NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

1
vote
1answer
496 views

Why can't I shutdown running kvm instance?

I have running kvm instance: =# virsh list --all Id Name State ---------------------------------------------------- 2 debian-test running When ...
2
votes
1answer
514 views

RHEL SELinux context differs between matchpathcon and restorecon

I am using RHEL 6.3 and I experiment a strange behavior with matchpathcon and restorecon SELinux commands. For a specific file, I have defined a context with semanage fcontext. Then, matchpathcon ...
3
votes
2answers
1k views

Write once, read many (WORM) using Linux file system

I have a requirement to write files to a Linux file system that can not be subsequently overwritten, appended to, updated in any way, or deleted. Not by a sudo-er, root, or anybody. I am attempting to ...
4
votes
2answers
1k views

Unable to start Mysql with SELinux

I am attempting to start MySQL with SELinux on CentOS 6 however I am getting the following error. 131212 09:08:08 mysqld_safe mysqld from pid file /var/run/mysqld/mysqld.pid ended 131212 09:08:58 ...
10
votes
2answers
5k views

SElinux: allow httpd to connect to a specific port

My system is running CentOS 6.4 with apache2.2.15. SElinux is enforcing and I'm trying to connect to a local instance of redis through my python/wsgi app. I get Error 13, Permission denied. I could ...
1
vote
2answers
1k views

SELinux: denied { execute } for pid=2174 comm=“httpd” path=“/etc/httpd/lib/libaprutil-1.so.0.5.3”

I have problem with SELinux. setroubleshoot suggested to enable mypol.pp with semodule -i mypol.pp so apache could run. after I run the suggested command, I'm keep getting: type=AVC ...
5
votes
6answers
6k views

how do I allow mysql connections through selinux

I'd like to for once leave selinux running on a server for the alleged increased security. I usually disable selinux to get anything to work. How do I tell selinux to allow mysql connections? The most ...
1
vote
1answer
807 views

Configure SElinux to allow rsync from a remote machine

I've set up a Debian machine with SElinux and except rsync from a remote machine everything works fine. I already created some module with additional rights using audit2allow, and now all errors in ...
2
votes
2answers
520 views

MySQL 5.6 and SELinux are arguing

CentOS 6.4(x64) / MySQL 5.6.10 Installed MySQL from source files and started it fine under it's original location (/var/lib/mysql). I moved everything to a different volume (/u0/mysql) and went ...
3
votes
1answer
1k views

Postfix won't run while selinux in enforcing mode

I enabled selinux forcing mode on Fedora 15 , and I was able to get apache, mysql and memcached to work fine , but I couldn't get postfix to run . I got the following errors : systemd[1]: Unit ...
8
votes
3answers
5k views

CentOS 6 kickstart ignoring 'selinux --disabled'

I've been fighting with this one for a bit and it seems that there has been a regression in CentOS 6 as far as anaconda ignoring the selinux --disabled directive. This appears to have first appeared ...
0
votes
0answers
243 views

Hidden 'neverallow' in selinux policy?

I intend to use 'enforce' selinux mode. First, i boot in permissive mode ( enforcing=0 in kernel cmdline ). After login in system, i collect all selinux policy violation from auditd logs and try to ...
2
votes
2answers
172 views

How to limit access to the private ssh key using SELinux policies?

I'm using Fedora distro - with its preinstalled SELinux policies. I want to limit unsecured access to my private keys in ~/.ssh folder - to prevent leaking by possible malware, that may run under my ...
1
vote
3answers
4k views

CentOS 6: PHP can not load gdchart.so and oci8.so compiled by me

I have been trying to add 2 PHP extensions to a freshly installed CentOS 6.0 Linux server, but get the error messages in /var/log/httpd/error_log: [notice] SELinux policy enabled; httpd running as ...
2
votes
2answers
1k views

SELinux contexts with NFS shares

I'm trying to set up an NFS share between 2 CentOS servers (filesrv & websrv) for a folder that needs to be readable & writeable by the Apache process. I'm having trouble with the writeable ...
2
votes
2answers
2k views

Incrond running but not executing commands CentOS 6.4

I have copied this question over here from StackOverflow... I have installed incron from the EPEL repository (0.5.9) (before you ask; YES, I also tried downloading the source and compiling locally ...
1
vote
1answer
459 views

SElinux process killed while trying to set boolean

I've got a strange problem. I can not allow apache to connect to database at my CentOC 6.4 box: [root@centos6 ~]# setsebool -P httpd_can_network_connect on Killed [root@centos6 ~]# sestatus -b | grep ...
3
votes
1answer
249 views

Can't make SELinux context types permanent with semanage

I created a new folder at /modevasive to hold my mod_evasive scripts and for the Log Directory. I'm trying to change the context type to httpd_sys_content_t so Apache can write to the folder. I did ...
2
votes
3answers
397 views

Zabbix Trigger for SELinux (type=AVC) Errors

I would like to create a trigger in Zabbix to alert me anytime a type=AVC error appears in a CentOS 6 server's /var/log/audit/audit.log file. I've already tried creating a basic log scrape. E.g.: ...
4
votes
1answer
1k views

Granting sudo access to a SELinux confined user in freeIPA

I'm using freeIPA to define RBAC, HBAC and sudo rules, as well as SELinux user mappings for a domain of a couple hundred virtual machines, where I need to grant different levels of access to several ...
0
votes
1answer
113 views

google sitemap generator installation selinux

when i trying to install google sitemap generator i received this error Change security context of to system_u:object_r:httpd_modules_t install: WARNING: ignoring --context (-Z); this kernel is not ...
1
vote
1answer
114 views

If matchpathcon checks the SELinux context of a directory, what is the converse check for the service?

A page from Fedora docs describes a SELinux context problem with the example: "...instead of using /var/www/html/ for a website, an administrator wants to use /srv/myweb/. ... [However] SELinux ...
1
vote
2answers
822 views

Apache will not stop/start gracefully

CentOs 6 64bit running apache 2.2.15-29.el6.centos. When I try to stop/start or restart httpd I get an error that says it has failed. A tail of the error log is below. I also noticed that a ...
2
votes
1answer
211 views

How to make Puppet fix SELinux types for home directories?

We are using pam_mkhomedir.so to automatically create the home directories of users logging in with SSH. There is a bug in pam_mkhomedir that sets the SELinux contexts to home_root_t instead of ...
2
votes
1answer
947 views

Configure selinux to allow openldap on CentOS 6.4

I'm trying to run an OpenLDAP server on CentOS 6.4 with selinux enabled, but slapd is dieing as soon as it's started via /etc/init.d/slapd start. (init script reports OK; everything works fine after ...
2
votes
1answer
295 views

sudo: PAM audit_log_acct_message() failed: Permission denied

.. any time I'm run sudo through NRPE, I'm get a following message in my /var/log/secure, and I can't figure out how to resolve it. sudo: PAM audit_log_acct_message() failed: Permission denied ...
0
votes
2answers
581 views

RHEL6: Selinux not logging AVC denial messages

I'm trying to configure a set of lockdown rules. My approach is to start with a restricted user, and use audit2allow messages to selective add permissions. My problem is that I don't see the expected ...
4
votes
3answers
1k views

SELinux - canonical way of automatically applying a context on file creation

My current understanding is that you have to manually use restorecon to apply the desired context to a newly created file or directory unless you are happy with the context that it inherits from its ...
4
votes
1answer
166 views

SELinux: How to show all allowed rules for a type?

For an arbitrary object type, e.g. user_tmp_t, I want to know which processes are allowed to access this tag. How do I find all allow rules that reference user_tmp_t?
0
votes
2answers
3k views

Selinux in permissive mode, ssh key based auth and locked account

I noticed something weird regarding ssh key based login and selinux in permissive mode. Let me introduce you the setup: The server is an updated Centos 6.4 x86_64. We create user without a password ...
0
votes
2answers
2k views

Can't change mysql data folder CentOS 6

I've a server with CentOS 6.3 and Mysql installed on. I've created two partition, one for system and the bigger one for data mounted in /data Right after installed Mysql I've created the dir ...
0
votes
1answer
6k views

SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0

I kept getting the following notice in apache log when I start apache http server 2.2: SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0 even though I disabled ...
2
votes
1answer
803 views

Creating a public_html for a user on a Red Hat Linux Server

I'm just trying to make a public_html folder under my username on a Red Hat Linux Server (and it's all been a bit of a headache). I made the folder and set the permissions to 755. I wasn't sure how ...
0
votes
1answer
560 views

Errors whilst installing kolab

i'm struggling for the past 2 days please help me anyone... [root@mail /]# setup-kolab Please supply a password for the LDAP administrator user 'admin', used to login to the graphical console of 389 ...
3
votes
2answers
91 views

Relocated /var - now selinux is unhappy

I needed more space in the /var tree on a VM so I allocated some, booted in to runlevel 1 and copied over the folder to the new space. After changing the fstab entry for /var to reflect the new ...
0
votes
3answers
649 views

Apache Documentroot access forbidden

Running Arch Linux I am trying to get apache to use /www (not /var/www) as DocumentRoot. /www is a softlink to /home/user/www. However, I keep getting an "Access Forbidden" error. The / and /home ...
2
votes
3answers
2k views

(13) Permission denied on Apache CGI attempt

I have recently upgraded my Apache2 server, and am now unable to run a CGI app. My logs are showing (13) Permission denied unable to connect to cgi deamon after multiple tries I understand that the ...
1
vote
2answers
4k views

SELinux preventing passwordless SSH login

I would like to connect a user account I have created for git in /var/git using authorized_keys. However, SELinux prevents this with the following AVC message SELinux is preventing sshd(sshd_t) ...
4
votes
1answer
903 views

RHEL6: Tomcat runs as unconfined Java user

I'm starting to configure RHEL6 to be a hardened Tomcat server and applying SELinux policies for access control. After installing RHEL6 and Tomcat6 (standalone, no httpd), I noticed that the Tomcat ...
1
vote
1answer
38 views

Assign selinux context to the application without changing context of binary

Is there a way to assign custom SELinux context to the application despite the context that is assigned to it's binary?
0
votes
3answers
106 views

proftpd is accessing my.cnf

I use proftpd for virtual FTP hosting with MySQL. I've started writing fine-grained SELinux policies and found that it's trying to access my.cnf files. Question is what for and why? type=AVC ...
1
vote
2answers
896 views

How do I Exempt MySQL from SELinux targeted list?

I am running CentOS 5.5 and attempting to place MySQL on a non-standard port...which SELinux complains about. MySQL starts perfectly fine on with SELinux off and refuses to start with it on. SELinux ...
2
votes
1answer
399 views

SELinux: How to add a new security context?

I'm new to SELinux and am trying to add a new security context (label) to test denial. To do this, I try changing a filew to a new context: chcon -t new_t test But it fails with "Invalid argument". ...
2
votes
1answer
260 views

Gitolite3 over http selinux permissions

I'm trying to install gitolite3 on Centos6.4. It works, I can ssh and, after some trouble, I can also read, such as clone, through http and httpd. I am re-enabling selinux into permissive mode, that I ...
2
votes
0answers
221 views

Gitolite3 push and selinux access failure

I try to install gitolite3 with ssh and http. I have followed largely the official guide at gitolite3, but I am stumbling accross three remaining problems. When I $ git clone ...
2
votes
2answers
137 views

Httpd on Centos6 not listing directory contents

I have a folder (which is NOT the conventional /var/www/html folder!) /Server/Websites/Default on my Centos6.4 server. There is only one file, phpinfo.php (with the obvious code in it). Running ...
1
vote
2answers
2k views

Home directories created with wrong Selinux context

[root@tst-01 home]# ls -Z drwxr-xr-x. ujjain users system_u:object_r:home_root_t:s0 ujjain drwxr-xr-x. johndoe users system_u:object_r:home_root_t:s0 johndoe The selinux ...
1
vote
1answer
174 views

vsftpd + vitual users + selinux

I can't make vsftpd to work and it is driving me crazy. The virtual users can connect, but they can't upload files or create folders. I hope someone can help me. I get this error in the ftp client: ...
1
vote
1answer
436 views

pure-ftpd auth blocked by SELinux

First, my setup. I'm using CentOS 6.4 and I installed pure-ftpd (plus the SELinux module) from the EPEL repositories : > rpm -q pure-ftpd pure-ftpd-selinux pure-ftpd-1.0.30-1.el6.x86_64 ...
1
vote
1answer
102 views

How to match selinux rules/transitions/labels/etc to modules

I need to match running/loaded selinux rules/transitions/labels/etc to the selinux policy modules where they are defined (semodules -l). I need this because I want to study some selinux policy modules ...