NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

1
vote
2answers
506 views

nginx suddenly redirecting everything to 403 page, can this be debugged or traced?

I'm not sure what happened to my nginx install. Suddenly all page requests are being redirected to the 403 page. Yesterday I tried to add a user agent to block, restarted service from that point ...
1
vote
2answers
2k views

OpenVPN SELinux Permission Denied

I am running CentOS 6.4. # cat /etc/centos-release CentOS release 6.4 (Final) After some updates, and a reboot, OpenVPN fails to start. # service openvpn start Starting openvpn: ...
3
votes
2answers
2k views

RHEL SELinux blocking Apache access to PostgreSQL

I'm running a Django app that uses PostgreSQL. The server is running RHEL 6.5 with SELinux. I'm having an issue where the Django app can't connect to the DB, and I think it's because SELinux is ...
0
votes
0answers
44 views

selinux-policy update prevents ssh into ec2. Now what?

I created a new EC2 instance using the official CentOS 7 (x86_64) HVM image. I ran: yum upgrade At: Running transaction Warning: RPMDB altered outside of yum. Updating : ...
1
vote
1answer
83 views

selinux, file not matching file_contexts.local

semanage fcontext -a -t puppet_etc_t "/etc/puppet/environments(/.*)?" cat /etc/selinux/targeted/contexts/files/file_contexts.local # This file is auto-generated by libsemanage # Do not edit ...
1
vote
1answer
133 views

selinux settings for script run by apache to pull git repo

I have a web server running apache under CentOS which as selinux enabled. I have a separate server which has gitlab running. I'm trying to create a workflow using gitlab's web hooks so that when code ...
2
votes
1answer
893 views

SELinux: no audit errors but nginx permission errors

I try to isolate a SELinux problem with nging/munin. I see that error message in "/var/log/nging/error.log": [crit] 8802#0: *55 connect() to unix:/var/run/munin/fcgi-html.sock failed (13: ...
2
votes
1answer
1k views

New Dovecot install not allowing login, giving permissions error despite saying that permissions “appear ok”

I'm installing dovecot onto a Virtualbox VM running Ubuntu Server 64-bit 14.04 guest. Dovecot itself is being installed into a Docker container (I'm not sure that that's relevant here, but am noting ...
2
votes
3answers
884 views

selinux Missing type enforcement (TE) allow rule

When I run my FTP test to test for full functionality, I'm concerned on why am I getting an avc denial error on such a popular command, such as 'mkdir'? Here is the AVC denial message: type=AVC ...
3
votes
1answer
636 views

SELinux remove or leave the old SSH port label?

I am following this (basic) security guide to change my Server's SSH port to something else. It says: $ semanage port -a -t ssh_port_t -p tcp 2345 #Change me ...which would add a new label on top ...
3
votes
6answers
15k views

How to disable SELinux for Apache httpd only on my Fedora 14?

By following this link I am able to just turn SELinux off completely from my Fedora 14. But I wonder how could I disable SELinux only for the httpd daemon? I don't have system-config-selinux installed ...
1
vote
2answers
827 views

How can I move /var/log/audit/audit.log to another partition

Fresh centos 6.5 with updates installed. We want to log auditd to a non persistent volume since we capture everything with splunk or logstash. The destination dir is /mnt/ephemeral/audit/ # ls -l ...
3
votes
1answer
243 views

SE Linux - can't change SELinux booleans with sudo

I think this is the correct place to put this, rather than in StackOverflow Either way, we have a CentOS 6.6 server. SElinux isn't allowing us to enable httpd_can_sendmail I've tried this.... sudo ...
0
votes
1answer
135 views

httpd trying to access root-owned session files

While looking into what's been causing a server to lock up/crash, I found many selinux messages in /var/log/messages. For example: setroubleshoot: SELinux is preventing /usr/sbin/httpd from getattr ...
0
votes
1answer
614 views

Centos 7 with SElinux: openvpn and DNS

I'm trying to use openvpn as client on centos 7. It works fine, but i cannot get DNS from server. As you know, there is no resolvconf in new Centos, so, standard update-resolv-conf script doesn't ...
1
vote
2answers
1k views

Centos: rsyslog blocks sshd and also local login if selinux is active

I have a very curious problem on an centos 6.5(now 6.6) machine. After an update between june 11th and october 21th the trouble begins (packages: http://pastebin.com/gXvaycLL). After a restart in ...
1
vote
1answer
632 views

Apache passphrase working sometimes

On one of my servers I observe the following problem with SSL passphrase: some certs are passing it without asking for a password, while some others keep asking for it. I have set it up globally: ...
7
votes
1answer
3k views

How to run PhantomJS on CentOS with SELinux?

I'm trying to make a screenshot using PhantomJS on my CentOS 5 machine, but I can't get it to work together with SELinux. It works on an identical machine with SELinux disabled, so I really suspect ...
9
votes
3answers
1k views

Real life SELinux security example?

Can anyone give a real life example of where SELinux saved their security bacon? (or AppArmour if you wish). If not your own, a pointer to someone with a credible experience? Not a lab test, not a ...
0
votes
2answers
1k views

SELinux interfering with Apache / PHP [duplicate]

On my installation of CentOS 7, SELinux is enabled by default. This is preventing Apache from properly reading PHP files in the standard /var/www/html document root (the browser is blank when ...
2
votes
2answers
4k views

SElinux: How to change to permissive mode without a reboot?

I need to change selinux to "permissive mode" on a production server without a reboot, but setenforce wont let me do it(as a root), it always prints "setenforce: SELinux is disabled" What i'm doing ...
1
vote
0answers
114 views

Possible to prevent access to /tmp for a specific user via SELinux?

I'm sort of learning the edges of SELinux and I'm wondering if it's possible to prevent a specific user from accessing /tmp. Clearly it's a bad idea to dork all permissions, so I'm hoping that ...
1
vote
1answer
6k views

Centos 7 and OpenVPN: how make them friends?

I'm trying to install OpenVPN server on Centos 7 and faced with next problem: [root@msk ~]# /etc/init.d/openvpn start Starting openvpn (via systemctl): [ OK ] [root@msk ~]# ...
0
votes
1answer
444 views

Varnish 4 service won't start because of selinux

I've installed varnish 4 on my new centos 6.5 box. I've activated EPEL repo to install varnish from http://repo.varnish-cache.org/redhat/varnish-4.0/ After installing and configuring my default.vcl I ...
0
votes
1answer
805 views

Apache can't connect to remote MySQL, but mysql command line from same server can

Symptoms: I am running CentOS 6. I can connect to the remote MySQL from the command line: mysql -h a.b.c.d -u user -p -D db. Laravel artisan commands run on the local command line can also connect: ...
0
votes
1answer
244 views

Configuration for Ubuntu SELinux with sshd

I am trying to set-up SELinux in an Ubuntu Trusty server, who is an Amazon EC2 instance. I followed the Debian documentation about installing SELinux. The installation work well as seen by : ...
1
vote
2answers
748 views

Selinux: Managing ports; Semanage command not found

I'm having trouble configuring SELinux to allow sending mail. Reading the SELinux documentation I've found I can manage ports via the semanage command, but the command can't be found. Is there ...
2
votes
1answer
2k views

SELinux permissions for LogRotate and Apache

With the directory structure: /www/live/website1/app/ /www/live/website1/files/ /www/live/website1/logs/ Where Apache needs at least the following access: app: read-only access, but read-write is ...
1
vote
1answer
2k views

svn: Can't open file '/var/www/svn/repo/db/txn-current-lock': Permission denied

On Fedora os, I have problem to access SVN Repo and commit via HTTP. Here is my config file /etc/httpd/conf.d/subversion.conf LoadModule dav_svn_module modules/mod_dav_svn.so LoadModule ...
0
votes
1answer
419 views

Audit says nothing to do, yet puppet won't run with SELinux enforcing

I'm determined to get my puppet master running with SELinux set to enforcing. If I make it permissive, it runs fine. I'm on RHEL 7, with systemd, apache2, passenger 4, and puppet 3. I've gone ...
0
votes
1answer
155 views

SELinux problems running Expect script from fail2ban

I have an Expect script that works fine if I run it manually, but fails when run as an action from Fail2ban. The error message is as follows: spawn /usr/bin/telnet 192.168.242.1 The system has no ...
1
vote
2answers
472 views

Redhat: How to create a new role with SELinux?

I can figure out how to map a SELinux user to an existing role, but how do I create new roles? I'm looking to create a restricted admin role for my box.
1
vote
1answer
2k views

SELinux blocking sudo from zabbix_agentd

I have a custom user parameter for Zabbix that calls a hardware RAID CLI tool (arcconf / megacli) and checks if any arrays are degraded. Since these tools are root-only, I have configured sudoers to ...
5
votes
1answer
1k views

Unable to re-enable SELinux

Up until now we have disabled SELinux as our Standard Operating Procedure -- before you tell me off, I know. That's why we're enabling it now we've got time to. Our normal procedure was to: Set ...
-2
votes
1answer
78 views

Difference between target policy 18 and 24 in SELinux

I recently started to learning SELinux and I am so new on that. So I've faced an issue and I have question, I use CentOS 6.5 and I am learning SElinux via video training. Into the video training ...
1
vote
0answers
17 views

SELinux module for a specific file rather than an entire context

I've created an SELinux module that works great for a specific context. What I would like to know is, is it possible to restrict this module to only function for specific files with that context? For ...
2
votes
3answers
1k views

Restrict user access in Linux

I am given a task to configure a RedHat Enterprise Linux 5 Gnome PC such that a specific user - say USER1 will have very limited desktop access. The requirements include: Access to all of the ...
1
vote
1answer
485 views

SELinux for RHEL not persistant after reboot

So in the Red Hat exam they want you to use SELinux. If for example you install vsftp, then do setsebool -P ftp_home_dir=1 or setsebool -P ftp_home_dir on to allow the users on the server to access ...
1
vote
1answer
1k views

How do I fix this dovecot SELinux error in audit.log on CentOS?

I'm getting these SELinux errors in /var/log/audit/audit.log for dovecot. type=USER_AUTH msg=audit(1404794536.249:100679): user pid=28375 uid=0 auid=0 ses=2700 ...
3
votes
2answers
274 views

CentOS Selinux config enforcing but unable to start

I recently discovered selinux is disabled, but config file saying selinux enforcing mode setted. I read about possibilities about why selinux is disabled. I am suspecting on kernel. But I can't find ...
2
votes
1answer
159 views

Why don't my domain transitions don't occur when the application binary is outside of the stardard binary directories?

I'm trying to set up a custom SELinux policy, but I'm having trouble getting the domain transitions to occur when the application binary is outside of the standard binary directories such as /bin, ...
2
votes
1answer
7k views

Apache doesn't start: syntax error…DocumentRoot must be a directory

I read all the previous answer but I couldn't fix my problem.. I'm changing the server where my website is hosted and I'm setting again apache.. Now, after installing php, fail2ban, etc i have that ...
1
vote
1answer
2k views

Why does Fedora 20 still deny access to home directories after enabling SELinux httpd_read_user_content and setting files to httpd_user_content_t?

On my Fedora 20, I've learned that to allow write access to files by processes like PHP via Apache, the process owner, which is in my case apache, must have write permissions to the files. Also, since ...
2
votes
1answer
1k views

How do I allow apache to rotate logs in user home directory with SELinux enabled?

Our development machine has multiple users, and their various sites are stored in /home/username/apache. In these folders are sub-folders like conf containing the virtual host config, logs containing ...
0
votes
1answer
1k views

httpd (WordPress) gets avc denied write (SELinux)

I'm getting following message in my /var/log/audit/audit.log: type=AVC msg=audit(1402615093.053:68): avc: denied { write } for pid=799 comm="httpd" name="php" dev="xvda1" ino=8667365 ...
2
votes
1answer
491 views

How to configure SELinux to allow apache to run git

I have a CentOS 6 server and I'm trying to get the apache web server to run git pull in a directory. The php file is simply: <?php shellexec('cd /var/www/vhosts/domain;git pull'); However, ...
2
votes
2answers
224 views

Is it possible to persist selinux port statements across reboots?

Currently we need to run something like this every time we start up: /usr/sbin/semanage port -a -t memcache_port_t -p tcp ${special-snowflake-port} It would be great if we could persist this across ...
5
votes
1answer
2k views

SElinux label for php-fpm sockets

I'm attempting to set up multiple instances of php-fpm to run multiple versions of php through apache 2.2 running on centos 6.5. At some point in the future this will end up in a shared hosting ...
1
vote
1answer
24 views

Disabling network access for a group of users but allowing smtp only

We have an environment where our users ssh into the system and their shell is set to simply launch Mutt on their $HOME/Maildir. We want to restrict our users to only be able to send/receive mail. We ...
1
vote
1answer
593 views

Zabbix & SNMPTT.log file access denied

I'm having a problem with a file accesed by ZAbbix to proccess all the SNMP trap data using a file /var/log/snmptt/snmptt.log. ZAbbix_proxy.log 23323:20140430:105246.532 sleeping for 5 seconds ...