NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

0
votes
1answer
43 views

SSH works but tunneling or SFTP doesn't. Why?

since 2014 I've got a server from SoYouStart, with Centos 7. It worked perfectly, but now I had to install again the OS. Now I'm configuring all the services to work again. I need to connect to the ...
2
votes
1answer
14 views

Find modified selinux booleans

I have a CentOS 6.6 server that was setup by someone else. I'll be recreating this server from scratch on a new box and I'm wondering if there is any way I can find out what selinux booleans have been ...
0
votes
2answers
34 views

Add custom 'allow' policy in SELinux

I would like allow httpd to executed files from a user's home directory. From audit2allow I understand that this implies the following policy: allow httpd_t user_home_t:file execute; How do I turn ...
1
vote
3answers
36 views

How to disable SELINUX for systemd script?

I have a systemd script in CentOS 7 which doesn't run properly unless I disable SELINUX. Is it possible to somehow have SELINUX enabled on the system but disable it only for this systemd script? The ...
2
votes
3answers
58 views

SELinux restrict Apache/PHP access

I installed a minimal CentOS system with Apache, PHP and SELinux in a default configuration: SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root ...
1
vote
0answers
23 views

Selinux: Shorewall will not respond to fail2ban

I am using fail2ban with shorewall and my Fedora 21 server & cloud. All flooded with the following error message: SELinux is preventing shorewall from write access on the file ...
0
votes
1answer
52 views

CentOS 7 Cannot delete ports defined for MongoDB

I installed and later removed the MongoDB server on a CentOS 7 box. While cleaning up, I noticed that the ports assigned to MongoDB were still open. if I remember correctly, I was able to delete the ...
0
votes
1answer
181 views

Docker 1.6.0 on RHEL 6.5 with SELinux, can't run containers without root

I'm trying to run a container on a RHEL 6.5 but I keep hitting this problem: sudo docker run -u postgres -it registry/postgres /bin/bash /bin/bash: error while loading shared libraries: ...
2
votes
1answer
72 views

Selinux semanage delete or modify chain

I use on all my server port 24 for SSH. After change port i got error because Selinux block server SSHD restart 4 08:08:02 kvm452 sshd[18297]: error: Bind to port 24 on 0.0.0.0 failed: Permission ...
2
votes
0answers
64 views

Init script has permissions issues, but running with /bin/sh resolves them? [closed]

Can someone tell me what's going on here? As far as I knew, these ways of executing an init script are identical. box:~# whoami root box:~# /etc/init.d/nginx restart nginx: [emerg] open() ...
0
votes
1answer
43 views

SELinux - mysql/ and httpdoc/ in same folder?

Looks like my old faithful LAMP directory structure has come unstuck with SELinux. I prefer everything in the same place. CentOS 6.6 Apache 2.2.15 MySQL 6.5 /DATA/ /DATA/httpdocs/ /DATA/mysql/ ...
2
votes
1answer
146 views

What I have to modify to have SELinux allow nginx to act as an IMAP/POP3 proxy?

By default nginx under CentOS 7 will fail to start if used as an IMAP/POP proxy. This is because of SELinux. How can SELinux's configuration be altered, without disabling its protections, to allow ...
1
vote
1answer
84 views

Moved /home to new disk, SELinux denying access to /home for sshd

Yesterday I added a drive to a Centos6 VM box, created a /home mount point on the drive and then moved a user (jenkins in this case) to it to free up space from the / mount point. This seemed to work ...
1
vote
1answer
24 views

SELinux - first attempt to restrict file by type - fails to fail

I have a Centos 6 Linux box. I read tutorials on SELinux and wanted to try it out. Here are steps I followed, set SELINUX=enforcing in /etc/selinux/config turned on SELINUX with setenforce 1 service ...
2
votes
2answers
136 views

SELinux - logrotate is not rotating NGINX logs

I am using CentOS, NGINX and Passenger to serve a Rails application. I have SELinux activated, and have had a series of problems with logrotate. I have been able to resolve most of the issues by ...
1
vote
1answer
39 views

Log/Audit everything allowed by SELinux

I'm profiling some proprietary software to construct a set of permission requirements and SELinux policies to allow it to install and run on Oracle Linux (or any RHEL derivative). I'm running SELinux ...
0
votes
0answers
43 views

How to work whit socket_file httpd (nginx-uwsgi)

I am trying to run Nginx/uWSGI/Django, the last remaining step is to run the socket_file all I get is a 502 Bad Gateway. Route my django application. #/home/deploy/webapps/myapp Configuration ...
1
vote
0answers
78 views

How to power down Cloudstack configured with XenServer Hypervisors

I have three XenServers(6.2) configured in a single pool. I also have a Cloudstack (CentOS 6.5) Management interface controlling them all. Everything is up and running but I can not figure out how to ...
0
votes
1answer
71 views

Selinux “Add context Rule to Semanage” [closed]

As you add or change a new rule to fcontext semanage to any directory and apply, egg: # How to add this rule for apply changes whit restoreconf -Rv /var/www/html(/.*)?/media(/.*)? ...
1
vote
1answer
184 views

SELINUX blocking php-fpm and nginx working together?

I'm having some issues with SELINUX. When trying to visit my website I get 403 forbidden from nginx and the server pops up with an error and says to use grep NGINX /var/log/audit/audit.log | ...
0
votes
1answer
42 views

ports to open to access samba share

When I turn off my iptables service, I can successfully list my samba shares. But when I turn it back on, I cannot access them at all. Also, my SELINUX is set to permissive Here is my current ...
0
votes
0answers
93 views

PHPINFO creates Permission Denied in error log

Running CentOS 7 with apache 2.4, using PHP5.6 from REMI repository. My wordpress and phpmyadmin seem to work, however any page that has phpinfo() causes a permission denied entry into my error log. ...
1
vote
2answers
302 views

Zabbix server SELinux policy

I have a Zabbix server running on a RHEL 7 box and when I use the web front end (on the same box) it says Zabbix server is not running. If I disable SELinux and change nothing else, the web front end ...
1
vote
1answer
45 views

Trying to track down why httpd would be trying to connect to a tor port

I'm seeing occasional selinux denied messages in my logs that I believe indicate that the httpd process is trying to connect to a tor port: type=AVC msg=audit(1423247604.799:1966): avc: denied { ...
-1
votes
1answer
243 views

Configure Nginx as Reverse Proxy with Apache2 on CentOS7 enabled with SELinux

I'm working on a project for academic purposes, the goal is to use Nginx as a Reverse Proxy for Apache, so far i've installed Nginx and everything is ok, it's listening to port 80, but when i was ...
1
vote
1answer
139 views

SELinux Permissive enabled; httpd error reporting

I kept getting the following notice in apache /var/log/messages and many others same messages : kernel: type=1400 audit(1422862414.790:3222): avc: denied { getattr } for pid=2484 comm="deliver" ...
1
vote
2answers
239 views

nginx suddenly redirecting everything to 403 page, can this be debugged or traced?

I'm not sure what happened to my nginx install. Suddenly all page requests are being redirected to the 403 page. Yesterday I tried to add a user agent to block, restarted service from that point ...
0
votes
2answers
1k views

LDAP user authentication on CentOS 7: Permission denied

I configured LDAP on CentOs 7 and now I'm trying to configure external user authentication. Browsing I found this: https://www.centos.org/docs/5/html/Deployment_Guide-en-US/s1-ldap-pam.html that is ...
0
votes
0answers
28 views

selinux-policy update prevents ssh into ec2. Now what?

I created a new EC2 instance using the official CentOS 7 (x86_64) HVM image. I ran: yum upgrade At: Running transaction Warning: RPMDB altered outside of yum. Updating : ...
1
vote
1answer
51 views

selinux, file not matching file_contexts.local

semanage fcontext -a -t puppet_etc_t "/etc/puppet/environments(/.*)?" cat /etc/selinux/targeted/contexts/files/file_contexts.local # This file is auto-generated by libsemanage # Do not edit ...
1
vote
1answer
79 views

selinux settings for script run by apache to pull git repo

I have a web server running apache under CentOS which as selinux enabled. I have a separate server which has gitlab running. I'm trying to create a workflow using gitlab's web hooks so that when code ...
1
vote
0answers
67 views

SElinux sandbox fails to start from systemd service

I have a server that runs user submitted code, for evaluation. I wrote a systemd service that starts a python application, that application then run the submitted code using SElinux sandbox. The ...
2
votes
1answer
478 views

SELinux: no audit errors but nginx permission errors

I try to isolate a SELinux problem with nging/munin. I see that error message in "/var/log/nging/error.log": [crit] 8802#0: *55 connect() to unix:/var/run/munin/fcgi-html.sock failed (13: ...
0
votes
0answers
98 views

Postgres on OpenSuse doesn't start after update

I tried to upgrade OpenSuse from 12.1 to 13.1 and after 'zypper update' and reboot Postgresql doesn't start. Here is the output of service postgresgl status: postgresql.service - LSB: Start the ...
1
vote
2answers
342 views

How can I move /var/log/audit/audit.log to another partition

Fresh centos 6.5 with updates installed. We want to log auditd to a non persistent volume since we capture everything with splunk or logstash. The destination dir is /mnt/ephemeral/audit/ # ls -l ...
3
votes
1answer
127 views

SE Linux - can't change SELinux booleans with sudo

I think this is the correct place to put this, rather than in StackOverflow Either way, we have a CentOS 6.6 server. SElinux isn't allowing us to enable httpd_can_sendmail I've tried this.... sudo ...
0
votes
0answers
42 views

SELinux - centos 6.5 run_init asks for password of non privileged user

I log onto my aws centos instance, as user: [user@aws-sonar-01 ~]$ sudo -i [root@aws-sonar-01 ~]# run_init /bin/bash -x -c 'ulimit -S -c 0 ; auditd'; echo $? Authenticating user. Password: + ulimit ...
0
votes
1answer
79 views

httpd trying to access root-owned session files

While looking into what's been causing a server to lock up/crash, I found many selinux messages in /var/log/messages. For example: setroubleshoot: SELinux is preventing /usr/sbin/httpd from getattr ...
0
votes
2answers
366 views

SELinux interfering with Apache / PHP [duplicate]

On my installation of CentOS 7, SELinux is enabled by default. This is preventing Apache from properly reading PHP files in the standard /var/www/html document root (the browser is blank when ...
0
votes
1answer
340 views

Centos 7 with SElinux: openvpn and DNS

I'm trying to use openvpn as client on centos 7. It works fine, but i cannot get DNS from server. As you know, there is no resolvconf in new Centos, so, standard update-resolv-conf script doesn't ...
1
vote
2answers
954 views

Centos: rsyslog blocks sshd and also local login if selinux is active

I have a very curious problem on an centos 6.5(now 6.6) machine. After an update between june 11th and october 21th the trouble begins (packages: http://pastebin.com/gXvaycLL). After a restart in ...
0
votes
0answers
142 views

Nconf can't generate & deploy Nagios configuration (SELinux)

this is my 1st post here. I'm having trouble with getting NConf (Nagios configuration tool) work with Nagios under CentOS 6.5 (64bit) with SELinux enabled. NConf wasn't able to generate & deploy ...
1
vote
0answers
74 views

Possible to prevent access to /tmp for a specific user via SELinux?

I'm sort of learning the edges of SELinux and I'm wondering if it's possible to prevent a specific user from accessing /tmp. Clearly it's a bad idea to dork all permissions, so I'm hoping that ...
0
votes
1answer
4k views

Centos 7 and OpenVPN: how make them friends?

I'm trying to install OpenVPN server on Centos 7 and faced with next problem: [root@msk ~]# /etc/init.d/openvpn start Starting openvpn (via systemctl): [ OK ] [root@msk ~]# ...
0
votes
1answer
285 views

Varnish 4 service won't start because of selinux

I've installed varnish 4 on my new centos 6.5 box. I've activated EPEL repo to install varnish from http://repo.varnish-cache.org/redhat/varnish-4.0/ After installing and configuring my default.vcl I ...
2
votes
1answer
2k views

how should I configure selinux when running nginx inside docker

There's a good article in docker's documentation about security with docker : https://docs.docker.com/articles/security/ However, it's not very clear to me how root-priviledged processes in the ...
0
votes
1answer
459 views

Apache can't connect to remote MySQL, but mysql command line from same server can

Symptoms: I am running CentOS 6. I can connect to the remote MySQL from the command line: mysql -h a.b.c.d -u user -p -D db. Laravel artisan commands run on the local command line can also connect: ...
0
votes
0answers
71 views

auditd auid changes after su

I try to implement individual accountability for my RHEL systems using selinux and the audit.log. I followed the instructions given here: Log all commands run by admins on production servers If I ...
0
votes
1answer
165 views

Configuration for Ubuntu SELinux with sshd

I am trying to set-up SELinux in an Ubuntu Trusty server, who is an Amazon EC2 instance. I followed the Debian documentation about installing SELinux. The installation work well as seen by : ...
3
votes
0answers
197 views

SELinux: cannot confine Firefox process to mozilla_t domain

My goal is to execute Firefox in the mozilla_t domain instead of unconfined_t. The machine runs Fedora 20 with SELinux in enforcing mode. Unfortunately, I can't seem to get this right. No matter ...