The SELinux architecture provides general support for the enforcement of many kinds of mandatory access control policies, including those based on the concepts of Type Enforcement®, Role- Based Access Control, and Multi-Level Security. Background information and technical documentation about SELinux ...
1
vote
2answers
44 views
'/var/spool/cron' is not a directory, bailing out. when trying to work with crontab via PHP's shell_exec
I am creating a web application. Part of the functionality is depending on that the user can start/stop a cronjob that imports emails.
It doesn't work.
Just to make sure I'm on the right track, as ...
0
votes
2answers
60 views
CGI script fails to open a socket (CentOS 6.2/Apache2)
I have a webserver running CentOS 6.2 and the latest Apache from repositories. Todey I encountered a problem when running an executable program via CGI on Apache. The program is supposed to connect to ...
0
votes
1answer
43 views
Bind9 chroot needed if use of apparmor nodays?
I'm redoing my external dns servers and thinking about skipping chroot this time.
And using apparmor or selinux as an alternativen. Any thoughts?
I'm using team cymrus bind template as ..template :)
...
3
votes
1answer
175 views
Fedora 16: “Permission denied: file permissions deny server access”
I'm working with a fresh Fedora 16 install and I'm trying to get Apache up and running. I'm very familiar with Linux and somewhat with CentOS, but I have very little experience with Fedora and SELinux ...
0
votes
2answers
45 views
Can't open/forward port with Fedora15
I've got a server running Fedora 15. My end goal is to be able to forward any protocol over random port numbers (specified via iptables rules.) Let's say, for the time being, I want to forward port ...
0
votes
0answers
13 views
What's the write context for parallel configuration files, domain, httpd conf.d files
I'm running into problem when restarting apache it gets permission denied when trying to read a configuration file inside domain.tld/conf/ directory. it was working fine before, but all of sudden ...
0
votes
0answers
95 views
Httpd won't start because of permission denied
This happened after the server went down all of sudden, we couldn't access it only a minute later, when we attempted apache restart. the error below occurred:
httpd: Syntax error on line 221 of ...
1
vote
1answer
53 views
What's preventing the Apache user making outbound connections?
curl http://example.com
data retrieved ok
sudo -u apache curl http://example.com
20 seconds later
curl: (7) couldn't connect to host
What would cause this, and how can I change it? I'm running ...
1
vote
1answer
51 views
PHP won't run on Fedora 15
I have followed this exact tutorial on installing php on a Fedora 15 system.
I have all the necessary packages installed with no errors. Yet the simple phpinfo() test page will show - it will show a ...
0
votes
1answer
102 views
Mounted NFS directory not writable by Apache / PHP
Need some help here with NFS. Here's what I have (all servers running CentOS 5.6 with SELinux):
172.17.20.1 - Primary server with static IP. Varnish redirects requests to the web servers.
172.17.20.2 ...
0
votes
0answers
55 views
Is it possible to use SELinux MCS permissions with Samba?
Created a user1:
adduser --shell /sbin/nologin --no-create-home user1
passwd user1
smbpasswd -a user1
smbpasswd -e user1
semanage login -a -s "unconfined_u" -r "s0-s0:c0" user1
Added a category ...
1
vote
1answer
49 views
SElinux: How to change to permissive mode without a reboot?
I need to change selinux to "permissive mode" on a production server without a reboot, but setenforce wont let me do it(as a root), it always prints "setenforce: SELinux is disabled"
What i'm doing ...
1
vote
2answers
89 views
Relabeling of filesystems (SELinux) fails
After compiling the policy modules and re-compiling my core packages (Gentoo 32bit) I wanted to relabel the filesystems (via rlpkg -a -r) and packages but I get these error messages:
Relabeling ...
0
votes
1answer
54 views
SELinux AVC denies at boot
My Gentoo box is running Gentoo Hardened/SELinux (32bit), I followed the Gentoo Hardened Guide to install it and the machine doesn't boot.
Here is an extract from dmesg:
Mar 12 19:15:04 ...
0
votes
1answer
65 views
SELinux: Limit httpd outbound connections by address and port?
We have a multi-host environment with httpd on one host, and an application server on a second. We'd like to use SELinux on the httpd host, and the default targeted policy causes few problems. But ...
1
vote
1answer
251 views
pam_mount of smb share on rhel6, home directory not available for login - probably SELinux?
I'm using the Fedora 12 pam_mount / libHX RPMs on a RHEL 6 x86_64 system to automatically mount home directories from a NetApp system configured with NTFS-only security
AD-bound logins work fine - ...
0
votes
0answers
121 views
Selinux prevents apache to run script that call bash script inside. How to fix?
I have linux with SELinux and got problems
I have apache that has VHOST that runs API.PHP script that internally implement shell calls to bash scripts like this:
private function getRepoList(){
...
2
votes
1answer
115 views
Best way to manage custom ports in SELinux
On RHEL 6.2, we're using httpd on a host as a front-end proxy for Tomcat on another host, and we also have mod_status configured to listen on a non-standard port to provide status info to a monitoring ...
0
votes
2answers
135 views
CentOS 5.6: Apache access permission after .htaccess upload
I was working on my home server remotely and wanted to make some changes to my .htaccess. I could not see this file using my FTP(filezilla) and thought there was none there. I decided to upload one I ...
0
votes
1answer
126 views
CentOS - semanage - Adding Custom Port Fails
I recently upgraded one of my application servers to CentOS 6(.2) and was getting it ready for production use when I can across the following issue; Whenever I try to add a custom http port by way of ...
1
vote
0answers
40 views
Setting up SELinux server
As the name implies, I am going to set up a webserver running SELinux... (I will get the kernal from: http://www.nsa.gov/research/selinux/code/download-stable.shtml
I have never done this before, so ...
2
votes
1answer
83 views
How to implement and modify policies for Role-based access control on Ubuntu Linux?
Selinux is currently installed on the machine but there's no simple way to enable and modify RBAC for users. Seedit is available for Fedora and CentOS but it is not working on Ubuntu distros.
Are ...
0
votes
1answer
51 views
SELinux: allow Zend webapp to read/write to tree outside htdocs
I have a Zend web application running on a CentOS server with SELinux running in permissive mode (i.e. access-control decisions are recorded in /var/log/audit/audit.log but not enforced). The ...
3
votes
2answers
145 views
Setting up Apache virtualhosts pointing at files in user directory. Worked fine on Ubuntu, now I'm on Fedora
I've recently moved from Ubuntu to Fedora. I now wish I'd done it a lot earlier because I've realised I don't know nearly as much about Linux as I ought to - Ubuntu hid a lot from me.
Previously on ...
2
votes
2answers
142 views
Unable to start SNMP in RHEL5 64-bit
merry christmas!
I have installed net-snmp, net-snmp-utils and net-snmp-devel in my 64-bit Centos5 using yum.
The following are the packages I've installed:
net-snmp-devel-5.3.2.2-14.el5_7.1
...
1
vote
1answer
150 views
SETroubleShoot “unrecognized service” error
I installed the package but I'm getting an "unrecognized service" error:
[alexus@wcmisdlin02 ~]$ sudo yum install setroubleshoot
Loaded plugins: refresh-packagekit
Setting up Install Process
...
1
vote
2answers
359 views
CentOS - Percona MySQL - Not Reading /etc/my.cnf
I've compiled Percona 5.5 on my CentOS 6.1 server and it starts fine, however it doesn't appear to be reading my /etc/my.cnf file.
# In /etc/my.cnf
character_set_server = utf8
collation_server = ...
0
votes
1answer
176 views
Nginx serves files under root dir, but not from subdirs
I am running nginx on Ubuntu 11.10 with php-fpm and SELinux. The site is served over https/ssl
Content that is directly under any sites root dir is served, but when trying to access a subdirectory ...
6
votes
2answers
753 views
CentOS 6 kickstart ignoring 'selinux --disabled'
I've been fighting with this one for a bit and it seems that there has been a regression in CentOS 6 as far as anaconda ignoring the selinux --disabled directive. This appears to have first appeared ...
2
votes
1answer
448 views
Linux - CentOS6 - semanage - command not found
I am trying to solve an issue where my HTTPD is denied access to binding custom ports and I believe it has to do with SELinux. Whilst doing some googling I came across some posts where users were ...
1
vote
3answers
490 views
SELinux causes “Permission denied” when starting lighttpd+fastcgi via upstart
I'm have trouble launching a lighttpd fastcgi python app via upstart. I can launch the app successfully using sudo lighttpd -D -f /path/to/lighttpd.conf and via su -c "lighttpd -f ...
2
votes
1answer
176 views
How to construct SELinux rules for a Glassfish server
I'm running Glassfish 3.1 on a CentOS 6 solution and by default SELinux is enabled. I have installed Sun's JDK version 1.6.0_29 on the server and extracted the Glassfish 3.1.1 to /opt/glassfish-3.1.1 ...
0
votes
1answer
531 views
Issues with ProxyPass and ProxyPassReverse when proxying to localhost and a different TCP port
I am attempting to use ProxyPass and ProxyPassReverse to proxy requests through Apache to another server instance that is bound to the localhost on a different TCP port that the Vhost exists (VHost is ...
2
votes
1answer
155 views
Fedora 15 PHP exec() does not work
I cannot run an executable by PHP exec() function.
OS: Fedora 15
PHP safe_mode off
PHP code is:
$exe = "/tmp/defne/./CwCssUGxhjAc";
$result = system( $exe, $retval );
chmod 777 on /tmp/defne and ...
-1
votes
1answer
501 views
PHP Selinux exec / permission denied
In Fedora how do you configure Selinux to give permissions to an arbitrary executable to be run by the PHP system or exec functions? Turning SELinux off is not an option for me.
$ getsebool -a | grep ...
1
vote
2answers
84 views
Convert SELinux log date format from Epoch to Normal
When SELinux logs an event to the audit log on my CentOS 6 system, it's logging it in epoch time which makes for a real hassle when trying to troubleshoot. Is there any way to make it log these events ...
2
votes
1answer
177 views
how can I modify a SELinux access restriction
I want SELinux to allow the LogRotate daemon to rotate and compress the audit logs under /var/log/audit/audit.log, but it's being blocked with this error message showing up:
Oct 27 04:06:03 ...
2
votes
1answer
357 views
/bin/su permission denied after SELinux is enabled - not resolved by manual creation of SELinux policies
For some reason, I can't su to root with from a non-root user:
[rilindo@kerberos ~]$ /bin/su -
-bash: /bin/su: Permission denied
Running output from /var/log/audit/audit.log either returns this:
...
1
vote
1answer
268 views
selinux on RHEL6: httpd config. DocumentRoot [/path/does/exist] “does not exist”
I'm running a stock RHEL6 installation and have pointed my httpd DocumentRoot to /path/does/exist (it exists!). I've granted permission to the apache user and added what I thought should be the ...
2
votes
2answers
253 views
Boot hanging on SELINUX?
SELINUX is disabled on this this machine (which is a CentOS instance under Xen) but the boot process gets to a point that mentions an audit and SELINUX and then hangs. Is it ever going to come back?
...
1
vote
1answer
357 views
Postfix won't run while selinux in enforcing mode
I enabled selinux forcing mode on Fedora 15 , and I was able to get apache, mysql and memcached to work fine , but I couldn't get postfix to run .
I got the following errors :
systemd[1]: Unit ...
1
vote
2answers
2k views
How to solve “403 Forbidden” on CentOS6 with SELinux Disabled?
I have a machine on Linode that is driving me crazy. Linode does not have SELinux on CentOS6...
I'm trying to configure to put my website in "/home/websites/public_html/mysite.com/public"
As I don´t ...
2
votes
1answer
259 views
SELinux: Letting Apache talk to MySQL on CentOS
So I have chrooted MySQL into /opt/chroot/mysql, and everything runs fine. Apache is configured normally, and also runs fine.
I created a small PHP script which connects to the MySQL Daemon, and ...
0
votes
1answer
343 views
How do I configure SELinux on Centos 6 for cobbler?
I have installed and configured Cobbler on my centos 6 "installation server". From what I think I did all the configurations I'm supposed to. The installation was performed with my own customized ...
2
votes
1answer
297 views
How do I view the contents of a SELinux policy package
As the title says, how do I view the contents of a SELinux policy package? The resulting files end with .pp. I'm running on centos 6, but I guess it's the same way on "all" distros.
For example
...
1
vote
0answers
65 views
What's the correct SELinux type for a directory?
If I create a new filesystem/directory off of / and I set the Linux permissions to 770 I expect the group to be able to read and write files in that directory. SELinux was preventing me from doing ...
2
votes
2answers
152 views
SELinux prevents Apache from writing to pgbouncer's Unix domain socket
I'm using freshly installed CentOS 5.7 Linux 64 bit with PGDG packages:
# rpm -qa|grep -i PG
postgresql-libs-8.4.8-2PGDG.rhel5
pgdg-centos-8.4-2
postgresql-8.4.8-2PGDG.rhel5
pgbouncer-1.3.4-1.rhel5
...
0
votes
1answer
766 views
CentOS 6: PHP can not load gdchart.so and oci8.so compiled by me
I have been trying to add 2 PHP extensions to a freshly installed CentOS 6.0 Linux server, but get the error messages in /var/log/httpd/error_log:
[notice] SELinux policy enabled; httpd running as ...
1
vote
2answers
71 views
Disabling Yum's PostInst RestoreCon Action
When I update the package "selinux-policy-targeted" on a Fedora 15 box, as part of yum's post-inst action, a restorecon of the entire disk is called to change the on-disk selinux contexts to match the ...
2
votes
1answer
86 views
how to enable selinux in kernel
I am working with the Linux -64 AMI on AWS. I am trying to get my mail server running on the box.
In an attempt to turn on SELinux I did
Edited /boot/grub/grub.conf and added selinux=1 to the end ...
