NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

0
votes
1answer
22 views

Can't enable logging for Bind 9 on Red Hat [closed]

When I enable logging for Bind, I get a permissions denied error which is due to Bind running in chroot/selinux (avc denied write). I can't figure out how to reconfigure selinux to allow the log file ...
0
votes
1answer
119 views

Why is this HTTP to HTTPS redirection not working?

I have been reading through all the discussions on the subject and decided to use the Redirect method in the httpd.conf file with no luck... So I came back here to this knowledgable crowd. We have a ...
1
vote
1answer
490 views

Dovecot SELinux MailDir permission denied

I have dovecot installed on CentOS 7.1. In the past, I have often just disabled SELinux, but now I want to have a server with SELinux that works for me. Anyhow, I have mail stored in /home/USER/...
1
vote
4answers
2k views

Selinux blocks wordpress in CentOS 6.3

I installed wordpress 3.5 to CentOS 6.3 using command: yum install wordpress and started httpd. Now I can see the following error in apache log: PHP Fatal error: require_once(): Failed opening ...
2
votes
1answer
307 views

SELinux on CentOS not working

i'm new to CentOS and trying to enable SELinux and it's not working after a restart as described on https://www.digitalocean.com/community/tutorials/an-introduction-to-selinux-on-centos-7-part-1-basic-...
0
votes
1answer
235 views

What are soundd daemons, and why does nginx need the type under SELinux?

Curious what is soundd daemon. The wiki at http://wiki.centos.org/TipsAndTricks/SelinuxBooleans says it is "soundd daemon" but I'm not finding much additional info on internet. To get nginx (...
1
vote
1answer
362 views

Creating an SELINUX allow rule for sockets error with clamd

I've got a CentOS 7 box configured as a Squid proxy, with clamav and Squidclamav. Normally I would just disable SELINUX, but I am attempting to understand and setup allow rules properly. I've managed ...
1
vote
1answer
181 views

auditd auid changes after su

I try to implement individual accountability for my RHEL systems using selinux and the audit.log. I followed the instructions given here: Log all commands run by admins on production servers If I ...
2
votes
3answers
3k views

(13) Permission denied on Apache CGI attempt

I have recently upgraded my Apache2 server, and am now unable to run a CGI app. My logs are showing (13) Permission denied unable to connect to cgi deamon after multiple tries I understand that the ...
0
votes
2answers
326 views

SSH works but tunneling or SFTP doesn't. Why?

since 2014 I've got a server from SoYouStart, with Centos 7. It worked perfectly, but now I had to install again the OS. Now I'm configuring all the services to work again. I need to connect to the ...
2
votes
1answer
34 views

Find modified selinux booleans

I have a CentOS 6.6 server that was setup by someone else. I'll be recreating this server from scratch on a new box and I'm wondering if there is any way I can find out what selinux booleans have been ...
0
votes
2answers
99 views

Add custom 'allow' policy in SELinux

I would like allow httpd to executed files from a user's home directory. From audit2allow I understand that this implies the following policy: allow httpd_t user_home_t:file execute; How do I turn ...
2
votes
3answers
257 views

How to disable SELINUX for systemd script?

I have a systemd script in CentOS 7 which doesn't run properly unless I disable SELINUX. Is it possible to somehow have SELINUX enabled on the system but disable it only for this systemd script? The ...
1
vote
0answers
86 views

Selinux: Shorewall will not respond to fail2ban

I am using fail2ban with shorewall and my Fedora 21 server & cloud. All flooded with the following error message: SELinux is preventing shorewall from write access on the file /tmp/fai2ban*.[...
2
votes
2answers
2k views

Boot hanging on SELINUX?

SELINUX is disabled on this this machine (which is a CentOS instance under Xen) but the boot process gets to a point that mentions an audit and SELINUX and then hangs. Is it ever going to come back? ...
0
votes
1answer
348 views

CentOS 7 Cannot delete ports defined for MongoDB

I installed and later removed the MongoDB server on a CentOS 7 box. While cleaning up, I noticed that the ports assigned to MongoDB were still open. if I remember correctly, I was able to delete the ...
0
votes
1answer
416 views

Docker 1.6.0 on RHEL 6.5 with SELinux, can't run containers without root

I'm trying to run a container on a RHEL 6.5 but I keep hitting this problem: sudo docker run -u postgres -it registry/postgres /bin/bash /bin/bash: error while loading shared libraries: libtinfo.so.5:...
23
votes
3answers
19k views

SElinux: allow httpd to connect to a specific port

My system is running CentOS 6.4 with apache2.2.15. SElinux is enforcing and I'm trying to connect to a local instance of redis through my python/wsgi app. I get Error 13, Permission denied. I could ...
2
votes
1answer
245 views

Selinux semanage delete or modify chain

I use on all my server port 24 for SSH. After change port i got error because Selinux block server SSHD restart 4 08:08:02 kvm452 sshd[18297]: error: Bind to port 24 on 0.0.0.0 failed: Permission ...
2
votes
0answers
214 views

Init script has permissions issues, but running with /bin/sh resolves them? [closed]

Can someone tell me what's going on here? As far as I knew, these ways of executing an init script are identical. box:~# whoami root box:~# /etc/init.d/nginx restart nginx: [emerg] open() "/var/run/...
0
votes
1answer
144 views

SELinux - mysql/ and httpdoc/ in same folder?

Looks like my old faithful LAMP directory structure has come unstuck with SELinux. I prefer everything in the same place. CentOS 6.6 Apache 2.2.15 MySQL 6.5 /DATA/ /DATA/httpdocs/ /DATA/mysql/ /DATA/...
0
votes
1answer
459 views

Sharing Collectd data with Apache on CentOS (SELinux)

My CentOS 7 VPS has SELinux enabled and is monitored by Collectd. It uses rrdtool to log the reported data. Pommi released a great solution that made me able to review all data on a webpage called CGP ...
3
votes
1answer
1k views

What I have to modify to have SELinux allow nginx to act as an IMAP/POP3 proxy?

By default nginx under CentOS 7 will fail to start if used as an IMAP/POP proxy. This is because of SELinux. How can SELinux's configuration be altered, without disabling its protections, to allow ...
1
vote
1answer
419 views

Moved /home to new disk, SELinux denying access to /home for sshd

Yesterday I added a drive to a Centos6 VM box, created a /home mount point on the drive and then moved a user (jenkins in this case) to it to free up space from the / mount point. This seemed to work ...
2
votes
2answers
690 views

SELinux - logrotate is not rotating NGINX logs

I am using CentOS, NGINX and Passenger to serve a Rails application. I have SELinux activated, and have had a series of problems with logrotate. I have been able to resolve most of the issues by ...
1
vote
1answer
26 views

SELinux - first attempt to restrict file by type - fails to fail

I have a Centos 6 Linux box. I read tutorials on SELinux and wanted to try it out. Here are steps I followed, set SELINUX=enforcing in /etc/selinux/config turned on SELINUX with setenforce 1 service ...
3
votes
3answers
3k views

SELinux preventing Apache from writing to a file

SELinux is preventing the apache user from writing to a log file which it owns. When I do setenforce 0 it works. Otherwise it shows this error IOError: [Errno 13] Permission denied: '/var/www/webapp/...
1
vote
1answer
72 views

Log/Audit everything allowed by SELinux

I'm profiling some proprietary software to construct a set of permission requirements and SELinux policies to allow it to install and run on Oracle Linux (or any RHEL derivative). I'm running SELinux ...
1
vote
1answer
73 views

Trying to track down why httpd would be trying to connect to a tor port

I'm seeing occasional selinux denied messages in my logs that I believe indicate that the httpd process is trying to connect to a tor port: type=AVC msg=audit(1423247604.799:1966): avc: denied { ...
0
votes
0answers
53 views

Setting up muli-project web development server

I'm trying to set up a development server that will be used for several (web) projects by different teams (consisting of different people, some of which may be involved with more than one project). I ...
1
vote
0answers
137 views

How to power down Cloudstack configured with XenServer Hypervisors

I have three XenServers(6.2) configured in a single pool. I also have a Cloudstack (CentOS 6.5) Management interface controlling them all. Everything is up and running but I can not figure out how to ...
0
votes
1answer
239 views

Selinux “Add context Rule to Semanage” [closed]

As you add or change a new rule to fcontext semanage to any directory and apply, egg: # How to add this rule for apply changes whit restoreconf -Rv /var/www/html(/.*)?/media(/.*)? system_u:object_r:...
1
vote
1answer
632 views

SELINUX blocking php-fpm and nginx working together?

I'm having some issues with SELINUX. When trying to visit my website I get 403 forbidden from nginx and the server pops up with an error and says to use grep NGINX /var/log/audit/audit.log | ...
0
votes
1answer
55 views

ports to open to access samba share

When I turn off my iptables service, I can successfully list my samba shares. But when I turn it back on, I cannot access them at all. Also, my SELINUX is set to permissive Here is my current ...
4
votes
2answers
2k views

CentOS - semanage - Adding Custom Port Fails

I recently upgraded one of my application servers to CentOS 6(.2) and was getting it ready for production use when I can across the following issue; Whenever I try to add a custom http port by way of ...
0
votes
0answers
253 views

PHPINFO creates Permission Denied in error log

Running CentOS 7 with apache 2.4, using PHP5.6 from REMI repository. My wordpress and phpmyadmin seem to work, however any page that has phpinfo() causes a permission denied entry into my error log. ...
1
vote
5answers
335 views

How do you secure the “gallery” photo gallery?

Are there any special steps that should be taken to secure Gallery? Specifically, I currently have the Fedora RPM gallery2-2.3-1.fc8 installed. I do have selinux enabled in targeted mode, which is a ...
-1
votes
1answer
497 views

Configure Nginx as Reverse Proxy with Apache2 on CentOS7 enabled with SELinux

I'm working on a project for academic purposes, the goal is to use Nginx as a Reverse Proxy for Apache, so far i've installed Nginx and everything is ok, it's listening to port 80, but when i was ...
1
vote
1answer
438 views

SELinux Permissive enabled; httpd error reporting

I kept getting the following notice in apache /var/log/messages and many others same messages : kernel: type=1400 audit(1422862414.790:3222): avc: denied { getattr } for pid=2484 comm="deliver" path="...
1
vote
1answer
381 views

Scientific Linux: soft lockup on quad opteron system

After an impressive uptime of 550 days without trouble our quad opteron system turned into a corrupted system a few days after I mounted an nfs-share from a FreeNAS-box. Ongoing sessions remained ...
1
vote
2answers
656 views

nginx suddenly redirecting everything to 403 page, can this be debugged or traced?

I'm not sure what happened to my nginx install. Suddenly all page requests are being redirected to the 403 page. Yesterday I tried to add a user agent to block, restarted service from that point ...
1
vote
2answers
3k views

OpenVPN SELinux Permission Denied

I am running CentOS 6.4. # cat /etc/centos-release CentOS release 6.4 (Final) After some updates, and a reboot, OpenVPN fails to start. # service openvpn start Starting openvpn: ...
3
votes
2answers
2k views

RHEL SELinux blocking Apache access to PostgreSQL

I'm running a Django app that uses PostgreSQL. The server is running RHEL 6.5 with SELinux. I'm having an issue where the Django app can't connect to the DB, and I think it's because SELinux is ...
0
votes
0answers
51 views

selinux-policy update prevents ssh into ec2. Now what?

I created a new EC2 instance using the official CentOS 7 (x86_64) HVM image. I ran: yum upgrade At: Running transaction Warning: RPMDB altered outside of yum. Updating : 32:bind-license-9.9....
1
vote
1answer
109 views

selinux, file not matching file_contexts.local

semanage fcontext -a -t puppet_etc_t "/etc/puppet/environments(/.*)?" cat /etc/selinux/targeted/contexts/files/file_contexts.local # This file is auto-generated by libsemanage # Do not edit directly....
1
vote
1answer
172 views

selinux settings for script run by apache to pull git repo

I have a web server running apache under CentOS which as selinux enabled. I have a separate server which has gitlab running. I'm trying to create a workflow using gitlab's web hooks so that when code ...
2
votes
1answer
980 views

SELinux: no audit errors but nginx permission errors

I try to isolate a SELinux problem with nging/munin. I see that error message in "/var/log/nging/error.log": [crit] 8802#0: *55 connect() to unix:/var/run/munin/fcgi-html.sock failed (13: ...
2
votes
3answers
1k views

selinux Missing type enforcement (TE) allow rule

When I run my FTP test to test for full functionality, I'm concerned on why am I getting an avc denial error on such a popular command, such as 'mkdir'? Here is the AVC denial message: type=AVC msg=...
3
votes
1answer
962 views

SELinux remove or leave the old SSH port label?

I am following this (basic) security guide to change my Server's SSH port to something else. It says: $ semanage port -a -t ssh_port_t -p tcp 2345 #Change me ...which would add a new label on top ...
3
votes
6answers
16k views

How to disable SELinux for Apache httpd only on my Fedora 14?

By following this link I am able to just turn SELinux off completely from my Fedora 14. But I wonder how could I disable SELinux only for the httpd daemon? I don't have system-config-selinux installed ...