanage fcontext -a -e /home/Ben '/websites(/.*)?' -a : add, -e : equivalence After that you'd have to run restorecon as in: restorecon -vvRF /websites and the new file context will be applied. -v : show changes in file labels, -R : recursive, -F : force reset of context It is also possible ...


8

SELinux has a bit of a reputation for being arcane - and one that I think is well deserved. The way I understand it, the context of a program that is running defines what the current policy will permit it to access or do. As such, as you've surmised, the haproxy_t type is allowed some permissions based on the http_port_t type. Now let's try to actually ...


8

AppArmor and SELinux are both independent Linux security module (LSM) implementations. They are configured using their own specific tools. Some distributions do ship with both kernel modules, but you can select only either at boot time (stacking certain other LSM modules, such as YAMA, is however possible). A notable practical difference between the two ...


7

At the time of writing what OP did should work. On Fedora 26: [aries@csibesz]$ sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS ...


7

You can use audit2why to find out why access was denied, and possibly if a SELinux boolean exists to allow access. SELinux boolean httpd_enable_homedirs allows Apache to read home directories, and should be enough in your case. You can enable it using (as root) setsebool -P httpd_enable_homedirs 1. In case you need to alter SELinux policy, you can use ...


6

Fedora's SELinux documentation is a good place to start. While referring to Fedora 13, the SELinux User Guide has plenty of information about how SELinux works. I also recommend reading Dan Walsh's Blog, where he talks about SELinux and related issues. Lastly, drop into #fedora-selinux on the FreeNode IRC network, there are often people there who can ...


6

What you can do is use a FUSE filesystem like bindfs in combination with a LD_PRELOAD hijacker that disables the mkdir and rmdir system calls. Like create a wrapper.c file with: #include <errno.h> int mkdir() { errno = EPERM; return -1; } int rmdir() { errno = EPERM; return -1; } Compile it with: gcc -fPIC -shared -o wrapper.so wrapper.c And run: ...


6

You didn't write why you choose LXC as it's not the most secure virtualization solution. I'm heavy user of KVM/XEN and also LXC and I can say this one thing that when it comes to security I never go with Linux containers (no matter if LXC / OpenVZ / VServer). It's just easier (and more reliable) with KVM/XEN. If it's about performance or hardware ...


Only top voted, non community-wiki answers of a minimum length are eligible