2
votes
1answer
46 views

Why don't my domain transitions don't occur when the application binary is outside of the stardard binary directories?

I'm trying to set up a custom SELinux policy, but I'm having trouble getting the domain transitions to occur when the application binary is outside of the standard binary directories such as /bin, ...
1
vote
1answer
57 views

Why does Fedora 20 still deny access to home directories after enabling SELinux httpd_read_user_content and setting files to httpd_user_content_t?

On my Fedora 20, I've learned that to allow write access to files by processes like PHP via Apache, the process owner, which is in my case apache, must have write permissions to the files. Also, since ...
1
vote
1answer
80 views

SELinux access denied error for bash scripts triggered from perl-cgi script

I have a automation framework which use Perl-CGI for running scripts at server. As we have SELinux enabled I am getting access denied errors when the script try to run a bash script. Below is the ...
0
votes
0answers
44 views

Reading home files permission: Policy constraint violation

I want to confine a certain user to be able to bind a node.js server to a certain port. That bit is working. What isn't working is allowing said user to access his own files. audit2allow is telling ...
1
vote
1answer
207 views

SELinux permissions for LogRotate and Apache

With the directory structure: /www/live/website1/app/ /www/live/website1/files/ /www/live/website1/logs/ Where Apache needs at least the following access: app: read-only access, but read-write is ...
0
votes
1answer
78 views

My virtual users can't Chroot()

I'm configuring a Proftp server in a Fedora 20 Linux server. All my real users are loging in perfectly but not the case with the virtual users. Virtaul users are in the SQL table and mod_sql.c is ...
1
vote
2answers
248 views

SELinux: denied { execute } for pid=2174 comm=“httpd” path=“/etc/httpd/lib/libaprutil-1.so.0.5.3”

I have problem with SELinux. setroubleshoot suggested to enable mypol.pp with semodule -i mypol.pp so apache could run. after I run the suggested command, I'm keep getting: type=AVC ...
1
vote
1answer
214 views

Configure SElinux to allow rsync from a remote machine

I've set up a Debian machine with SElinux and except rsync from a remote machine everything works fine. I already created some module with additional rights using audit2allow, and now all errors in ...
4
votes
2answers
284 views

Unable to start Mysql with SELinux

I am attempting to start MySQL with SELinux on CentOS 6 however I am getting the following error. 131212 09:08:08 mysqld_safe mysqld from pid file /var/run/mysqld/mysqld.pid ended 131212 09:08:58 ...
2
votes
2answers
96 views

How to limit access to the private ssh key using SELinux policies?

I'm using Fedora distro - with its preinstalled SELinux policies. I want to limit unsecured access to my private keys in ~/.ssh folder - to prevent leaking by possible malware, that may run under my ...
3
votes
2answers
557 views

Write once, read many (WORM) using Linux file system

I have a requirement to write files to a Linux file system that can not be subsequently overwritten, appended to, updated in any way, or deleted. Not by a sudo-er, root, or anybody. I am attempting to ...
2
votes
1answer
231 views

Creating a public_html for a user on a Red Hat Linux Server

I'm just trying to make a public_html folder under my username on a Red Hat Linux Server (and it's all been a bit of a headache). I made the folder and set the permissions to 755. I wasn't sure how ...
1
vote
1answer
54 views

How to match selinux rules/transitions/labels/etc to modules

I need to match running/loaded selinux rules/transitions/labels/etc to the selinux policy modules where they are defined (semodules -l). I need this because I want to study some selinux policy modules ...
3
votes
1answer
186 views

How can I query for all selinux rules/default file contexts/etc affecting a type

I need to know everything related to a selinux type on a running system's current rules: allow, allowaudit, dontaudit rules. files labeled with a context using the type. transitions. ...and any ...
3
votes
1answer
165 views

Selinux interfering with vboxwebsrv or phpvirtualbox

I have a brand new installation of Fedora 18, with a brand new installation of Virtualbox 4.2. I have spent a painful few hours trying to get phpVirtualBox working. Apache 2.4 and PHP 5.4 are ...
1
vote
1answer
354 views

Errors whilst installing kolab

i'm struggling for the past 2 days please help me anyone... [root@mail /]# setup-kolab Please supply a password for the LDAP administrator user 'admin', used to login to the graphical console of 389 ...
2
votes
2answers
625 views

setenforce: SELinux is disabled

I'm in a CentOS 5 machine, and try to install vsftpd. I want to configure ftp_home_dir using setsebool -P ftp_home_dir on but it says: setsebool: SELinux is disabled. I try to enable it using ...
2
votes
1answer
55 views

Adding to existing policy in selinux

I just created a custom policy and did the semodule -i test.te. I reran all my tests after a few days and I noticed there were additional AVC denials in the audit.log. I want to add the new stuff ...
2
votes
0answers
101 views

selinux “Possible mismatch between this policy…”

How do I go about troubleshooting the following error below: type=AVC msg=audit(1365523330.609:4846): avc: denied { append } for pid=12542 comm="FTPMan.pl" name="user_list" dev=dm-0 ino=2884237 ...
1
vote
1answer
59 views

selinux in enforcing mode

I do test driven development where all my APIs are tested with a batch of tests. Initially, I ran the tests in ‘permissive’ mode in selinux. So, I decided to enable selinux to ‘enforcing’ mode. ...
0
votes
2answers
211 views

selinux Missing type enforcement (TE) allow rule

When I run my FTP test to test for full functionality, I'm concerned on why am I getting an avc denial error on such a popular command, such as 'mkdir'? Here is the AVC denial message: type=AVC ...
2
votes
2answers
324 views

selinux avc: denied issue

I just setup a web hosting server with selinux in permissive mode, meaning it's unsecured but writing issues to the message log file. Once I have fixed all the avc: denied errors, I will put the ...
0
votes
1answer
773 views

Change unconfined_u to system_u is failing [duplicate]

I've got a file on my apache/linux server. ls -Z gives: drwxr-xr-x. apache apache unconfined_u:object_r:httpd_sys_rw_content_t:s0 localization.smicloud.org I need to change unconfined_u to ...
-1
votes
1answer
30 views

if I'm only using a server to host webpages, should I be using SELINUX? [duplicate]

On my server, I have static and dynamic websites. Yes there are api links, but they aren't exactly open to the public. When is it appropriate to SELINUX? would this be an appropriate example of a good ...
0
votes
2answers
976 views

sshd[4344]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument?

OpenSSH_5.8p1, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 selinux-policy-2.4.6-338.el5 pam-0.99.6.2-12.el5 SELinux is running in permissive mode: # sestatus SELinux status: enabled ...
2
votes
3answers
10k views

Where is the sshd log file on Red Hat Linux stored?

Can someone please tell me where to find the SSHD log on RedHat and SELinux.... I would like to view the log to see who is logging into my account..
4
votes
4answers
2k views

Trying to SSH in to remote computer but still asking for password

Trying to SSH in to remote computer but still asking for password. I have a number of computers running SElinux and only one of them is giving me a hard time using ssh without the password. I did ...
1
vote
0answers
68 views

linux: upload / download difference on network shares

I have a Red Hat Enterprise Linux 6 (with SELinux) which shows significant differences of speed between download and upload (the latter significantly slower) of files shared over the LAN. The ...
0
votes
2answers
163 views

selinux permissive and type targeted

i am running centos 6.2 recently i noticed that apache was running with selinux enabled # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # ...
3
votes
1answer
490 views

CentOS - semanage - Delete range of ports

Surprisingly, could not find any clear information on how to delete a range of ports by way of semanage port. Here is a list of permutations I tried: semanage port -d -t http_port_t -p tcp 0-60000 ...
1
vote
1answer
131 views

selinux boolean allow_user_postgresql_connect has no effect

I'm setting up a new system which contains a postgresql database and I'm trying to lock down which machines are able to open a connection to the database. I'm trying to use the ...
1
vote
0answers
51 views

SELinux documentation [closed]

SELinux is still shipping with new version of Linux (like RHEL), and is still heavily used. However, if a problem occur its hard to find a forum post or answer that doesn’t just tell you to turn it ...
2
votes
1answer
331 views

SELinux - Allow multiple services access to same /home/dir

I currently have SELinux enabled and have been able to configure apache to allow access to /home/src/web with a chcon command granting the 'httpd_sys_content_t' type. But now I am trying to serve the ...
1
vote
2answers
1k views

What does the .autorelabel file do in Linux?

What does the .autorelabel file located at the file root / do in Linux? I know its something to do with SELinux but I can't find any information as to what it actually does. I am running CentOS 6. ...
0
votes
1answer
58 views

change selinux property of a file? [duplicate]

Possible Duplicate: Permission denied in vhost document root Apache cant process my files due to forbidden error, searching resulted that it might be because of selinux, how can I change ...
1
vote
3answers
324 views

Can Solaris RBAC roles be ported to Linux using SElinux only?

We are migrating an application from Solaris to Linux and the main user is allowed, through the use of RBAC roles, to run a few system commands like svccfg/svcadm (chkconfig on redhat). Is it ...
1
vote
1answer
123 views

How to allow custom program on 80 port via selinux

I have custom webserver that i want to run on 80 port. The problem is its being blocked by selinux. So from localhost I can browse the site, but from outer world its not accessible. I run the ...
1
vote
2answers
933 views

Why isn't my cronjob running?

I have a cronjob in /etc/cron.d/mycron that looks like this: 0 3 * * * apache php /path/to/my/script.php In the same file there are other cronjobs begin run as root and other users (which ...
1
vote
1answer
26 views

List all files with specified selinux context

How do I list all the files with specific selinux context such as - 'system_u:object_r:svirt_image_t:s0:c332,c575' etc ??
0
votes
2answers
258 views

SELinux preventing cups-pdf output to samba shared directory

I want to setup an cups-pdf printer to print PDFs to a samba shared directory but SELinux denies cups access to the shared directory. (cups needs to write to a local FS directory which is hosted as a ...
2
votes
0answers
56 views

How to create user/allowed port policies in SELinux? [duplicate]

Possible Duplicate: Restrict User Access to Certain Ports I have been looking at the SELinux documentation for allowing all user processes to only bind on certain ports. How can I say, ...
3
votes
2answers
2k views

Unable to start auditd

I am on CentOS 5.8 final I recently installed auditd via yum install audit however I am unable to start it. I edited the configuration file to give a verbose output of the error it is recieving in ...
2
votes
2answers
790 views

How to write protect a directory? [closed]

I have some directories and files that looks like this one drwxr-xr-x. 2 ss ss 4096 Oct 3 2004 backup Notice the . in the permissions. The user ss can not delete this directory. Question How ...
1
vote
2answers
381 views

'/var/spool/cron' is not a directory, bailing out. when trying to work with crontab via PHP's shell_exec

I am creating a web application. Part of the functionality is depending on that the user can start/stop a cronjob that imports emails. It doesn't work. Just to make sure I'm on the right track, as ...
0
votes
0answers
1k views

Httpd won't start because of permission denied

This happened after the server went down all of sudden, we couldn't access it only a minute later, when we attempted apache restart. the error below occurred: httpd: Syntax error on line 221 of ...
1
vote
1answer
946 views

SElinux: How to change to permissive mode without a reboot?

I need to change selinux to "permissive mode" on a production server without a reboot, but setenforce wont let me do it(as a root), it always prints "setenforce: SELinux is disabled" What i'm doing ...
3
votes
2answers
286 views

Setting up Apache virtualhosts pointing at files in user directory. Worked fine on Ubuntu, now I'm on Fedora

I've recently moved from Ubuntu to Fedora. I now wish I'd done it a lot earlier because I've realised I don't know nearly as much about Linux as I ought to - Ubuntu hid a lot from me. Previously on ...
2
votes
1answer
606 views

SETroubleShoot “unrecognized service” error

I installed the package but I'm getting an "unrecognized service" error: [alexus@wcmisdlin02 ~]$ sudo yum install setroubleshoot Loaded plugins: refresh-packagekit Setting up Install Process ...
2
votes
1answer
2k views

/bin/su permission denied after SELinux is enabled - not resolved by manual creation of SELinux policies

For some reason, I can't su to root with from a non-root user: [rilindo@kerberos ~]$ /bin/su - -bash: /bin/su: Permission denied Running output from /var/log/audit/audit.log either returns this: ...
3
votes
1answer
155 views

What's the correct SELinux type for a directory?

If I create a new filesystem/directory off of / and I set the Linux permissions to 770 I expect the group to be able to read and write files in that directory. SELinux was preventing me from doing ...