NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

0
votes
0answers
20 views

Suspicious SELinux Audit Log Entries PHP-FPM Write Denied - How to investigate?

I found a few /var/log/audit/audit.log entries which have me a little bit concerned. SEAlert explains them as such: SELinux is preventing /usr/sbin/php-fpm from write access on the directory ...
1
vote
1answer
27 views

selinux: rwx permissions for a folder

I am facing problems with PHP interface that calls perl and shell scripts. These enable uploading of a file to a folder and execute them with some input while storing output into some other files. Now ...
0
votes
0answers
16 views

semodule -i takes 100% cpu and does not end

I am setting up selinux and ran grep ${1} /var/log/audit/audit.log | audit2allow -r -M local_${1} within an compilation script (oneliner). I'd like to run it like "compile_selinux collectd_t" so ...
2
votes
1answer
40 views

SELinux not enforcing apache write restrictions despite being enabled

Problem in a nutshell: SELinux does not protect files and directories labeled as httpd_sys_content_t from being written, deleted or changed when new/custom document root is created. I have ...
1
vote
0answers
15 views

how do i inspect the contents of an selinux module?

I would like to view the [textual] contents of an selinux module, say for instance, /etc/selinux/targeted/modules/active/modules/udev.pp. I tried sedismod, but I get the following error on Fedora 21: ...
0
votes
1answer
20 views

Can't enable logging for Bind 9 on Red Hat [closed]

When I enable logging for Bind, I get a permissions denied error which is due to Bind running in chroot/selinux (avc denied write). I can't figure out how to reconfigure selinux to allow the log file ...
1
vote
2answers
81 views

Enable SELinux on Centos7 LXC container with Ubuntu 14.04 host

I'm trying to setup an LXC container for testing which is running CentOS 7 with SELinux enabled to meet the requirements for a test I'm trying to run. Despite all my efforts, I'm still unable to get ...
1
vote
1answer
40 views

Dovecot SELinux MailDir permission denied

I have dovecot installed on CentOS 7.1. In the past, I have often just disabled SELinux, but now I want to have a server with SELinux that works for me. Anyhow, I have mail stored in ...
0
votes
1answer
76 views

Why is this HTTP to HTTPS redirection not working?

I have been reading through all the discussions on the subject and decided to use the Redirect method in the httpd.conf file with no luck... So I came back here to this knowledgable crowd. We have a ...
2
votes
1answer
100 views

SELinux on CentOS not working

i'm new to CentOS and trying to enable SELinux and it's not working after a restart as described on ...
1
vote
1answer
64 views

Creating an SELINUX allow rule for sockets error with clamd

I've got a CentOS 7 box configured as a Squid proxy, with clamav and Squidclamav. Normally I would just disable SELINUX, but I am attempting to understand and setup allow rules properly. I've managed ...
0
votes
1answer
56 views

What are soundd daemons, and why does nginx need the type under SELinux?

Curious what is soundd daemon. The wiki at http://wiki.centos.org/TipsAndTricks/SelinuxBooleans says it is "soundd daemon" but I'm not finding much additional info on internet. To get nginx ...
0
votes
2answers
71 views

SSH works but tunneling or SFTP doesn't. Why?

since 2014 I've got a server from SoYouStart, with Centos 7. It worked perfectly, but now I had to install again the OS. Now I'm configuring all the services to work again. I need to connect to the ...
2
votes
1answer
20 views

Find modified selinux booleans

I have a CentOS 6.6 server that was setup by someone else. I'll be recreating this server from scratch on a new box and I'm wondering if there is any way I can find out what selinux booleans have been ...
0
votes
2answers
42 views

Add custom 'allow' policy in SELinux

I would like allow httpd to executed files from a user's home directory. From audit2allow I understand that this implies the following policy: allow httpd_t user_home_t:file execute; How do I turn ...
1
vote
3answers
65 views

How to disable SELINUX for systemd script?

I have a systemd script in CentOS 7 which doesn't run properly unless I disable SELINUX. Is it possible to somehow have SELINUX enabled on the system but disable it only for this systemd script? The ...
2
votes
3answers
90 views

SELinux restrict Apache/PHP access

I installed a minimal CentOS system with Apache, PHP and SELinux in a default configuration: SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root ...
1
vote
0answers
47 views

Selinux: Shorewall will not respond to fail2ban

I am using fail2ban with shorewall and my Fedora 21 server & cloud. All flooded with the following error message: SELinux is preventing shorewall from write access on the file ...
0
votes
1answer
95 views

CentOS 7 Cannot delete ports defined for MongoDB

I installed and later removed the MongoDB server on a CentOS 7 box. While cleaning up, I noticed that the ports assigned to MongoDB were still open. if I remember correctly, I was able to delete the ...
0
votes
1answer
224 views

Docker 1.6.0 on RHEL 6.5 with SELinux, can't run containers without root

I'm trying to run a container on a RHEL 6.5 but I keep hitting this problem: sudo docker run -u postgres -it registry/postgres /bin/bash /bin/bash: error while loading shared libraries: ...
2
votes
1answer
102 views

Selinux semanage delete or modify chain

I use on all my server port 24 for SSH. After change port i got error because Selinux block server SSHD restart 4 08:08:02 kvm452 sshd[18297]: error: Bind to port 24 on 0.0.0.0 failed: Permission ...
2
votes
0answers
92 views

Init script has permissions issues, but running with /bin/sh resolves them? [closed]

Can someone tell me what's going on here? As far as I knew, these ways of executing an init script are identical. box:~# whoami root box:~# /etc/init.d/nginx restart nginx: [emerg] open() ...
0
votes
1answer
55 views

SELinux - mysql/ and httpdoc/ in same folder?

Looks like my old faithful LAMP directory structure has come unstuck with SELinux. I prefer everything in the same place. CentOS 6.6 Apache 2.2.15 MySQL 6.5 /DATA/ /DATA/httpdocs/ /DATA/mysql/ ...
2
votes
1answer
359 views

What I have to modify to have SELinux allow nginx to act as an IMAP/POP3 proxy?

By default nginx under CentOS 7 will fail to start if used as an IMAP/POP proxy. This is because of SELinux. How can SELinux's configuration be altered, without disabling its protections, to allow ...
1
vote
1answer
114 views

Moved /home to new disk, SELinux denying access to /home for sshd

Yesterday I added a drive to a Centos6 VM box, created a /home mount point on the drive and then moved a user (jenkins in this case) to it to free up space from the / mount point. This seemed to work ...
1
vote
1answer
25 views

SELinux - first attempt to restrict file by type - fails to fail

I have a Centos 6 Linux box. I read tutorials on SELinux and wanted to try it out. Here are steps I followed, set SELINUX=enforcing in /etc/selinux/config turned on SELINUX with setenforce 1 service ...
2
votes
2answers
212 views

SELinux - logrotate is not rotating NGINX logs

I am using CentOS, NGINX and Passenger to serve a Rails application. I have SELinux activated, and have had a series of problems with logrotate. I have been able to resolve most of the issues by ...
1
vote
1answer
45 views

Log/Audit everything allowed by SELinux

I'm profiling some proprietary software to construct a set of permission requirements and SELinux policies to allow it to install and run on Oracle Linux (or any RHEL derivative). I'm running SELinux ...
0
votes
0answers
51 views

How to work whit socket_file httpd (nginx-uwsgi)

I am trying to run Nginx/uWSGI/Django, the last remaining step is to run the socket_file all I get is a 502 Bad Gateway. Route my django application. #/home/deploy/webapps/myapp Configuration ...
1
vote
0answers
96 views

How to power down Cloudstack configured with XenServer Hypervisors

I have three XenServers(6.2) configured in a single pool. I also have a Cloudstack (CentOS 6.5) Management interface controlling them all. Everything is up and running but I can not figure out how to ...
0
votes
1answer
94 views

Selinux “Add context Rule to Semanage” [closed]

As you add or change a new rule to fcontext semanage to any directory and apply, egg: # How to add this rule for apply changes whit restoreconf -Rv /var/www/html(/.*)?/media(/.*)? ...
1
vote
1answer
236 views

SELINUX blocking php-fpm and nginx working together?

I'm having some issues with SELINUX. When trying to visit my website I get 403 forbidden from nginx and the server pops up with an error and says to use grep NGINX /var/log/audit/audit.log | ...
0
votes
1answer
48 views

ports to open to access samba share

When I turn off my iptables service, I can successfully list my samba shares. But when I turn it back on, I cannot access them at all. Also, my SELINUX is set to permissive Here is my current ...
0
votes
0answers
121 views

PHPINFO creates Permission Denied in error log

Running CentOS 7 with apache 2.4, using PHP5.6 from REMI repository. My wordpress and phpmyadmin seem to work, however any page that has phpinfo() causes a permission denied entry into my error log. ...
1
vote
2answers
585 views

Zabbix server SELinux policy

I have a Zabbix server running on a RHEL 7 box and when I use the web front end (on the same box) it says Zabbix server is not running. If I disable SELinux and change nothing else, the web front end ...
1
vote
1answer
53 views

Trying to track down why httpd would be trying to connect to a tor port

I'm seeing occasional selinux denied messages in my logs that I believe indicate that the httpd process is trying to connect to a tor port: type=AVC msg=audit(1423247604.799:1966): avc: denied { ...
-1
votes
1answer
271 views

Configure Nginx as Reverse Proxy with Apache2 on CentOS7 enabled with SELinux

I'm working on a project for academic purposes, the goal is to use Nginx as a Reverse Proxy for Apache, so far i've installed Nginx and everything is ok, it's listening to port 80, but when i was ...
1
vote
1answer
213 views

SELinux Permissive enabled; httpd error reporting

I kept getting the following notice in apache /var/log/messages and many others same messages : kernel: type=1400 audit(1422862414.790:3222): avc: denied { getattr } for pid=2484 comm="deliver" ...
1
vote
2answers
304 views

nginx suddenly redirecting everything to 403 page, can this be debugged or traced?

I'm not sure what happened to my nginx install. Suddenly all page requests are being redirected to the 403 page. Yesterday I tried to add a user agent to block, restarted service from that point ...
0
votes
2answers
2k views

LDAP user authentication on CentOS 7: Permission denied

I configured LDAP on CentOs 7 and now I'm trying to configure external user authentication. Browsing I found this: https://www.centos.org/docs/5/html/Deployment_Guide-en-US/s1-ldap-pam.html that is ...
0
votes
0answers
31 views

selinux-policy update prevents ssh into ec2. Now what?

I created a new EC2 instance using the official CentOS 7 (x86_64) HVM image. I ran: yum upgrade At: Running transaction Warning: RPMDB altered outside of yum. Updating : ...
1
vote
1answer
61 views

selinux, file not matching file_contexts.local

semanage fcontext -a -t puppet_etc_t "/etc/puppet/environments(/.*)?" cat /etc/selinux/targeted/contexts/files/file_contexts.local # This file is auto-generated by libsemanage # Do not edit ...
1
vote
1answer
89 views

selinux settings for script run by apache to pull git repo

I have a web server running apache under CentOS which as selinux enabled. I have a separate server which has gitlab running. I'm trying to create a workflow using gitlab's web hooks so that when code ...
1
vote
0answers
79 views

SElinux sandbox fails to start from systemd service

I have a server that runs user submitted code, for evaluation. I wrote a systemd service that starts a python application, that application then run the submitted code using SElinux sandbox. The ...
2
votes
1answer
638 views

SELinux: no audit errors but nginx permission errors

I try to isolate a SELinux problem with nging/munin. I see that error message in "/var/log/nging/error.log": [crit] 8802#0: *55 connect() to unix:/var/run/munin/fcgi-html.sock failed (13: ...
0
votes
0answers
126 views

Postgres on OpenSuse doesn't start after update

I tried to upgrade OpenSuse from 12.1 to 13.1 and after 'zypper update' and reboot Postgresql doesn't start. Here is the output of service postgresgl status: postgresql.service - LSB: Start the ...
1
vote
2answers
447 views

How can I move /var/log/audit/audit.log to another partition

Fresh centos 6.5 with updates installed. We want to log auditd to a non persistent volume since we capture everything with splunk or logstash. The destination dir is /mnt/ephemeral/audit/ # ls -l ...
3
votes
1answer
155 views

SE Linux - can't change SELinux booleans with sudo

I think this is the correct place to put this, rather than in StackOverflow Either way, we have a CentOS 6.6 server. SElinux isn't allowing us to enable httpd_can_sendmail I've tried this.... sudo ...
0
votes
0answers
42 views

SELinux - centos 6.5 run_init asks for password of non privileged user

I log onto my aws centos instance, as user: [user@aws-sonar-01 ~]$ sudo -i [root@aws-sonar-01 ~]# run_init /bin/bash -x -c 'ulimit -S -c 0 ; auditd'; echo $? Authenticating user. Password: + ulimit ...
0
votes
1answer
97 views

httpd trying to access root-owned session files

While looking into what's been causing a server to lock up/crash, I found many selinux messages in /var/log/messages. For example: setroubleshoot: SELinux is preventing /usr/sbin/httpd from getattr ...