NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

0
votes
0answers
11 views

pam_tty audit logs gives too much of not required information

We are using pam_tty to record all the commands that user types. We are interested in monitoring the user commands. In the audit.log, when we grep for USER_TTY, there is too much of logging that ...
0
votes
0answers
10 views

libsepol.policydb_read: policydb magic number

I'm trying to create a selinux .te file from a .pp file but the tools on fc22 don't work. Is this a bug or should I be doing something different? Environment: fc22 [root@fc20-64 ~]# rpm -q ...
3
votes
0answers
15 views

SELinux: manually changing files in /etc/selinux/targeted/contexts/files/

I'm setting up a CentOS 7 server in which the /home directory has to be located on another partition and then mounted with bind-mount. So: /data/homes should be bind-mounted to /home. The problem is ...
0
votes
0answers
28 views

systemd apache service start is denied by selinux on centos 7

I am trying to start a custom httpd service from systemd on centos7. on the command line all works fine but from systemd it fails. the command line to start httpd is /usr/sbin/httpd -f ...
0
votes
0answers
23 views

fcoemon: error response from lldpad: error

I have created and configured the red hat cluster and as I was just going through logs to see if every thing is fine, thats when I saw these errors. Not sure whats with these errors. Please advise. ...
0
votes
0answers
7 views

SELinux: Restrict access to /tmp to subfolder

I'm trying to work out an SELinux policy that would allow httpd to have read-write access to a subfolder in /tmp, but not to the parent. Setting httpd_sys_rw_content_t on the subfolder allows the RW ...
0
votes
0answers
6 views

Http request blocked on port 80 [duplicate]

I currently have Centos 7 installed on EC2 with the following: Apache Php Mysql Iptables Firewalld Apache running Redirecting to /bin/systemctl status httpd.service ● httpd.service - The ...
2
votes
2answers
23 views

SELinux create custom role

I have a folder shared out via Samba, and a Docker container which I would like to give access to said folder by adding it as a volume to the Docker container (yes, I know that's not portable). ...
0
votes
1answer
26 views

can access virtualhost locally on the same server but cannot access on remote machine

A pretty wired problem occured when configure a virtualhost at port 81. When I use command curl 123.123.123.123:81 or curl localhost:81 in the same server, it got response. While when I access it ...
3
votes
0answers
93 views

SSH - 1s hang at “Entering interactive session” (Not DNS; possibly SELinux related)

I'm having an issue on CentOS 6.7 where SSH logins are 1s more than any non-6.7 machines on this network (e.g. 7.2, 5.11). Running debugging on the client side showed the hang at "Entering interactive ...
2
votes
1answer
29 views

Why isn't my SELinux logging anything?

I have a sneaking suspicion it has something to do with me mucking about with my rsyslog.conf, but I'm not 100% sure about that. I am running Centos 7, and SELinux has been working A-OK. However, I ...
3
votes
0answers
23 views

View custom selinux policies

Is there a way to view all custom policies applied to SELinux, preferably rolling them all up into one policy "package"? I've just spent the last week or so working through a series of SELinux errors ...
2
votes
0answers
19 views

Finding local ID for SELinux denial under Fedora 23

Trying to get more fluent with SELinux, it looks like sealert -l <local-id> would be a particularly useful way to get help with logged denials. From what I understand, the local IDs used to ...
3
votes
1answer
35 views

SELinux allow access for perl script via log rotate

I have a perl script that I want to run as a perorate script for log rotate. When I force log rotate to run from the command line as root, it works. However, when run through cron, SELinux prevents ...
1
vote
1answer
114 views

ValueError: Type http_sys_content_t is invalid, must be a file or device type

I need to set selinux permissions on a non-default httpd directory: /www/virtualhosts/site01, ect. So I issue: [mybox]# semanage fcontext -a -t http_sys_content_t "/www(/.*)?" And get: ...
0
votes
1answer
60 views

Service php-fpm does not get user permissions

I have an issue with php-fpm. It is actually the php7 version. I have drupal and it will complain that some directory is not writtable. Only if I start php-fpm as a service like that: #service ...
0
votes
1answer
22 views

How can I run a salt state if a command prints zero rows?

I've got Salt and SELinux running on CentOS7. I want to run restorecon -Rv /path/to/something, but only if it's necessary. I know that Salt has the onlyif and unless commands, but I'm having a heck ...
2
votes
2answers
92 views

Can't apply SELinux file context to paths with symlinks

I have a solution that is being installed in an enterprise environment. The solution and its deployment guide are designed to installed on a RHEL7/CentOS7 server with SELinux enabled and components ...
0
votes
2answers
240 views

Permission denied with Openshift PersistentStorage on GlusterFS

I'm trying to use OpenShift with PersistentStorage on a GusterFS cluster. I'm starting one of the default templates : mysql-persistent I've installed a GlusterFS cluster and create a volume ...
0
votes
0answers
40 views

Error 13 when executing mysqldump to export a database into a cvs file

I would like to export my database into a .csv file but I got a problem when I execute the command to do that: mysqldump -u root -p -t -T~/tesht/ database orders --fields-terminated-by=',' ...
1
vote
0answers
21 views

How do i configure NIS on Fedora 22?

I am trying to configure NIS client on Fedora 22. Following the tutorial http://www.server-world.info/en/note?os=Fedora_22&p=nis&f=2. I have to set SELinux=disable so that folders can be ...
0
votes
1answer
54 views

SELinux permissions for a socket and PID

I'm looking at getting rmilter installed on a CentOS 7 box. I'm trying to work out which SELinux labels/permissions I need for the daemon to bind/write to the following pidfile = ...
1
vote
1answer
227 views

SElinux on Debian Jessie missing default policy

I want to enable SElinux on Debian Jessie. In order to do this, I followed the guide on https://wiki.debian.org/SELinux/Setup. However, when I run the apt-get command, the selinux-policy-default ...
3
votes
0answers
26 views

What's the recommended way to restrict Internet access per process using SELinux?

Before I have tried to do this using a phony user and iptables to execute commands that needs to be restricted. However now the commands need to read configuration set by each user's environment vars ...
2
votes
1answer
64 views

Running logstash under SELinux

I want to run logstash as root to allow it to read all logs (granting it access to every log is very tiresome). However, I don't want it running amok on my server, I thought about constraining it ...
0
votes
0answers
17 views

xguest with Biometric validation

I am looking for a solution to the following problem: A server is connected to 'dummy' terminals (all-in-one computers) in an isolated network. These terminals have xguest account that are directly ...
2
votes
1answer
27 views

docker made fedora host unbootable in selinux enforcing mode

I've done incautiously docker run -v /:/mnt:ro someimage It has resulted with some docker (docker v1.7) daemon error. Since then I can only boot in permissive mode and got lot of selinux errors. ...
0
votes
1answer
74 views

iptables outgoing default policy is accept, but some ports appear blocked

I'm new to servers and iptables. I have a web app (happens to be bugzilla) running on my Centos 6.7 apache/httpd server, and it attempts to connect out to the web (updates.bugzilla.org) via port 80. ...
1
vote
1answer
60 views

SELinux preventing Fail2Ban from emailing notification via msmtp

I have msmtp as a null client connecting to my AWS SES account for SMTP, delivering alerts such as cron, monit and soon hopefully Fail2Ban to my email addresses. However, Fail2Ban isn't playing ball, ...
0
votes
1answer
93 views

SSH allowing remote hosts to connect to local forwarded ports

I'm currently facing an issue with a RHEL 7.0 regarding the ssh option -g (i.e remote hosts connection to local forwarded ports ). I'm establishing a connection with port forwarding, from a server on ...
0
votes
0answers
102 views

Fail2Ban Cannot Read NginX Log Files - SELinux - ERROR No file(s) found for glob

I've been having issues with this on and off and I've exhausted my abilities on this. It's a CentOS7 system with SElinux enabled. Fail2Ban works for most jails just fine, very happy with it. My ...
-1
votes
2answers
389 views

Correct CentOS 7 SSH configuration

I'm having some trouble changing the ports on a new CentOS 7 (minimal) machine (IP 11.22.33.44). To log into the new machine, I use a proxy VPS (let's say, IP 88.99.100.101). I edited the ...
0
votes
1answer
55 views

Nagios Selinux contexts on RHEL7 equivelant

I installed nagios core and plugins for the first time, and can't get it to work with SElinux. The error in the audit log is, type=AVC msg=audit(1441480084.865:710): avc: denied { execute } for ...
2
votes
1answer
68 views

Unable to enable custom SELinux rule

logrotate is unable to rotate a log file for our application on CentOS 7. This appears to be because of this AVC error: type=AVC msg=audit(1441112694.305:19502): avc: denied { write } for pid=9146 ...
1
vote
0answers
24 views

SELinux for in-house applications

I have a ruby application running on Puma, behind nginx. I want to use SELinux to mitigate the risk of it being used as an entry point to the rest of our system. I couldn't find any reference of ...
0
votes
0answers
177 views

Suspicious SELinux Audit Log Entries PHP-FPM Write Denied - How to investigate?

I found a few /var/log/audit/audit.log entries which have me a little bit concerned. SEAlert explains them as such: SELinux is preventing /usr/sbin/php-fpm from write access on the directory ...
1
vote
1answer
65 views

selinux: rwx permissions for a folder

I am facing problems with PHP interface that calls perl and shell scripts. These enable uploading of a file to a folder and execute them with some input while storing output into some other files. Now ...
0
votes
0answers
59 views

semodule -i takes 100% cpu and does not end

I am setting up selinux and ran grep ${1} /var/log/audit/audit.log | audit2allow -r -M local_${1} within an compilation script (oneliner). I'd like to run it like "compile_selinux collectd_t" so ...
2
votes
1answer
62 views

SELinux not enforcing apache write restrictions despite being enabled

Problem in a nutshell: SELinux does not protect files and directories labeled as httpd_sys_content_t from being written, deleted or changed when new/custom document root is created. I have ...
2
votes
0answers
70 views

how do i inspect the contents of an selinux module?

I would like to view the [textual] contents of an selinux module, say for instance, /etc/selinux/targeted/modules/active/modules/udev.pp. I tried sedismod, but I get the following error on Fedora 21: ...
0
votes
1answer
21 views

Can't enable logging for Bind 9 on Red Hat [closed]

When I enable logging for Bind, I get a permissions denied error which is due to Bind running in chroot/selinux (avc denied write). I can't figure out how to reconfigure selinux to allow the log file ...
2
votes
2answers
557 views

Enable SELinux on Centos7 LXC container with Ubuntu 14.04 host

I'm trying to setup an LXC container for testing which is running CentOS 7 with SELinux enabled to meet the requirements for a test I'm trying to run. Despite all my efforts, I'm still unable to get ...
1
vote
1answer
280 views

Dovecot SELinux MailDir permission denied

I have dovecot installed on CentOS 7.1. In the past, I have often just disabled SELinux, but now I want to have a server with SELinux that works for me. Anyhow, I have mail stored in ...
0
votes
1answer
111 views

Why is this HTTP to HTTPS redirection not working?

I have been reading through all the discussions on the subject and decided to use the Redirect method in the httpd.conf file with no luck... So I came back here to this knowledgable crowd. We have a ...
2
votes
1answer
226 views

SELinux on CentOS not working

i'm new to CentOS and trying to enable SELinux and it's not working after a restart as described on ...
1
vote
1answer
199 views

Creating an SELINUX allow rule for sockets error with clamd

I've got a CentOS 7 box configured as a Squid proxy, with clamav and Squidclamav. Normally I would just disable SELINUX, but I am attempting to understand and setup allow rules properly. I've managed ...
0
votes
1answer
177 views

What are soundd daemons, and why does nginx need the type under SELinux?

Curious what is soundd daemon. The wiki at http://wiki.centos.org/TipsAndTricks/SelinuxBooleans says it is "soundd daemon" but I'm not finding much additional info on internet. To get nginx ...
0
votes
2answers
237 views

SSH works but tunneling or SFTP doesn't. Why?

since 2014 I've got a server from SoYouStart, with Centos 7. It worked perfectly, but now I had to install again the OS. Now I'm configuring all the services to work again. I need to connect to the ...
2
votes
1answer
29 views

Find modified selinux booleans

I have a CentOS 6.6 server that was setup by someone else. I'll be recreating this server from scratch on a new box and I'm wondering if there is any way I can find out what selinux booleans have been ...
0
votes
2answers
70 views

Add custom 'allow' policy in SELinux

I would like allow httpd to executed files from a user's home directory. From audit2allow I understand that this implies the following policy: allow httpd_t user_home_t:file execute; How do I turn ...