NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

0
votes
0answers
11 views

CentOS 6 Apache 2.2 SELinux uploaded files 403 forbidden [duplicate]

We are running Magento 1.8.1.0 and for one of the upload folders in *document root*/media, namely the folder wysiwyg SELinux applies rights that makes uploaded content unreachable (403 Forbidden). We ...
1
vote
1answer
25 views

Why won't apache allow symbolic links, with SELinux?

I have a simple scenario: I want to symlink /home/leonard/apache/sandbox/markdown to /home/leonard/github/markdown-editor, so that the markdown-editor can be viewed from my browser. I setup the link ...
2
votes
0answers
32 views

SELinux preventing access to /var/log due to Docker

I have a Docker container that should read logs, including those from the host itself. So I mount the volume /var/log using the z flag. This changes the SELinux context on the files inside /var/log ...
0
votes
1answer
161 views

SELinux setup for MongoDB

I'm trying to install MongoDB on CentOS 7.2 from the mongodb.org repository. So far so good, but the hoster has created a secondary disk (/mongo) for all the MongoDB data files. This clashes with the ...
0
votes
1answer
58 views

SELinux preventing Asterisk from connecting to IMAP server for voicemail

I am running Asterisk on Fedora 23 and am using the voicemail IMAP module to store voicemails to Gmail. When SELinux is in enforcing mode it prevents Asterisk from connecting to Gmail. Here is the ...
2
votes
0answers
16 views

How can I configure SELinux to let rsyslogd run my program?

I'm trying to use SELinux with a system which has rsyslogd call a binary: # rsyslog configuration file module(load="omprog") template( name="snmp_template" type="string" string="%msg%\007" ) ...
1
vote
3answers
109 views

SELinux blocks nrpe access to MariaDB

I have a few virtual machines in the same LAN monitored by Icinga2 via NRPE. [Machine A] CentOS 6 Icinga2. [Machine B] CentOS 6 MariaDB v10.1.12 properly running Datadir and socket settings ...
8
votes
1answer
108 views

CentOS 7 - Directories created through VSFTPD not inheriting SELinux contexts

Our company has a webserver with CentOS 7 and our customers manage their websites through FTP (vsftpd). SELinux is in enforcing mode. The issue is that data created/uploadad through VSFTPD is not ...
1
vote
1answer
38 views

centos 7 & SELinux & ldconfig

Have Centos 7 virtual instance running on a shared host. They using VMWare vSphere hypervisor. It is a customized minimal install plus openssh and vmware tools. All updates applied. SELinux is ...
2
votes
0answers
20 views

How do I go about creating a systemd selinux policy domain?

How can I create an selinux policy to govern my systemd unit? I am creating a daemon that will be managed by systemd and I'd like to create an appropriate selinux policy to go with it. I've tried ...
1
vote
1answer
52 views

SELinux context for apache ldap ssl

Question What SELinux context do I need, for what file to get apache ldap (over ssl) auth to work? Or is it a network protocol or system call or something else entirely? Environment Apache 2.4 on ...
1
vote
1answer
44 views

Change selinux context for TLS cacert.pem

I need to make /etc/pki/CA/certs/cacert.pem have the same context as all the other files in /etc/pki: system_u:object_r:cert_t:s0 Tried restorecon -vR /etc/pki and semanage fcontext but the file ...
0
votes
1answer
28 views

Wrong SELinux labels on NFS homes?

I have NFS (v4) home directories. The NFS server is a Synology (DSM 5.2), the client is a FC 23. The client gets autofs settings from a freeIPA server: ipa automountmap-add default auto.home ipa ...
1
vote
2answers
215 views

How can I tell SELinux to permit nginx access to a unix socket without audit2allow?

I have nginx forwarding requests to gunicorn via a unix socket at /run/gunicorn/socket. By default, this behavior is not permitted by SELinux: grep nginx /var/log/audit/audit.log type=SERVICE_START ...
1
vote
1answer
33 views

selinux mls ssh getting denied dyntransition - login failure

I am trying to learn SELinux and going though the Red Hat documentation for RHEL 7. I came upon the documentation for Multi Layer Security (MLS) and wanted to try it, so I set SELINUXTYPE=mls and ...
0
votes
1answer
64 views

Can't open port

I can't open port 25 and 587. Background information: I am running CentOS 7 with firewalld and httpd. Now I want to run a mailserver. I started with installing postfix. Then I added firewall rules for ...
-2
votes
1answer
27 views

How we can see SElinux policies running on a centos system?? [closed]

I am given with an assignment that how we can see what selinux policies are running on a system(centos), as i am a new and dont know about the system
2
votes
1answer
61 views

use Sudo in apache

I am using CentOS 6 and trying to call sudo in Apache using this command: exec("sudo -u kouser whoami 2>&1",$output,$code); However SElinux add a line to output array(2) { [0]=> ...
2
votes
2answers
206 views

Allowing httpd to run a bash script in /usr/bin/

Migrating a system from CentOS6 to RHEL7 with SELinux running Enforced. A php script makes a call to /usr/bin/processdata.sh to generate some data behind the scenes. This worked fine with the old ...
0
votes
0answers
25 views

snv + http protocols with SElinux

I was asked to run the subversion with http and svn protocols on CentOS 7 os. Installed apache and subversion. The issue arises when apache and subversion are to access the repository. Apache works ...
6
votes
1answer
663 views

How to enable SELinux inside of a CentOS Docker container?

I am trying to install SELinux inside of a Docker container in order to distribute an application that uses SELinux internally. The default CentOS image does not have SELinux installed: $ docker run ...
0
votes
1answer
23 views

pam_tty audit logs gives too much of not required information

We are using pam_tty to record all the commands that user types. We are interested in monitoring the user commands. In the audit.log, when we grep for USER_TTY, there is too much of logging that ...
0
votes
1answer
39 views

libsepol.policydb_read: policydb magic number

I'm trying to create a selinux .te file from a .pp file but the tools on fc22 don't work. Is this a bug or should I be doing something different? Environment: fc22 [root@fc20-64 ~]# rpm -q ...
4
votes
0answers
44 views

SELinux: manually changing files in /etc/selinux/targeted/contexts/files/

I'm setting up a CentOS 7 server in which the /home directory has to be located on another partition and then mounted with bind-mount. So: /data/homes should be bind-mounted to /home. The problem is ...
0
votes
0answers
130 views

systemd apache service start is denied by selinux on centos 7

I am trying to start a custom httpd service from systemd on centos7. on the command line all works fine but from systemd it fails. the command line to start httpd is /usr/sbin/httpd -f ...
0
votes
0answers
57 views

fcoemon: error response from lldpad: error

I have created and configured the red hat cluster and as I was just going through logs to see if every thing is fine, thats when I saw these errors. Not sure whats with these errors. Please advise. ...
0
votes
0answers
15 views

SELinux: Restrict access to /tmp to subfolder

I'm trying to work out an SELinux policy that would allow httpd to have read-write access to a subfolder in /tmp, but not to the parent. Setting httpd_sys_rw_content_t on the subfolder allows the RW ...
0
votes
0answers
8 views

Http request blocked on port 80 [duplicate]

I currently have Centos 7 installed on EC2 with the following: Apache Php Mysql Iptables Firewalld Apache running Redirecting to /bin/systemctl status httpd.service ● httpd.service - The ...
2
votes
2answers
33 views

SELinux create custom role

I have a folder shared out via Samba, and a Docker container which I would like to give access to said folder by adding it as a volume to the Docker container (yes, I know that's not portable). ...
0
votes
1answer
33 views

can access virtualhost locally on the same server but cannot access on remote machine

A pretty wired problem occured when configure a virtualhost at port 81. When I use command curl 123.123.123.123:81 or curl localhost:81 in the same server, it got response. While when I access it ...
3
votes
0answers
141 views

SSH - 1s hang at “Entering interactive session” (Not DNS; possibly SELinux related)

I'm having an issue on CentOS 6.7 where SSH logins are 1s more than any non-6.7 machines on this network (e.g. 7.2, 5.11). Running debugging on the client side showed the hang at "Entering interactive ...
2
votes
1answer
65 views

Why isn't my SELinux logging anything?

I have a sneaking suspicion it has something to do with me mucking about with my rsyslog.conf, but I'm not 100% sure about that. I am running Centos 7, and SELinux has been working A-OK. However, I ...
3
votes
0answers
36 views

View custom selinux policies

Is there a way to view all custom policies applied to SELinux, preferably rolling them all up into one policy "package"? I've just spent the last week or so working through a series of SELinux errors ...
2
votes
0answers
47 views

Finding local ID for SELinux denial under Fedora 23

Trying to get more fluent with SELinux, it looks like sealert -l <local-id> would be a particularly useful way to get help with logged denials. From what I understand, the local IDs used to ...
3
votes
1answer
49 views

SELinux allow access for perl script via log rotate

I have a perl script that I want to run as a perorate script for log rotate. When I force log rotate to run from the command line as root, it works. However, when run through cron, SELinux prevents ...
1
vote
1answer
542 views

ValueError: Type http_sys_content_t is invalid, must be a file or device type

I need to set selinux permissions on a non-default httpd directory: /www/virtualhosts/site01, ect. So I issue: [mybox]# semanage fcontext -a -t http_sys_content_t "/www(/.*)?" And get: ...
0
votes
1answer
136 views

Service php-fpm does not get user permissions

I have an issue with php-fpm. It is actually the php7 version. I have drupal and it will complain that some directory is not writtable. Only if I start php-fpm as a service like that: #service ...
0
votes
1answer
36 views

How can I run a salt state if a command prints zero rows?

I've got Salt and SELinux running on CentOS7. I want to run restorecon -Rv /path/to/something, but only if it's necessary. I know that Salt has the onlyif and unless commands, but I'm having a heck ...
2
votes
3answers
131 views

Can't apply SELinux file context to paths with symlinks

I have a solution that is being installed in an enterprise environment. The solution and its deployment guide are designed to installed on a RHEL7/CentOS7 server with SELinux enabled and components ...
0
votes
2answers
534 views

Permission denied with Openshift PersistentStorage on GlusterFS

I'm trying to use OpenShift with PersistentStorage on a GusterFS cluster. I'm starting one of the default templates : mysql-persistent I've installed a GlusterFS cluster and create a volume ...
0
votes
0answers
81 views

Error 13 when executing mysqldump to export a database into a cvs file

I would like to export my database into a .csv file but I got a problem when I execute the command to do that: mysqldump -u root -p -t -T~/tesht/ database orders --fields-terminated-by=',' ...
1
vote
0answers
29 views

How do i configure NIS on Fedora 22?

I am trying to configure NIS client on Fedora 22. Following the tutorial http://www.server-world.info/en/note?os=Fedora_22&p=nis&f=2. I have to set SELinux=disable so that folders can be ...
0
votes
1answer
145 views

SELinux permissions for a socket and PID

I'm looking at getting rmilter installed on a CentOS 7 box. I'm trying to work out which SELinux labels/permissions I need for the daemon to bind/write to the following pidfile = ...
1
vote
1answer
703 views

SElinux on Debian Jessie missing default policy

I want to enable SElinux on Debian Jessie. In order to do this, I followed the guide on https://wiki.debian.org/SELinux/Setup. However, when I run the apt-get command, the selinux-policy-default ...
3
votes
0answers
47 views

What's the recommended way to restrict Internet access per process using SELinux?

Before I have tried to do this using a phony user and iptables to execute commands that needs to be restricted. However now the commands need to read configuration set by each user's environment vars ...
2
votes
1answer
119 views

Running logstash under SELinux

I want to run logstash as root to allow it to read all logs (granting it access to every log is very tiresome). However, I don't want it running amok on my server, I thought about constraining it ...
0
votes
0answers
18 views

xguest with Biometric validation

I am looking for a solution to the following problem: A server is connected to 'dummy' terminals (all-in-one computers) in an isolated network. These terminals have xguest account that are directly ...
2
votes
1answer
30 views

docker made fedora host unbootable in selinux enforcing mode

I've done incautiously docker run -v /:/mnt:ro someimage It has resulted with some docker (docker v1.7) daemon error. Since then I can only boot in permissive mode and got lot of selinux errors. ...
0
votes
1answer
102 views

iptables outgoing default policy is accept, but some ports appear blocked

I'm new to servers and iptables. I have a web app (happens to be bugzilla) running on my Centos 6.7 apache/httpd server, and it attempts to connect out to the web (updates.bugzilla.org) via port 80. ...
1
vote
1answer
98 views

SELinux preventing Fail2Ban from emailing notification via msmtp

I have msmtp as a null client connecting to my AWS SES account for SMTP, delivering alerts such as cron, monit and soon hopefully Fail2Ban to my email addresses. However, Fail2Ban isn't playing ball, ...