The SELinux architecture provides general support for the enforcement of many kinds of mandatory access control policies, including those based on the concepts of Type Enforcement®, Role- Based Access Control, and Multi-Level Security. Background information and technical documentation about SELinux ...
0
votes
1answer
24 views
CentOS - semanage - Adding Custom Port Fails
I recently upgraded one of my application servers to CentOS 6(.2) and was getting it ready for production use when I can across the following issue; Whenever I try to add a custom http port by way of ...
1
vote
0answers
25 views
Setting up SELinux server
As the name implies, I am going to set up a webserver running SELinux... (I will get the kernal from: http://www.nsa.gov/research/selinux/code/download-stable.shtml
I have never done this before, so ...
2
votes
1answer
33 views
How to implement and modify policies for Role-based access control on Ubuntu Linux?
Selinux is currently installed on the machine but there's no simple way to enable and modify RBAC for users. Seedit is available for Fedora and CentOS but it is not working on Ubuntu distros.
Are ...
0
votes
1answer
24 views
SELinux: allow Zend webapp to read/write to tree outside htdocs
I have a Zend web application running on a CentOS server with SELinux running in permissive mode (i.e. access-control decisions are recorded in /var/log/audit/audit.log but not enforced). The ...
3
votes
2answers
87 views
Setting up Apache virtualhosts pointing at files in user directory. Worked fine on Ubuntu, now I'm on Fedora
I've recently moved from Ubuntu to Fedora. I now wish I'd done it a lot earlier because I've realised I don't know nearly as much about Linux as I ought to - Ubuntu hid a lot from me.
Previously on ...
2
votes
2answers
59 views
Unable to start SNMP in RHEL5 64-bit
merry christmas!
I have installed net-snmp, net-snmp-utils and net-snmp-devel in my 64-bit Centos5 using yum.
The following are the packages I've installed:
net-snmp-devel-5.3.2.2-14.el5_7.1
...
1
vote
0answers
46 views
SETroubleShoot “unrecognized service” error
I installed the package but I'm getting an "unrecognized service" error:
[alexus@wcmisdlin02 ~]$ sudo yum install setroubleshoot
Loaded plugins: refresh-packagekit
Setting up Install Process
...
1
vote
1answer
123 views
CentOS - Percona MySQL - Not Reading /etc/my.cnf
I've compiled Percona 5.5 on my CentOS 6.1 server and it starts fine, however it doesn't appear to be reading my /etc/my.cnf file.
# In /etc/my.cnf
character_set_server = utf8
collation_server = ...
0
votes
1answer
67 views
Nginx serves files under root dir, but not from subdirs
I am running nginx on Ubuntu 11.10 with php-fpm and SELinux. The site is served over https/ssl
Content that is directly under any sites root dir is served, but when trying to access a subdirectory ...
5
votes
2answers
291 views
CentOS 6 kickstart ignoring 'selinux --disabled'
I've been fighting with this one for a bit and it seems that there has been a regression in CentOS 6 as far as anaconda ignoring the selinux --disabled directive. This appears to have first appeared ...
2
votes
1answer
139 views
Linux - CentOS6 - semanage - command not found
I am trying to solve an issue where my HTTPD is denied access to binding custom ports and I believe it has to do with SELinux. Whilst doing some googling I came across some posts where users were ...
0
votes
0answers
14 views
Why do some instructions require 3 files when creating a custom SELinux module?
Normally, I create a custom module using audit2allow. This created two files:
.te file - assumed this is the human-readable module
.pp file - assumed that this is the compiled module
However, ...
1
vote
3answers
172 views
SELinux causes “Permission denied” when starting lighttpd+fastcgi via upstart
I'm have trouble launching a lighttpd fastcgi python app via upstart. I can launch the app successfully using sudo lighttpd -D -f /path/to/lighttpd.conf and via su -c "lighttpd -f ...
1
vote
0answers
79 views
How to construct SELinux rules for a Glassfish server
I'm running Glassfish 3.1 on a CentOS 6 solution and by default SELinux is enabled. I have installed Sun's JDK version 1.6.0_29 on the server and extracted the Glassfish 3.1.1 to /opt/glassfish-3.1.1 ...
0
votes
1answer
275 views
Issues with ProxyPass and ProxyPassReverse when proxying to localhost and a different TCP port
I am attempting to use ProxyPass and ProxyPassReverse to proxy requests through Apache to another server instance that is bound to the localhost on a different TCP port that the Vhost exists (VHost is ...
2
votes
1answer
68 views
Fedora 15 PHP exec() does not work
I cannot run an executable by PHP exec() function.
OS: Fedora 15
PHP safe_mode off
PHP code is:
$exe = "/tmp/defne/./CwCssUGxhjAc";
$result = system( $exe, $retval );
chmod 777 on /tmp/defne and ...
-1
votes
1answer
284 views
PHP Selinux exec / permission denied
In Fedora how do you configure Selinux to give permissions to an arbitrary executable to be run by the PHP system or exec functions? Turning SELinux off is not an option for me.
$ getsebool -a | grep ...
1
vote
2answers
52 views
Convert SELinux log date format from Epoch to Normal
When SELinux logs an event to the audit log on my CentOS 6 system, it's logging it in epoch time which makes for a real hassle when trying to troubleshoot. Is there any way to make it log these events ...
2
votes
1answer
94 views
how can I modify a SELinux access restriction
I want SELinux to allow the LogRotate daemon to rotate and compress the audit logs under /var/log/audit/audit.log, but it's being blocked with this error message showing up:
Oct 27 04:06:03 ...
2
votes
1answer
178 views
/bin/su permission denied after SELinux is enabled - not resolved by manual creation of SELinux policies
For some reason, I can't su to root with from a non-root user:
[rilindo@kerberos ~]$ /bin/su -
-bash: /bin/su: Permission denied
Running output from /var/log/audit/audit.log either returns this:
...
1
vote
1answer
111 views
selinux on RHEL6: httpd config. DocumentRoot [/path/does/exist] “does not exist”
I'm running a stock RHEL6 installation and have pointed my httpd DocumentRoot to /path/does/exist (it exists!). I've granted permission to the apache user and added what I thought should be the ...
2
votes
2answers
103 views
Boot hanging on SELINUX?
SELINUX is disabled on this this machine (which is a CentOS instance under Xen) but the boot process gets to a point that mentions an audit and SELINUX and then hangs. Is it ever going to come back?
...
1
vote
1answer
199 views
Postfix won't run while selinux in enforcing mode
I enabled selinux forcing mode on Fedora 15 , and I was able to get apache, mysql and memcached to work fine , but I couldn't get postfix to run .
I got the following errors :
systemd[1]: Unit ...
1
vote
2answers
582 views
How to solve “403 Forbidden” on CentOS6 with SELinux Disabled?
I have a machine on Linode that is driving me crazy. Linode does not have SELinux on CentOS6...
I'm trying to configure to put my website in "/home/websites/public_html/mysite.com/public"
As I don´t ...
2
votes
1answer
124 views
SELinux: Letting Apache talk to MySQL on CentOS
So I have chrooted MySQL into /opt/chroot/mysql, and everything runs fine. Apache is configured normally, and also runs fine.
I created a small PHP script which connects to the MySQL Daemon, and ...
0
votes
1answer
235 views
How do I configure SELinux on Centos 6 for cobbler?
I have installed and configured Cobbler on my centos 6 "installation server". From what I think I did all the configurations I'm supposed to. The installation was performed with my own customized ...
2
votes
1answer
133 views
How do I view the contents of a SELinux policy package
As the title says, how do I view the contents of a SELinux policy package? The resulting files end with .pp. I'm running on centos 6, but I guess it's the same way on "all" distros.
For example
...
1
vote
0answers
46 views
What's the correct SELinux type for a directory?
If I create a new filesystem/directory off of / and I set the Linux permissions to 770 I expect the group to be able to read and write files in that directory. SELinux was preventing me from doing ...
2
votes
2answers
95 views
SELinux prevents Apache from writing to pgbouncer's Unix domain socket
I'm using freshly installed CentOS 5.7 Linux 64 bit with PGDG packages:
# rpm -qa|grep -i PG
postgresql-libs-8.4.8-2PGDG.rhel5
pgdg-centos-8.4-2
postgresql-8.4.8-2PGDG.rhel5
pgbouncer-1.3.4-1.rhel5
...
0
votes
1answer
383 views
CentOS 6: PHP can not load gdchart.so and oci8.so compiled by me
I have been trying to add 2 PHP extensions to a freshly installed CentOS 6.0 Linux server, but get the error messages in /var/log/httpd/error_log:
[notice] SELinux policy enabled; httpd running as ...
1
vote
2answers
60 views
Disabling Yum's PostInst RestoreCon Action
When I update the package "selinux-policy-targeted" on a Fedora 15 box, as part of yum's post-inst action, a restorecon of the entire disk is called to change the on-disk selinux contexts to match the ...
2
votes
1answer
60 views
how to enable selinux in kernel
I am working with the Linux -64 AMI on AWS. I am trying to get my mail server running on the box.
In an attempt to turn on SELinux I did
Edited /boot/grub/grub.conf and added selinux=1 to the end ...
1
vote
1answer
80 views
selinux password-less login
os: centos 6
currently i have selinux linux enabled (enforcing) , disabling it makes ssh passwordless login work.
i have set setsebool for ssh the following settings
[root@server]# ...
2
votes
1answer
30 views
selinux setting for outgoing psql connections from apache
os: centos 6
currently i have enabled selinux to Permissive for the server, i want it to be set to Enforcing but at the same time selinux should be disabled for outgoing psql connections from ...
1
vote
3answers
167 views
How do I secure my OpenVZ host node?
I'm running a server using OpenVZ for a few websites. Nothing in HN except for sshd. A VM for Varnish, a VM for MySQL and a few VMs each for one website (running Apache/PHP). Now I'd like to secure ...
3
votes
1answer
130 views
The imporance of having SELinux enabled on a web server
This question is probably a matter of personal opinion but I wanted to gather your thoughts on how important having SELinux enabled on a web server is.
In your opinion, is the added security a must ...
0
votes
1answer
57 views
Does semodule -i need to be run after every SELinux policy update?
On RHEL and CentOS servers, when the selinux-policy-* RPM packages receive an update, is it always necessary to manually reload any custom modules I have built? When I see an update to ...
0
votes
1answer
36 views
Apache: Access denied to /
I have disabled selinux with:
setenforce 0
selinux=disabled
in /etc/selinux/config Does anyone knows if i have to label or chcon any dir to solve that error:
error [error] [client 127.0.0.1] ...
2
votes
3answers
1k views
Permission denied: could not create /var/run/httpd.pid in Apache
I'm working on setting up a web server running RedHat Enterprise 6 with Apache and PHP inside of a chroot jail environment. The chroot directory for apache is /chroot/httpd. I followed this example ...
2
votes
2answers
618 views
mod_unique_id: unable to find IPv4 address of FQDN despite setting etc/hosts and Apache ServerName
I'm trying to get mod_security and hit the very common hostname error of
[alert] (EAI 2)Name or service not known: mod_unique_id: unable to find IPv4 address of "computername.domain.com"
This ...
2
votes
3answers
268 views
Restrict user access in Linux
I am given a task to configure a RedHat Enterprise Linux 5 Gnome PC such that a specific user - say USER1 will have very limited desktop access. The requirements include:
Access to all of the ...
1
vote
1answer
300 views
How to change MySQL data directory?
I want to place my databases in another directory, so I can store them in an ESB (elastic block storage, just a fancy name for a virtualized harddisk) together with my web-apps and other persistent ...
3
votes
1answer
165 views
Disable SELinux file read protection for httpd
I am using RHEL 6.1 and I would like to configure SELinux to authorize httpd to read all files in some folders (My goal is to make log files available via web access).
Is this possible without ...
0
votes
1answer
70 views
What does “Invalid AVC allowed in current policy” mean?
I was looking into my selinux alert logfile and running over multiple entries labeled
**** Invalid AVC allowed in current policy ***
I understand that this signals a problem (on read or getattr ...
0
votes
1answer
95 views
Enabling mod_wsgi with SELinux (Is there a way?)
I recently had a bit of problem when recently by Deploying Django with mod_wsgi due to SELinux. Usually world get a "Permission denied" error (403). This was solved by disabling SELinux.
Is there a ...
2
votes
2answers
83 views
Allowing multiple types in the type field of a folder label in SELinux
I'm an Ubuntu/Debian guy but I had trouble installing Ubuntu on a softraid/fakeraid system, so I went with CentOS 5.6.
I'm also at a small web development firm where we need to share our test ...
4
votes
2answers
264 views
SELinux & ncsa_auth in Squid
I'm trying to enable SELinux on a CentOS 5.5 server with Squid 3.1.12 that handles authentication via ncsa_auth.
When I turn off SElinux everything works fine, but when I enable it, Squid crashes on ...
1
vote
2answers
540 views
SELinux prevents Nagios plugins from running on RHEL6
After installing Nagios NRPE & Nagios Plugins, I'm getting the following entry in my rsyslog:
May 13 14:01:30 wcmisdlin02 kernel: type=1400 audit(1305309690.482:2334): avc: denied { getattr } ...
0
votes
4answers
76 views
FC14 available TCP ports?
I am installing an application on Fedora Core 14 that uses a lot of sockets (eight of them) for TCP communication between various servers, all running on the same localhost. I've been trying to find ...
0
votes
1answer
584 views
Centos+Apache+Phusion+REE=FAIL
I have been trying to get Phusion Passenger running on 5.6 for the last couple of days with no luck. Initially, I started with Ruby 1.9.2 under RVM since the default Ruby on RHEL-based distros is ...
