NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

0
votes
0answers
8 views

CentOS 6 Apache 2.2 SELinux uploaded files 403 forbidden [duplicate]

We are running Magento 1.8.1.0 and for one of the upload folders in *document root*/media, namely the folder wysiwyg SELinux applies rights that makes uploaded content unreachable (403 Forbidden). We ...
1
vote
1answer
21 views

Why won't apache allow symbolic links, with SELinux?

I have a simple scenario: I want to symlink /home/leonard/apache/sandbox/markdown to /home/leonard/github/markdown-editor, so that the markdown-editor can be viewed from my browser. I setup the link ...
-1
votes
0answers
25 views

CentoOS / Apache Cant reach webserver

I have CentoOS 7.2 and Apache/2.4.6 The Iptables are disabled/stopped. SeLinux is also disabled. setenforce 0 I can ping the sites on my vhosts list from outside the network and also can ping others ...
2
votes
0answers
29 views

SELinux preventing access to /var/log due to Docker

I have a Docker container that should read logs, including those from the host itself. So I mount the volume /var/log using the z flag. This changes the SELinux context on the files inside /var/log ...
0
votes
1answer
76 views

SELinux setup for MongoDB

I'm trying to install MongoDB on CentOS 7.2 from the mongodb.org repository. So far so good, but the hoster has created a secondary disk (/mongo) for all the MongoDB data files. This clashes with the ...
0
votes
1answer
49 views

SELinux preventing Asterisk from connecting to IMAP server for voicemail

I am running Asterisk on Fedora 23 and am using the voicemail IMAP module to store voicemails to Gmail. When SELinux is in enforcing mode it prevents Asterisk from connecting to Gmail. Here is the ...
-1
votes
0answers
27 views

Centos 7 vsftpd - cannot modify files or rename folders - no write permission

I have just installed fresh centos 7 relase and i try to configure an vsftpd server. Server is set to use local users. Want i want to achive is to be able to write to /var/www/html There are ...
2
votes
0answers
15 views

How can I configure SELinux to let rsyslogd run my program?

I'm trying to use SELinux with a system which has rsyslogd call a binary: # rsyslog configuration file module(load="omprog") template( name="snmp_template" type="string" string="%msg%\007" ) ...
1
vote
3answers
80 views

SELinux blocks nrpe access to MariaDB

I have a few virtual machines in the same LAN monitored by Icinga2 via NRPE. [Machine A] CentOS 6 Icinga2. [Machine B] CentOS 6 MariaDB v10.1.12 properly running Datadir and socket settings ...
8
votes
1answer
90 views

CentOS 7 - Directories created through VSFTPD not inheriting SELinux contexts

Our company has a webserver with CentOS 7 and our customers manage their websites through FTP (vsftpd). SELinux is in enforcing mode. The issue is that data created/uploadad through VSFTPD is not ...
1
vote
1answer
35 views

centos 7 & SELinux & ldconfig

Have Centos 7 virtual instance running on a shared host. They using VMWare vSphere hypervisor. It is a customized minimal install plus openssh and vmware tools. All updates applied. SELinux is ...
2
votes
0answers
19 views

How do I go about creating a systemd selinux policy domain?

How can I create an selinux policy to govern my systemd unit? I am creating a daemon that will be managed by systemd and I'd like to create an appropriate selinux policy to go with it. I've tried ...
1
vote
1answer
35 views

SELinux context for apache ldap ssl

Question What SELinux context do I need, for what file to get apache ldap (over ssl) auth to work? Or is it a network protocol or system call or something else entirely? Environment Apache 2.4 on ...
1
vote
1answer
39 views

Change selinux context for TLS cacert.pem

I need to make /etc/pki/CA/certs/cacert.pem have the same context as all the other files in /etc/pki: system_u:object_r:cert_t:s0 Tried restorecon -vR /etc/pki and semanage fcontext but the file ...
0
votes
1answer
25 views

Wrong SELinux labels on NFS homes?

I have NFS (v4) home directories. The NFS server is a Synology (DSM 5.2), the client is a FC 23. The client gets autofs settings from a freeIPA server: ipa automountmap-add default auto.home ipa ...
1
vote
2answers
136 views

How can I tell SELinux to permit nginx access to a unix socket without audit2allow?

I have nginx forwarding requests to gunicorn via a unix socket at /run/gunicorn/socket. By default, this behavior is not permitted by SELinux: grep nginx /var/log/audit/audit.log type=SERVICE_START ...
1
vote
1answer
29 views

selinux mls ssh getting denied dyntransition - login failure

I am trying to learn SELinux and going though the Red Hat documentation for RHEL 7. I came upon the documentation for Multi Layer Security (MLS) and wanted to try it, so I set SELINUXTYPE=mls and ...
0
votes
1answer
55 views

Can't open port

I can't open port 25 and 587. Background information: I am running CentOS 7 with firewalld and httpd. Now I want to run a mailserver. I started with installing postfix. Then I added firewall rules for ...
-2
votes
1answer
26 views

How we can see SElinux policies running on a centos system?? [closed]

I am given with an assignment that how we can see what selinux policies are running on a system(centos), as i am a new and dont know about the system
2
votes
1answer
49 views

use Sudo in apache

I am using CentOS 6 and trying to call sudo in Apache using this command: exec("sudo -u kouser whoami 2>&1",$output,$code); However SElinux add a line to output array(2) { [0]=> ...
2
votes
2answers
181 views

Allowing httpd to run a bash script in /usr/bin/

Migrating a system from CentOS6 to RHEL7 with SELinux running Enforced. A php script makes a call to /usr/bin/processdata.sh to generate some data behind the scenes. This worked fine with the old ...
0
votes
0answers
23 views

snv + http protocols with SElinux

I was asked to run the subversion with http and svn protocols on CentOS 7 os. Installed apache and subversion. The issue arises when apache and subversion are to access the repository. Apache works ...
5
votes
1answer
520 views

How to enable SELinux inside of a CentOS Docker container?

I am trying to install SELinux inside of a Docker container in order to distribute an application that uses SELinux internally. The default CentOS image does not have SELinux installed: $ docker run ...
0
votes
1answer
22 views

pam_tty audit logs gives too much of not required information

We are using pam_tty to record all the commands that user types. We are interested in monitoring the user commands. In the audit.log, when we grep for USER_TTY, there is too much of logging that ...
0
votes
1answer
33 views

libsepol.policydb_read: policydb magic number

I'm trying to create a selinux .te file from a .pp file but the tools on fc22 don't work. Is this a bug or should I be doing something different? Environment: fc22 [root@fc20-64 ~]# rpm -q ...
4
votes
0answers
39 views

SELinux: manually changing files in /etc/selinux/targeted/contexts/files/

I'm setting up a CentOS 7 server in which the /home directory has to be located on another partition and then mounted with bind-mount. So: /data/homes should be bind-mounted to /home. The problem is ...
0
votes
0answers
107 views

systemd apache service start is denied by selinux on centos 7

I am trying to start a custom httpd service from systemd on centos7. on the command line all works fine but from systemd it fails. the command line to start httpd is /usr/sbin/httpd -f ...
0
votes
0answers
48 views

fcoemon: error response from lldpad: error

I have created and configured the red hat cluster and as I was just going through logs to see if every thing is fine, thats when I saw these errors. Not sure whats with these errors. Please advise. ...
0
votes
0answers
13 views

SELinux: Restrict access to /tmp to subfolder

I'm trying to work out an SELinux policy that would allow httpd to have read-write access to a subfolder in /tmp, but not to the parent. Setting httpd_sys_rw_content_t on the subfolder allows the RW ...
0
votes
0answers
8 views

Http request blocked on port 80 [duplicate]

I currently have Centos 7 installed on EC2 with the following: Apache Php Mysql Iptables Firewalld Apache running Redirecting to /bin/systemctl status httpd.service ● httpd.service - The ...
2
votes
2answers
31 views

SELinux create custom role

I have a folder shared out via Samba, and a Docker container which I would like to give access to said folder by adding it as a volume to the Docker container (yes, I know that's not portable). ...
0
votes
1answer
30 views

can access virtualhost locally on the same server but cannot access on remote machine

A pretty wired problem occured when configure a virtualhost at port 81. When I use command curl 123.123.123.123:81 or curl localhost:81 in the same server, it got response. While when I access it ...
3
votes
0answers
125 views

SSH - 1s hang at “Entering interactive session” (Not DNS; possibly SELinux related)

I'm having an issue on CentOS 6.7 where SSH logins are 1s more than any non-6.7 machines on this network (e.g. 7.2, 5.11). Running debugging on the client side showed the hang at "Entering interactive ...
2
votes
1answer
56 views

Why isn't my SELinux logging anything?

I have a sneaking suspicion it has something to do with me mucking about with my rsyslog.conf, but I'm not 100% sure about that. I am running Centos 7, and SELinux has been working A-OK. However, I ...
3
votes
0answers
31 views

View custom selinux policies

Is there a way to view all custom policies applied to SELinux, preferably rolling them all up into one policy "package"? I've just spent the last week or so working through a series of SELinux errors ...
2
votes
0answers
42 views

Finding local ID for SELinux denial under Fedora 23

Trying to get more fluent with SELinux, it looks like sealert -l <local-id> would be a particularly useful way to get help with logged denials. From what I understand, the local IDs used to ...
3
votes
1answer
45 views

SELinux allow access for perl script via log rotate

I have a perl script that I want to run as a perorate script for log rotate. When I force log rotate to run from the command line as root, it works. However, when run through cron, SELinux prevents ...
1
vote
1answer
415 views

ValueError: Type http_sys_content_t is invalid, must be a file or device type

I need to set selinux permissions on a non-default httpd directory: /www/virtualhosts/site01, ect. So I issue: [mybox]# semanage fcontext -a -t http_sys_content_t "/www(/.*)?" And get: ...
0
votes
1answer
109 views

Service php-fpm does not get user permissions

I have an issue with php-fpm. It is actually the php7 version. I have drupal and it will complain that some directory is not writtable. Only if I start php-fpm as a service like that: #service ...
0
votes
1answer
35 views

How can I run a salt state if a command prints zero rows?

I've got Salt and SELinux running on CentOS7. I want to run restorecon -Rv /path/to/something, but only if it's necessary. I know that Salt has the onlyif and unless commands, but I'm having a heck ...
2
votes
3answers
123 views

Can't apply SELinux file context to paths with symlinks

I have a solution that is being installed in an enterprise environment. The solution and its deployment guide are designed to installed on a RHEL7/CentOS7 server with SELinux enabled and components ...
0
votes
2answers
454 views

Permission denied with Openshift PersistentStorage on GlusterFS

I'm trying to use OpenShift with PersistentStorage on a GusterFS cluster. I'm starting one of the default templates : mysql-persistent I've installed a GlusterFS cluster and create a volume ...
0
votes
0answers
69 views

Error 13 when executing mysqldump to export a database into a cvs file

I would like to export my database into a .csv file but I got a problem when I execute the command to do that: mysqldump -u root -p -t -T~/tesht/ database orders --fields-terminated-by=',' ...
1
vote
0answers
27 views

How do i configure NIS on Fedora 22?

I am trying to configure NIS client on Fedora 22. Following the tutorial http://www.server-world.info/en/note?os=Fedora_22&p=nis&f=2. I have to set SELinux=disable so that folders can be ...
0
votes
1answer
109 views

SELinux permissions for a socket and PID

I'm looking at getting rmilter installed on a CentOS 7 box. I'm trying to work out which SELinux labels/permissions I need for the daemon to bind/write to the following pidfile = ...
1
vote
1answer
574 views

SElinux on Debian Jessie missing default policy

I want to enable SElinux on Debian Jessie. In order to do this, I followed the guide on https://wiki.debian.org/SELinux/Setup. However, when I run the apt-get command, the selinux-policy-default ...
3
votes
0answers
45 views

What's the recommended way to restrict Internet access per process using SELinux?

Before I have tried to do this using a phony user and iptables to execute commands that needs to be restricted. However now the commands need to read configuration set by each user's environment vars ...
2
votes
1answer
107 views

Running logstash under SELinux

I want to run logstash as root to allow it to read all logs (granting it access to every log is very tiresome). However, I don't want it running amok on my server, I thought about constraining it ...
0
votes
0answers
18 views

xguest with Biometric validation

I am looking for a solution to the following problem: A server is connected to 'dummy' terminals (all-in-one computers) in an isolated network. These terminals have xguest account that are directly ...
2
votes
1answer
29 views

docker made fedora host unbootable in selinux enforcing mode

I've done incautiously docker run -v /:/mnt:ro someimage It has resulted with some docker (docker v1.7) daemon error. Since then I can only boot in permissive mode and got lot of selinux errors. ...