1
vote
1answer
19 views

Disabling network access for a group of users but allowing smtp only

We have an environment where our users ssh into the system and their shell is set to simply launch Mutt on their $HOME/Maildir. We want to restrict our users to only be able to send/receive mail. We ...
1
vote
1answer
211 views

SELinux permissions for LogRotate and Apache

With the directory structure: /www/live/website1/app/ /www/live/website1/files/ /www/live/website1/logs/ Where Apache needs at least the following access: app: read-only access, but read-write is ...
1
vote
1answer
56 views

Do linux security modules (LSM) run on virtual server (vServer)? [closed]

I have a vServer for 10 EUR/month from 1und1 and I know that it is not a dedicated machine (meaning I have less control). I know that I can use some the system as root, yet the kernel is untouchable. ...
2
votes
2answers
96 views

How to limit access to the private ssh key using SELinux policies?

I'm using Fedora distro - with its preinstalled SELinux policies. I want to limit unsecured access to my private keys in ~/.ssh folder - to prevent leaking by possible malware, that may run under my ...
1
vote
1answer
32 views

Assign selinux context to the application without changing context of binary

Is there a way to assign custom SELinux context to the application despite the context that is assigned to it's binary?
0
votes
3answers
82 views

proftpd is accessing my.cnf

I use proftpd for virtual FTP hosting with MySQL. I've started writing fine-grained SELinux policies and found that it's trying to access my.cnf files. Question is what for and why? type=AVC ...
1
vote
1answer
54 views

How to match selinux rules/transitions/labels/etc to modules

I need to match running/loaded selinux rules/transitions/labels/etc to the selinux policy modules where they are defined (semodules -l). I need this because I want to study some selinux policy modules ...
3
votes
1answer
188 views

How can I query for all selinux rules/default file contexts/etc affecting a type

I need to know everything related to a selinux type on a running system's current rules: allow, allowaudit, dontaudit rules. files labeled with a context using the type. transitions. ...and any ...
1
vote
1answer
354 views

Errors whilst installing kolab

i'm struggling for the past 2 days please help me anyone... [root@mail /]# setup-kolab Please supply a password for the LDAP administrator user 'admin', used to login to the graphical console of 389 ...
2
votes
1answer
55 views

Adding to existing policy in selinux

I just created a custom policy and did the semodule -i test.te. I reran all my tests after a few days and I noticed there were additional AVC denials in the audit.log. I want to add the new stuff ...
2
votes
0answers
101 views

selinux “Possible mismatch between this policy…”

How do I go about troubleshooting the following error below: type=AVC msg=audit(1365523330.609:4846): avc: denied { append } for pid=12542 comm="FTPMan.pl" name="user_list" dev=dm-0 ino=2884237 ...
1
vote
1answer
59 views

selinux in enforcing mode

I do test driven development where all my APIs are tested with a batch of tests. Initially, I ran the tests in ‘permissive’ mode in selinux. So, I decided to enable selinux to ‘enforcing’ mode. ...
0
votes
2answers
211 views

selinux Missing type enforcement (TE) allow rule

When I run my FTP test to test for full functionality, I'm concerned on why am I getting an avc denial error on such a popular command, such as 'mkdir'? Here is the AVC denial message: type=AVC ...
2
votes
2answers
325 views

selinux avc: denied issue

I just setup a web hosting server with selinux in permissive mode, meaning it's unsecured but writing issues to the message log file. Once I have fixed all the avc: denied errors, I will put the ...
0
votes
2answers
164 views

selinux permissive and type targeted

i am running centos 6.2 recently i noticed that apache was running with selinux enabled # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # ...
1
vote
0answers
51 views

SELinux documentation [closed]

SELinux is still shipping with new version of Linux (like RHEL), and is still heavily used. However, if a problem occur its hard to find a forum post or answer that doesn’t just tell you to turn it ...
1
vote
3answers
325 views

Can Solaris RBAC roles be ported to Linux using SElinux only?

We are migrating an application from Solaris to Linux and the main user is allowed, through the use of RBAC roles, to run a few system commands like svccfg/svcadm (chkconfig on redhat). Is it ...
1
vote
1answer
123 views

How to allow custom program on 80 port via selinux

I have custom webserver that i want to run on 80 port. The problem is its being blocked by selinux. So from localhost I can browse the site, but from outer world its not accessible. I run the ...
1
vote
0answers
59 views

SELinux - Prevent users in the user_t domain from creating sockets

I need untrusted users to execute Ruby and Python scripts via SSH on a Fedora 17 machine with a minimal impact on system integrity and security. A SSH wrapper will ensure only Ruby and Python ...
2
votes
0answers
56 views

How to create user/allowed port policies in SELinux? [duplicate]

Possible Duplicate: Restrict User Access to Certain Ports I have been looking at the SELinux documentation for allowing all user processes to only bind on certain ports. How can I say, ...
1
vote
2answers
336 views

Relabeling of filesystems (SELinux) fails

After compiling the policy modules and re-compiling my core packages (Gentoo 32bit) I wanted to relabel the filesystems (via rlpkg -a -r) and packages but I get these error messages: Relabeling ...
2
votes
1answer
728 views

How to construct SELinux rules for a Glassfish server

I'm running Glassfish 3.1 on a CentOS 6 solution and by default SELinux is enabled. I have installed Sun's JDK version 1.6.0_29 on the server and extracted the Glassfish 3.1.1 to /opt/glassfish-3.1.1 ...
2
votes
1answer
2k views

/bin/su permission denied after SELinux is enabled - not resolved by manual creation of SELinux policies

For some reason, I can't su to root with from a non-root user: [rilindo@kerberos ~]$ /bin/su - -bash: /bin/su: Permission denied Running output from /var/log/audit/audit.log either returns this: ...
1
vote
3answers
1k views

How do I secure my OpenVZ host node?

I'm running a server using OpenVZ for a few websites. Nothing in HN except for sshd. A VM for Varnish, a VM for MySQL and a few VMs each for one website (running Apache/PHP). Now I'd like to secure ...
3
votes
1answer
232 views

The imporance of having SELinux enabled on a web server

This question is probably a matter of personal opinion but I wanted to gather your thoughts on how important having SELinux enabled on a web server is. In your opinion, is the added security a must ...
2
votes
5answers
11k views

How to disable SELinux for Apache httpd only on my Fedora 14?

By following this link I am able to just turn SELinux off completely from my Fedora 14. But I wonder how could I disable SELinux only for the httpd daemon? I don't have system-config-selinux installed ...
6
votes
3answers
657 views

SELinux - Getting Started on really understanding it?

I often have problems with SELinux, most of which I have resolved eventually. There are still some situations where doing custom policy would be very elegant and more proper. I'd like to get the ...
9
votes
5answers
2k views

Why we need SELinux?

I could not get much idea where the SELinux has been used and what it saves from attacker. I have gone through SELinux web site and read the basic but still not getting clue about SELinux. For the ...
1
vote
1answer
613 views

SElinux in ubuntu

Has anyone installed SW Linux in Ubuntu? what were your results? does it come with all the same default rules that the Redhat installation does? I like the security of SE linux, but I have a ...
7
votes
2answers
867 views

Real life SELinux security example?

Can anyone give a real life example of where SELinux saved their security bacon? (or AppArmour if you wish). If not your own, a pointer to someone with a credible experience? Not a lab test, not a ...
0
votes
1answer
798 views

Slackware and SELinux

I would like to learn and play with SELinux on Slackware, my distro of choice. The kernel already includes SELinux code, so that is not a problem. Slackware does not ship with PAM, and I would prefer ...
3
votes
6answers
910 views

Linux distributions without selinux

Are there linux distros without selinux portion in kernel? Sorry if that's dumb question ;), but my distro (debian) has it and i see that it's in kernel on kernel.org so i was wondering if it's so ...
1
vote
2answers
3k views

SELinux preventing passwordless SSH login

I would like to connect a user account I have created for git in /var/git using authorized_keys. However, SELinux prevents this with the following AVC message SELinux is preventing sshd(sshd_t) ...
6
votes
3answers
828 views

SELinux in the Real World

Through my (short) job experience to date, I have gained quite a bit of knowledge of how SELinux works, from an implementation point of view and how to administer it. I personally have several ...
23
votes
7answers
4k views

Reasons to disable / enable SELinux

In the line of this question on StackOverflow and the completely different crowd we have here, I wonder: what are your reasons to disable SELinux (assuming most people still do)? Would you like to ...
1
vote
5answers
317 views

How do you secure the “gallery” photo gallery?

Are there any special steps that should be taken to secure Gallery? Specifically, I currently have the Fedora RPM gallery2-2.3-1.fc8 installed. I do have selinux enabled in targeted mode, which is a ...