NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

1
vote
1answer
2k views

sftp gives permission denied only when chrooted?

I have configured sshd_conf on my centos box as below: Match group pilots ChrootDirectory /home/pilots ForceCommand internal-sftp X11Forwarding no AllowTcpForwarding no and the directory ...
1
vote
1answer
97 views

Do linux security modules (LSM) run on virtual server (vServer)? [closed]

I have a vServer for 10 EUR/month from 1und1 and I know that it is not a dedicated machine (meaning I have less control). I know that I can use some the system as root, yet the kernel is untouchable. ...
1
vote
1answer
197 views

SELinux policy issue

As qemu & KVM are working fine with SELinux out of the box I'd like to enable SELinux to improve guest isolation on my CentOS 6 server. The problem is that I'm using a 3rd parity virtualization ...
2
votes
3answers
845 views

How to configure SELinux to allow specific services to communicate with Avahi?

I have a service, running on a Fedora 20 machine, that when started attempts to register services with Avahi. This works perfectly if my service is started while SELinux is in permissive mode, but the ...
2
votes
4answers
2k views

Using SELinux to force Linux to allow programs to bind to port numbers lower than 1024

Is there a way in SELinux to force linux to allow a program to be able to bind to a port number lower than 1024.
3
votes
2answers
75 views

Lost password on EC2 SELinux instance

As the title says, I have an SELinux instance on EC2 that I haven't used for a while. I have been unable to access it via ssh since firing it back up. I have accessed it from this machine in the ...
0
votes
1answer
795 views

Unable to start the Phusion Passenger - Cannot change the directory - Operation not permitted (errno=1)

I'm running Red Hat Enterprise Linux Server release 6.4 (Santiago) on Amazon EC2. I have installed Phusion Passenger via a gem. When I start httpd I have this error message in less ...
1
vote
1answer
512 views

Why can't I shutdown running kvm instance?

I have running kvm instance: =# virsh list --all Id Name State ---------------------------------------------------- 2 debian-test running When ...
2
votes
1answer
556 views

RHEL SELinux context differs between matchpathcon and restorecon

I am using RHEL 6.3 and I experiment a strange behavior with matchpathcon and restorecon SELinux commands. For a specific file, I have defined a context with semanage fcontext. Then, matchpathcon ...
3
votes
2answers
1k views

Write once, read many (WORM) using Linux file system

I have a requirement to write files to a Linux file system that can not be subsequently overwritten, appended to, updated in any way, or deleted. Not by a sudo-er, root, or anybody. I am attempting to ...
4
votes
2answers
1k views

Unable to start Mysql with SELinux

I am attempting to start MySQL with SELinux on CentOS 6 however I am getting the following error. 131212 09:08:08 mysqld_safe mysqld from pid file /var/run/mysqld/mysqld.pid ended 131212 09:08:58 ...
1
vote
2answers
1k views

SELinux: denied { execute } for pid=2174 comm=“httpd” path=“/etc/httpd/lib/libaprutil-1.so.0.5.3”

I have problem with SELinux. setroubleshoot suggested to enable mypol.pp with semodule -i mypol.pp so apache could run. after I run the suggested command, I'm keep getting: type=AVC ...
5
votes
6answers
6k views

how do I allow mysql connections through selinux

I'd like to for once leave selinux running on a server for the alleged increased security. I usually disable selinux to get anything to work. How do I tell selinux to allow mysql connections? The most ...
1
vote
1answer
870 views

Configure SElinux to allow rsync from a remote machine

I've set up a Debian machine with SElinux and except rsync from a remote machine everything works fine. I already created some module with additional rights using audit2allow, and now all errors in ...
2
votes
2answers
583 views

MySQL 5.6 and SELinux are arguing

CentOS 6.4(x64) / MySQL 5.6.10 Installed MySQL from source files and started it fine under it's original location (/var/lib/mysql). I moved everything to a different volume (/u0/mysql) and went ...
3
votes
1answer
1k views

Postfix won't run while selinux in enforcing mode

I enabled selinux forcing mode on Fedora 15 , and I was able to get apache, mysql and memcached to work fine , but I couldn't get postfix to run . I got the following errors : systemd[1]: Unit ...
8
votes
3answers
5k views

CentOS 6 kickstart ignoring 'selinux --disabled'

I've been fighting with this one for a bit and it seems that there has been a regression in CentOS 6 as far as anaconda ignoring the selinux --disabled directive. This appears to have first appeared ...
0
votes
0answers
262 views

Hidden 'neverallow' in selinux policy?

I intend to use 'enforce' selinux mode. First, i boot in permissive mode ( enforcing=0 in kernel cmdline ). After login in system, i collect all selinux policy violation from auditd logs and try to ...
2
votes
2answers
178 views

How to limit access to the private ssh key using SELinux policies?

I'm using Fedora distro - with its preinstalled SELinux policies. I want to limit unsecured access to my private keys in ~/.ssh folder - to prevent leaking by possible malware, that may run under my ...
1
vote
3answers
4k views

CentOS 6: PHP can not load gdchart.so and oci8.so compiled by me

I have been trying to add 2 PHP extensions to a freshly installed CentOS 6.0 Linux server, but get the error messages in /var/log/httpd/error_log: [notice] SELinux policy enabled; httpd running as ...
2
votes
2answers
2k views

SELinux contexts with NFS shares

I'm trying to set up an NFS share between 2 CentOS servers (filesrv & websrv) for a folder that needs to be readable & writeable by the Apache process. I'm having trouble with the writeable ...
2
votes
2answers
2k views

Incrond running but not executing commands CentOS 6.4

I have copied this question over here from StackOverflow... I have installed incron from the EPEL repository (0.5.9) (before you ask; YES, I also tried downloading the source and compiling locally ...
1
vote
1answer
467 views

SElinux process killed while trying to set boolean

I've got a strange problem. I can not allow apache to connect to database at my CentOC 6.4 box: [root@centos6 ~]# setsebool -P httpd_can_network_connect on Killed [root@centos6 ~]# sestatus -b | grep ...
3
votes
1answer
266 views

Can't make SELinux context types permanent with semanage

I created a new folder at /modevasive to hold my mod_evasive scripts and for the Log Directory. I'm trying to change the context type to httpd_sys_content_t so Apache can write to the folder. I did ...
2
votes
3answers
410 views

Zabbix Trigger for SELinux (type=AVC) Errors

I would like to create a trigger in Zabbix to alert me anytime a type=AVC error appears in a CentOS 6 server's /var/log/audit/audit.log file. I've already tried creating a basic log scrape. E.g.: ...
4
votes
1answer
1k views

Granting sudo access to a SELinux confined user in freeIPA

I'm using freeIPA to define RBAC, HBAC and sudo rules, as well as SELinux user mappings for a domain of a couple hundred virtual machines, where I need to grant different levels of access to several ...
0
votes
1answer
119 views

google sitemap generator installation selinux

when i trying to install google sitemap generator i received this error Change security context of to system_u:object_r:httpd_modules_t install: WARNING: ignoring --context (-Z); this kernel is not ...
1
vote
1answer
118 views

If matchpathcon checks the SELinux context of a directory, what is the converse check for the service?

A page from Fedora docs describes a SELinux context problem with the example: "...instead of using /var/www/html/ for a website, an administrator wants to use /srv/myweb/. ... [However] SELinux ...
1
vote
2answers
896 views

Apache will not stop/start gracefully

CentOs 6 64bit running apache 2.2.15-29.el6.centos. When I try to stop/start or restart httpd I get an error that says it has failed. A tail of the error log is below. I also noticed that a ...
2
votes
1answer
241 views

How to make Puppet fix SELinux types for home directories?

We are using pam_mkhomedir.so to automatically create the home directories of users logging in with SSH. There is a bug in pam_mkhomedir that sets the SELinux contexts to home_root_t instead of ...
2
votes
1answer
1k views

Configure selinux to allow openldap on CentOS 6.4

I'm trying to run an OpenLDAP server on CentOS 6.4 with selinux enabled, but slapd is dieing as soon as it's started via /etc/init.d/slapd start. (init script reports OK; everything works fine after ...
2
votes
1answer
308 views

sudo: PAM audit_log_acct_message() failed: Permission denied

.. any time I'm run sudo through NRPE, I'm get a following message in my /var/log/secure, and I can't figure out how to resolve it. sudo: PAM audit_log_acct_message() failed: Permission denied ...
0
votes
2answers
623 views

RHEL6: Selinux not logging AVC denial messages

I'm trying to configure a set of lockdown rules. My approach is to start with a restricted user, and use audit2allow messages to selective add permissions. My problem is that I don't see the expected ...
4
votes
3answers
1k views

SELinux - canonical way of automatically applying a context on file creation

My current understanding is that you have to manually use restorecon to apply the desired context to a newly created file or directory unless you are happy with the context that it inherits from its ...
4
votes
1answer
179 views

SELinux: How to show all allowed rules for a type?

For an arbitrary object type, e.g. user_tmp_t, I want to know which processes are allowed to access this tag. How do I find all allow rules that reference user_tmp_t?
0
votes
2answers
3k views

Selinux in permissive mode, ssh key based auth and locked account

I noticed something weird regarding ssh key based login and selinux in permissive mode. Let me introduce you the setup: The server is an updated Centos 6.4 x86_64. We create user without a password ...
0
votes
2answers
2k views

Can't change mysql data folder CentOS 6

I've a server with CentOS 6.3 and Mysql installed on. I've created two partition, one for system and the bigger one for data mounted in /data Right after installed Mysql I've created the dir ...
0
votes
1answer
7k views

SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0

I kept getting the following notice in apache log when I start apache http server 2.2: SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0 even though I disabled ...
2
votes
1answer
892 views

Creating a public_html for a user on a Red Hat Linux Server

I'm just trying to make a public_html folder under my username on a Red Hat Linux Server (and it's all been a bit of a headache). I made the folder and set the permissions to 755. I wasn't sure how ...
0
votes
1answer
580 views

Errors whilst installing kolab

i'm struggling for the past 2 days please help me anyone... [root@mail /]# setup-kolab Please supply a password for the LDAP administrator user 'admin', used to login to the graphical console of 389 ...
3
votes
2answers
91 views

Relocated /var - now selinux is unhappy

I needed more space in the /var tree on a VM so I allocated some, booted in to runlevel 1 and copied over the folder to the new space. After changing the fstab entry for /var to reflect the new ...
0
votes
3answers
658 views

Apache Documentroot access forbidden

Running Arch Linux I am trying to get apache to use /www (not /var/www) as DocumentRoot. /www is a softlink to /home/user/www. However, I keep getting an "Access Forbidden" error. The / and /home ...
2
votes
3answers
2k views

(13) Permission denied on Apache CGI attempt

I have recently upgraded my Apache2 server, and am now unable to run a CGI app. My logs are showing (13) Permission denied unable to connect to cgi deamon after multiple tries I understand that the ...
2
votes
2answers
4k views

SELinux preventing passwordless SSH login

I would like to connect a user account I have created for git in /var/git using authorized_keys. However, SELinux prevents this with the following AVC message SELinux is preventing sshd(sshd_t) ...
4
votes
1answer
952 views

RHEL6: Tomcat runs as unconfined Java user

I'm starting to configure RHEL6 to be a hardened Tomcat server and applying SELinux policies for access control. After installing RHEL6 and Tomcat6 (standalone, no httpd), I noticed that the Tomcat ...
1
vote
1answer
39 views

Assign selinux context to the application without changing context of binary

Is there a way to assign custom SELinux context to the application despite the context that is assigned to it's binary?
0
votes
3answers
108 views

proftpd is accessing my.cnf

I use proftpd for virtual FTP hosting with MySQL. I've started writing fine-grained SELinux policies and found that it's trying to access my.cnf files. Question is what for and why? type=AVC ...
1
vote
2answers
912 views

How do I Exempt MySQL from SELinux targeted list?

I am running CentOS 5.5 and attempting to place MySQL on a non-standard port...which SELinux complains about. MySQL starts perfectly fine on with SELinux off and refuses to start with it on. SELinux ...
2
votes
1answer
441 views

SELinux: How to add a new security context?

I'm new to SELinux and am trying to add a new security context (label) to test denial. To do this, I try changing a filew to a new context: chcon -t new_t test But it fails with "Invalid argument". ...
2
votes
1answer
270 views

Gitolite3 over http selinux permissions

I'm trying to install gitolite3 on Centos6.4. It works, I can ssh and, after some trouble, I can also read, such as clone, through http and httpd. I am re-enabling selinux into permissive mode, that I ...