NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

0
votes
0answers
6 views

SELinux, complains constantly about rm files in /tmp/

SELinux on my server is constantly flooded by messages like this: Apr 16 00:27:05 mail setroubleshoot: SELinux is preventing the rm from using potentially mislabeled files (/tmp/.font-unix). For ...
-1
votes
2answers
20 views

Why am I getting permission error from tftp server?

I'm trying to tftp an image to an ASA 5500 and I'm getting this error: TFTP failure: RX TFTP Error Packet TFTP OP Code: Error Packet Error Msg: Permission denied
0
votes
0answers
24 views

Zabbix-server-mysql can't allocate shared memory - Access denied

I'm trying to run an instance of zabbix-server-mysql on Fedora 20, but Zabbix keeps saying that cant allocate shared memory space for history cache due to an Access Denied error. i'm sure that the ...
0
votes
1answer
23 views

SELinux access denied error for bash scripts triggered from perl-cgi script

I have a automation framework which use Perl-CGI for running scripts at server. As we have SELinux enabled I am getting access denied errors when the script try to run a bash script. Below is the ...
0
votes
0answers
18 views

Reading home files permission: Policy constraint violation

I want to confine a certain user to be able to bind a node.js server to a certain port. That bit is working. What isn't working is allowing said user to access his own files. audit2allow is telling ...
1
vote
1answer
53 views

SELinux permissions for LogRotate and Apache

With the directory structure: /www/live/website1/app/ /www/live/website1/files/ /www/live/website1/logs/ Where Apache needs at least the following access: app: read-only access, but read-write is ...
0
votes
1answer
62 views

RHEL SELinux blocking Apache access to PostgreSQL

I'm running a Django app that uses PostgreSQL. The server is running RHEL 6.5 with SELinux. I'm having an issue where the Django app can't connect to the DB, and I think it's because SELinux is ...
0
votes
1answer
57 views

My virtual users can't Chroot()

I'm configuring a Proftp server in a Fedora 20 Linux server. All my real users are loging in perfectly but not the case with the virtual users. Virtaul users are in the SQL table and mod_sql.c is ...
0
votes
1answer
15 views

VSFTPD - 0.00Kbyte/sec - intermittent

I can't get a good connection via FTP to my DigitalOcean server. I set it up following this guide. https://www.digitalocean.com/community/articles/how-to-set-up-vsftpd-on-centos-6--2 Symptoms: ...
2
votes
2answers
96 views

SELinux preventing /etc/aliases email pipe to script from working

When somebody sends an email to my server, e.g. somestringthatisnotnecessarilyauser@myserver.com I want it to pipe to a PHP script. So in my /etc/aliases file I have: ...
1
vote
1answer
48 views

sftp gives permission denied only when chrooted?

I have configured sshd_conf on my centos box as below: Match group pilots ChrootDirectory /home/pilots ForceCommand internal-sftp X11Forwarding no AllowTcpForwarding no and the directory ...
1
vote
0answers
23 views

How to write a file from Apache CGI in a user home directory on CentOS

I made a CGI in Python and it works unless I try to write to a file in a user's home. I activated allow_httpd_anon_write and allow_http_sys_script_anon_write to true with graphical tool for ...
0
votes
0answers
5 views

Apache: Pass phrase incorrect SSLPassPhraseDialog [duplicate]

On one of my servers I observe the following problem with SSL passphrase: some certs are passing it without asking for a password, while some others keep asking for it. I have set it up globally: ...
1
vote
1answer
42 views

Do linux security modules (LSM) run on virtual server (vServer)? [closed]

I have a vServer for 10 EUR/month from 1und1 and I know that it is not a dedicated machine (meaning I have less control). I know that I can use some the system as root, yet the kernel is untouchable. ...
1
vote
1answer
53 views

SELinux policy issue

As qemu & KVM are working fine with SELinux out of the box I'd like to enable SELinux to improve guest isolation on my CentOS 6 server. The problem is that I'm using a 3rd parity virtualization ...
1
vote
3answers
109 views

How to configure SELinux to allow specific services to communicate with Avahi?

I have a service, running on a Fedora 20 machine, that when started attempts to register services with Avahi. This works perfectly if my service is started while SELinux is in permissive mode, but the ...
1
vote
0answers
44 views

Apache passphrase working sometimes

On one of my servers I observe the following problem with SSL passphrase: some certs are passing it without asking for a password, while some others keep asking for it. I have set it up globally: ...
0
votes
1answer
177 views

Apache doesn't start: syntax error…DocumentRoot must be a directory

I read all the previous answer but I couldn't fix my problem.. I'm changing the server where my website is hosted and I'm setting again apache.. Now, after installing php, fail2ban, etc i have that ...
3
votes
2answers
48 views

Lost password on EC2 SELinux instance

As the title says, I have an SELinux instance on EC2 that I haven't used for a while. I have been unable to access it via ssh since firing it back up. I have accessed it from this machine in the ...
0
votes
1answer
140 views

Unable to start the Phusion Passenger - Cannot change the directory - Operation not permitted (errno=1)

I'm running Red Hat Enterprise Linux Server release 6.4 (Santiago) on Amazon EC2. I have installed Phusion Passenger via a gem. When I start httpd I have this error message in less ...
1
vote
1answer
183 views

Why can't I shutdown running kvm instance?

I have running kvm instance: =# virsh list --all Id Name State ---------------------------------------------------- 2 debian-test running When ...
2
votes
1answer
83 views

RHEL SELinux context differs between matchpathcon and restorecon

I am using RHEL 6.3 and I experiment a strange behavior with matchpathcon and restorecon SELinux commands. For a specific file, I have defined a context with semanage fcontext. Then, matchpathcon ...
4
votes
2answers
160 views

SElinux: allow httpd to connect to a specific port

My system is running CentOS 6.4 with apache2.2.15. SElinux is enforcing and I'm trying to connect to a local instance of redis through my python/wsgi app. I get Error 13, Permission denied. I could ...
1
vote
2answers
101 views

SELinux: denied { execute } for pid=2174 comm=“httpd” path=“/etc/httpd/lib/libaprutil-1.so.0.5.3”

I have problem with SELinux. setroubleshoot suggested to enable mypol.pp with semodule -i mypol.pp so apache could run. after I run the suggested command, I'm keep getting: type=AVC ...
1
vote
1answer
76 views

Configure SElinux to allow rsync from a remote machine

I've set up a Debian machine with SElinux and except rsync from a remote machine everything works fine. I already created some module with additional rights using audit2allow, and now all errors in ...
2
votes
2answers
74 views

MySQL 5.6 and SELinux are arguing

CentOS 6.4(x64) / MySQL 5.6.10 Installed MySQL from source files and started it fine under it's original location (/var/lib/mysql). I moved everything to a different volume (/u0/mysql) and went ...
4
votes
2answers
123 views

Unable to start Mysql with SELinux

I am attempting to start MySQL with SELinux on CentOS 6 however I am getting the following error. 131212 09:08:08 mysqld_safe mysqld from pid file /var/run/mysqld/mysqld.pid ended 131212 09:08:58 ...
0
votes
0answers
59 views

Hidden 'neverallow' in selinux policy?

I intend to use 'enforce' selinux mode. First, i boot in permissive mode ( enforcing=0 in kernel cmdline ). After login in system, i collect all selinux policy violation from auditd logs and try to ...
2
votes
2answers
71 views

How to limit access to the private ssh key using SELinux policies?

I'm using Fedora distro - with its preinstalled SELinux policies. I want to limit unsecured access to my private keys in ~/.ssh folder - to prevent leaking by possible malware, that may run under my ...
1
vote
2answers
275 views

OpenVPN SELinux Permission Denied

I am running CentOS 6.4. # cat /etc/centos-release CentOS release 6.4 (Final) After some updates, and a reboot, OpenVPN fails to start. # service openvpn start Starting openvpn: ...
2
votes
2answers
122 views

SELinux contexts with NFS shares

I'm trying to set up an NFS share between 2 CentOS servers (filesrv & websrv) for a folder that needs to be readable & writeable by the Apache process. I'm having trouble with the writeable ...
0
votes
0answers
25 views

How to use run_init with processes in the background

I'm working on a CentOS 5.9 machine. There's a program that runs in the foreground instead of correctly forking a daemon. It's /etc/init.d/myprogram script has something like below: start() { ...
1
vote
1answer
134 views

SElinux process killed while trying to set boolean

I've got a strange problem. I can not allow apache to connect to database at my CentOC 6.4 box: [root@centos6 ~]# setsebool -P httpd_can_network_connect on Killed [root@centos6 ~]# sestatus -b | grep ...
3
votes
1answer
88 views

Can't make SELinux context types permanent with semanage

I created a new folder at /modevasive to hold my mod_evasive scripts and for the Log Directory. I'm trying to change the context type to httpd_sys_content_t so Apache can write to the folder. I did ...
0
votes
1answer
51 views

google sitemap generator installation selinux

when i trying to install google sitemap generator i received this error Change security context of to system_u:object_r:httpd_modules_t install: WARNING: ignoring --context (-Z); this kernel is not ...
3
votes
2answers
346 views

Write once, read many (WORM) using Linux file system

I have a requirement to write files to a Linux file system that can not be subsequently overwritten, appended to, updated in any way, or deleted. Not by a sudo-er, root, or anybody. I am attempting to ...
1
vote
2answers
213 views

Apache will not stop/start gracefully

CentOs 6 64bit running apache 2.2.15-29.el6.centos. When I try to stop/start or restart httpd I get an error that says it has failed. A tail of the error log is below. I also noticed that a ...
1
vote
1answer
83 views

If matchpathcon checks the SELinux context of a directory, what is the converse check for the service?

A page from Fedora docs describes a SELinux context problem with the example: "...instead of using /var/www/html/ for a website, an administrator wants to use /srv/myweb/. ... [However] SELinux ...
2
votes
1answer
134 views

sudo: PAM audit_log_acct_message() failed: Permission denied

.. any time I'm run sudo through NRPE, I'm get a following message in my /var/log/secure, and I can't figure out how to resolve it. sudo: PAM audit_log_acct_message() failed: Permission denied ...
0
votes
0answers
44 views

RHEL6: Selinux execute rule not working

I want to configure a rule to allow a restricted user to execute 1 file (bash script) in /etc/init.d. I tagged this file as follows: -rwxr-xr-x. root root system_u:object_r:myappd_initrc_exec_t:s0 ...
0
votes
2answers
112 views

RHEL6: Selinux not logging AVC denial messages

I'm trying to configure a set of lockdown rules. My approach is to start with a restricted user, and use audit2allow messages to selective add permissions. My problem is that I don't see the expected ...
4
votes
1answer
60 views

SELinux: How to show all allowed rules for a type?

For an arbitrary object type, e.g. user_tmp_t, I want to know which processes are allowed to access this tag. How do I find all allow rules that reference user_tmp_t?
2
votes
1answer
149 views

Creating a public_html for a user on a Red Hat Linux Server

I'm just trying to make a public_html folder under my username on a Red Hat Linux Server (and it's all been a bit of a headache). I made the folder and set the permissions to 755. I wasn't sure how ...
3
votes
2answers
83 views

Relocated /var - now selinux is unhappy

I needed more space in the /var tree on a VM so I allocated some, booted in to runlevel 1 and copied over the folder to the new space. After changing the fstab entry for /var to reflect the new ...
4
votes
1answer
367 views

Granting sudo access to a SELinux confined user in freeIPA

I'm using freeIPA to define RBAC, HBAC and sudo rules, as well as SELinux user mappings for a domain of a couple hundred virtual machines, where I need to grant different levels of access to several ...
2
votes
1answer
79 views

How to make Puppet fix SELinux types for home directories?

We are using pam_mkhomedir.so to automatically create the home directories of users logging in with SSH. There is a bug in pam_mkhomedir that sets the SELinux contexts to home_root_t instead of ...
1
vote
1answer
60 views

SELinux remove or leave the old SSH port label?

I am following this (basic) security guide to change my Server's SSH port to something else. It says: $ semanage port -a -t ssh_port_t -p tcp 2345 #Change me ...which would add a new label on top ...
1
vote
1answer
28 views

Assign selinux context to the application without changing context of binary

Is there a way to assign custom SELinux context to the application despite the context that is assigned to it's binary?
0
votes
3answers
74 views

proftpd is accessing my.cnf

I use proftpd for virtual FTP hosting with MySQL. I've started writing fine-grained SELinux policies and found that it's trying to access my.cnf files. Question is what for and why? type=AVC ...
3
votes
1answer
241 views

RHEL6: Tomcat runs as unconfined Java user

I'm starting to configure RHEL6 to be a hardened Tomcat server and applying SELinux policies for access control. After installing RHEL6 and Tomcat6 (standalone, no httpd), I noticed that the Tomcat ...