NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

0
votes
0answers
17 views

semanage to add port, how to make active without reboot

Added a new SSH port using: semanage port -a -t ssh_port_t -p tcp #PORTNUMBER Added the Port to /etc/ssh/sshd_config, restarted sshd, and confirmed with netstat that a service was now listening on ...
0
votes
0answers
6 views

Overwrite default selinux fcontext rules

I'm trying to overwrite default rule for public_html directory: /home/[^/]*/((www)|(web)|(public_html))(/.+)? unconfined_u:object_r:httpd_user_content_t:s0 Assigning the httpd_user_rw_content_t ...
0
votes
1answer
37 views

View, compare, and copy SELinux configurations between machines?

I have two machines running the same JBoss and HTTPD setup. They started from the exact same install of RedHat 7 and the same process was followed to install everything on both machines. On one ...
0
votes
2answers
32 views

SElinux error :ValueError: Port tcp/5000 already defined

I have been trying to add an exception to SELinux for apache on port 5000.So I used the command: # semanage port -a -t http_port_t -p tcp 5000 But returns the error, ValueError: Port tcp/5000 ...
2
votes
0answers
7 views

SELinux - FCGID program being blocked and no log on /var/log/audit/audit.log

I have a setup where a certain link on my Web Server is redirected to a FCGID module. When I disable SELinux with 'setenforce 0' the site works. When I enable it won't work, it gives me a "Error 500 -...
0
votes
1answer
22 views

RHEL 6.5 kernel panic unfixable after setting selinux to disabled

This question is similar to Server won't boot, kernel panic - not syncing Background: I have set /etc/selinux/config and changed the line SELINUX=enforcing to SELINUX=disabled After rebooting it ...
0
votes
1answer
38 views

move mariaDb database to home folder

after install I'm trying to move the database location On fedora: # su # systemtcl stop mariadb # cp -rp /var/lib/mysql /home # chown mysql.mysql /home/mysql Next i'm editing the file /etc/my.cnf....
-1
votes
0answers
12 views

running apache on fedora/selinux/no setroubleshoot messages on desktop [migrated]

I have installed fedora 24 installed from scratch via iso image. I have httpd started and can see the default page if I access "localhost". Now I want to add a directory which should contain files ...
1
vote
1answer
49 views

SELinux rules in CentOS 7 with Samba and SSSD on Kerberos Ticket generation

I've built a simple File Server with Samba and Netatalk running on CentOS 7.2. Everything is working as expected except for SELinux that's denying Samba to authenticate due to a policy of denying ...
0
votes
1answer
22 views

PHP cant connect to postgreSQL in Centos 7 Selinux

After migration to a new VPS and trying website on new server(Centos 7), Selinux somehow prevents http from accessing Postgresql: pg_connect(): Unable to connect to PostgreSQL server: could not ...
0
votes
1answer
33 views

SELinux keeps blocking my Apache instance

I am using CentOS 7 and have set up a duplicate Apache instance using the systemd structure there. I can get both Apaches to run if I use setenforce 0. However, when I setenforce 1, the new Apache ...
0
votes
0answers
8 views

selinux with nfs share how to allow different processes to write

We have a server with an NFS share for all storage stuff. Many processes should have read/write access to this share. For example: squid httpd ejabberd other self written For this question I used ...
1
vote
0answers
18 views

xdebug remote centos host from mac

I have a server running CentOS7, PHP7.0.7 with php-fpm, and SELinux. I am trying to debug a PHP script running on that server. And I have a Mac machine that runs PHPstorm where I intend to do the ...
1
vote
1answer
61 views

Allow SELinux, Nginx to read local file and make outbound connection

I am a new admin to a server which uses CentOS 7, nginix and php-fpm. There is a web form that needs to read a local file (prod.pem) and then make an outbound connection to either: gateway.push....
3
votes
1answer
57 views

SELinux on CentOS7-based LXC?

Is there any way to enable SELinux on LXC-based container using proxmox 4.2?
0
votes
0answers
92 views

Apache configured on Centos 7 to listen for https requests on non-standard port (8443) but from outside the connection is refused

I am working on this for quite some time with researching the Q&A everywhere. Any hints would be most welcome. The setup: small private network at home with router from ISP (Comtrend VR-3026e ...
0
votes
0answers
12 views

CentOS 6 Apache 2.2 SELinux uploaded files 403 forbidden [duplicate]

We are running Magento 1.8.1.0 and for one of the upload folders in *document root*/media, namely the folder wysiwyg SELinux applies rights that makes uploaded content unreachable (403 Forbidden). We ...
1
vote
1answer
36 views

Why won't apache allow symbolic links, with SELinux?

I have a simple scenario: I want to symlink /home/leonard/apache/sandbox/markdown to /home/leonard/github/markdown-editor, so that the markdown-editor can be viewed from my browser. I setup the link ...
2
votes
0answers
35 views

SELinux preventing access to /var/log due to Docker

I have a Docker container that should read logs, including those from the host itself. So I mount the volume /var/log using the z flag. This changes the SELinux context on the files inside /var/log ...
0
votes
1answer
328 views

SELinux setup for MongoDB

I'm trying to install MongoDB on CentOS 7.2 from the mongodb.org repository. So far so good, but the hoster has created a secondary disk (/mongo) for all the MongoDB data files. This clashes with the ...
0
votes
1answer
69 views

SELinux preventing Asterisk from connecting to IMAP server for voicemail

I am running Asterisk on Fedora 23 and am using the voicemail IMAP module to store voicemails to Gmail. When SELinux is in enforcing mode it prevents Asterisk from connecting to Gmail. Here is the ...
2
votes
0answers
24 views

How can I configure SELinux to let rsyslogd run my program?

I'm trying to use SELinux with a system which has rsyslogd call a binary: # rsyslog configuration file module(load="omprog") template( name="snmp_template" type="string" string="%msg%\007" ) ...
1
vote
3answers
139 views

SELinux blocks nrpe access to MariaDB

I have a few virtual machines in the same LAN monitored by Icinga2 via NRPE. [Machine A] CentOS 6 Icinga2. [Machine B] CentOS 6 MariaDB v10.1.12 properly running Datadir and socket settings ...
8
votes
1answer
135 views

CentOS 7 - Directories created through VSFTPD not inheriting SELinux contexts

Our company has a webserver with CentOS 7 and our customers manage their websites through FTP (vsftpd). SELinux is in enforcing mode. The issue is that data created/uploadad through VSFTPD is not ...
1
vote
1answer
48 views

centos 7 & SELinux & ldconfig

Have Centos 7 virtual instance running on a shared host. They using VMWare vSphere hypervisor. It is a customized minimal install plus openssh and vmware tools. All updates applied. SELinux is ...
2
votes
0answers
25 views

How do I go about creating a systemd selinux policy domain?

How can I create an selinux policy to govern my systemd unit? I am creating a daemon that will be managed by systemd and I'd like to create an appropriate selinux policy to go with it. I've tried ...
1
vote
1answer
98 views

SELinux context for apache ldap ssl

Question What SELinux context do I need, for what file to get apache ldap (over ssl) auth to work? Or is it a network protocol or system call or something else entirely? Environment Apache 2.4 on ...
1
vote
1answer
68 views

Change selinux context for TLS cacert.pem

I need to make /etc/pki/CA/certs/cacert.pem have the same context as all the other files in /etc/pki: system_u:object_r:cert_t:s0 Tried restorecon -vR /etc/pki and semanage fcontext but the file ...
0
votes
1answer
51 views

Wrong SELinux labels on NFS homes?

I have NFS (v4) home directories. The NFS server is a Synology (DSM 5.2), the client is a FC 23. The client gets autofs settings from a freeIPA server: ipa automountmap-add default auto.home ipa ...
2
votes
2answers
390 views

How can I tell SELinux to permit nginx access to a unix socket without audit2allow?

I have nginx forwarding requests to gunicorn via a unix socket at /run/gunicorn/socket. By default, this behavior is not permitted by SELinux: grep nginx /var/log/audit/audit.log type=SERVICE_START ...
1
vote
1answer
48 views

selinux mls ssh getting denied dyntransition - login failure

I am trying to learn SELinux and going though the Red Hat documentation for RHEL 7. I came upon the documentation for Multi Layer Security (MLS) and wanted to try it, so I set SELINUXTYPE=mls and ...
0
votes
1answer
76 views

Can't open port

I can't open port 25 and 587. Background information: I am running CentOS 7 with firewalld and httpd. Now I want to run a mailserver. I started with installing postfix. Then I added firewall rules for ...
-2
votes
1answer
28 views

How we can see SElinux policies running on a centos system?? [closed]

I am given with an assignment that how we can see what selinux policies are running on a system(centos), as i am a new and dont know about the system
2
votes
1answer
101 views

use Sudo in apache

I am using CentOS 6 and trying to call sudo in Apache using this command: exec("sudo -u kouser whoami 2>&1",$output,$code); However SElinux add a line to output array(2) { [0]=> ...
2
votes
2answers
243 views

Allowing httpd to run a bash script in /usr/bin/

Migrating a system from CentOS6 to RHEL7 with SELinux running Enforced. A php script makes a call to /usr/bin/processdata.sh to generate some data behind the scenes. This worked fine with the old ...
1
vote
0answers
30 views

snv + http protocols with SElinux

I was asked to run the subversion with http and svn protocols on CentOS 7 os. Installed apache and subversion. The issue arises when apache and subversion are to access the repository. Apache works ...
6
votes
1answer
1k views

How to enable SELinux inside of a CentOS Docker container?

I am trying to install SELinux inside of a Docker container in order to distribute an application that uses SELinux internally. The default CentOS image does not have SELinux installed: $ docker run ...
0
votes
1answer
28 views

pam_tty audit logs gives too much of not required information

We are using pam_tty to record all the commands that user types. We are interested in monitoring the user commands. In the audit.log, when we grep for USER_TTY, there is too much of logging that ...
0
votes
1answer
55 views

libsepol.policydb_read: policydb magic number

I'm trying to create a selinux .te file from a .pp file but the tools on fc22 don't work. Is this a bug or should I be doing something different? Environment: fc22 [root@fc20-64 ~]# rpm -q --...
4
votes
0answers
53 views

SELinux: manually changing files in /etc/selinux/targeted/contexts/files/

I'm setting up a CentOS 7 server in which the /home directory has to be located on another partition and then mounted with bind-mount. So: /data/homes should be bind-mounted to /home. The problem is ...
0
votes
0answers
166 views

systemd apache service start is denied by selinux on centos 7

I am trying to start a custom httpd service from systemd on centos7. on the command line all works fine but from systemd it fails. the command line to start httpd is /usr/sbin/httpd -f /etc/...
0
votes
0answers
73 views

fcoemon: error response from lldpad: error

I have created and configured the red hat cluster and as I was just going through logs to see if every thing is fine, thats when I saw these errors. Not sure whats with these errors. Please advise. ...
0
votes
0answers
17 views

SELinux: Restrict access to /tmp to subfolder

I'm trying to work out an SELinux policy that would allow httpd to have read-write access to a subfolder in /tmp, but not to the parent. Setting httpd_sys_rw_content_t on the subfolder allows the RW ...
0
votes
0answers
9 views

Http request blocked on port 80 [duplicate]

I currently have Centos 7 installed on EC2 with the following: Apache Php Mysql Iptables Firewalld Apache running Redirecting to /bin/systemctl status httpd.service ● httpd.service - The ...
2
votes
2answers
36 views

SELinux create custom role

I have a folder shared out via Samba, and a Docker container which I would like to give access to said folder by adding it as a volume to the Docker container (yes, I know that's not portable). ...
0
votes
1answer
36 views

can access virtualhost locally on the same server but cannot access on remote machine

A pretty wired problem occured when configure a virtualhost at port 81. When I use command curl 123.123.123.123:81 or curl localhost:81 in the same server, it got response. While when I access it ...
3
votes
0answers
157 views

SSH - 1s hang at “Entering interactive session” (Not DNS; possibly SELinux related)

I'm having an issue on CentOS 6.7 where SSH logins are 1s more than any non-6.7 machines on this network (e.g. 7.2, 5.11). Running debugging on the client side showed the hang at "Entering interactive ...
2
votes
1answer
110 views

Why isn't my SELinux logging anything?

I have a sneaking suspicion it has something to do with me mucking about with my rsyslog.conf, but I'm not 100% sure about that. I am running Centos 7, and SELinux has been working A-OK. However, I ...
3
votes
0answers
48 views

View custom selinux policies

Is there a way to view all custom policies applied to SELinux, preferably rolling them all up into one policy "package"? I've just spent the last week or so working through a series of SELinux errors ...
2
votes
0answers
61 views

Finding local ID for SELinux denial under Fedora 23

Trying to get more fluent with SELinux, it looks like sealert -l <local-id> would be a particularly useful way to get help with logged denials. From what I understand, the local IDs used to ...