Questions tagged [selinux]
NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.
691
questions
0
votes
1
answer
2k
views
How to fix SElinux contexts and labels after restoring from backup
I have a server running Centos7/XFS with SElinux that had a problem (unrelated to SElinux) and had to be restored from a snapshot that was several weeks old. This server also makes a nightly rsync ...
0
votes
1
answer
2k
views
Rsyslog / CentOS 8 / no write logs|no catch?
I use rsyslog (8.37.0-13) on CentOS 8 (CentOS Linux release 8.1.1911) and I've type error with my configuration.
My rsyslog.conf is :
module(load="imuxsock")
module(load="imjournal")
module(load="...
0
votes
2
answers
558
views
Determine if Linux account locked when SELinux protects shadow
I am trying to run a script which gets the username of every locked account on a Linux system. The server is a Gentoo Hardened Server with SELinux. I tried by writing some Python which looks in /...
1
vote
2
answers
5k
views
Permission denied: AH02478: failed to create proxy mutex
Running a local centos 7 apache webserver, recently it stopped working. Journalctl don't say anything other then service failed. Only the error_log in /var/log/httpd/ says:
[core:notice] [pid 5026:...
1
vote
0
answers
80
views
SELinux prevents Apache from scheduling at job
I have an application that submits tasks to cloud services that create certain time-sensitive assets. The services take an unknown amount of time to process, and in addition the assets may be ...
0
votes
0
answers
4k
views
rsync postgres backup to another directory
I have CentOS 7 (3.10.0-1062.18.1.el7.x86_64) with SELinux enabled.
PostgreSQL 12 installed (not sure if it is related).
I try to backup database and move backup files to another disk. How I create ...
1
vote
1
answer
782
views
How can one identify what changes the SELinux file context of a file?
I'm noticing some files within a web directory with changed file contexts that deviates from system policy. There are developers that run git pull against at a higher part of the web directory and I'm ...
4
votes
1
answer
3k
views
semodule_package command not found
Hello im trying to install MongoDB on CentOS7. It says there to configure SELInux, which i followed.
On the third step, it says to execute the following;
checkmodule -M -m -o mongodb_cgroup_memory....
8
votes
2
answers
25k
views
SELinux blocking execution in systemd unit
I use Fedora 31 and tried to set up a Teamspeak server. When I look in journalctl -u teamspeak I get the following error:
mar 09 22:22:46 melchior systemd[1]: Started Teamspeak server.
mar 09 22:22:...
2
votes
1
answer
2k
views
SELinux with docker and traefik
I have a SELinux security problem on /run/docker.sock using traefik in docker.
docker ps works correctly, it's only a problem with traefik needing to map volume /var/run/docker.sock
Here is what I ...
0
votes
2
answers
608
views
Apache Webserver - Selinux, directory permission
I trying to set up apache on centos 8. The service is running. When i test with wget, I get 403
$ wget 127.0.0.1:9000 ...
0
votes
1
answer
1k
views
Allow apache service to execute command on another user with sudo. Set correctly SELinux
I want allow PHP script to execute external command with another user with exec.
For this, I call my command like :
exec('sudo -u username /usr/bin/command -a arg1 --arg2 arg2');
In sudoers rules, I ...
1
vote
1
answer
289
views
Allow rsync to write to httpd_user_content_t
We have rsyncd running as a daemon on our frontend web servers. We push web app updates out via rsync.
We're looking at cutting down the noise in auditd and fixing up some of the issues from SELinux (...
0
votes
1
answer
3k
views
SELinux logrotate issue
It seems the topic is quite popular... So I figured I have issues with my logrotate not being able to rotate tomcat logs. Logrotate configuration is set in /etc/logrotate.d/tomcat as
/opt/tomcat/...
4
votes
2
answers
9k
views
Why is SELinux blocking my Zabbix agent's sudo calls?
I have some Zabbix checks that require sudo. These are the contents of /etc/sudoers.d/zabbix
zabbix ALL=(ALL) NOPASSWD: /bin/yum history
zabbix ALL=(ALL) NOPASSWD: /bin/needs-restarting
zabbix ...
1
vote
1
answer
897
views
SELinux, Nginx and fcgiWrap: how to allow access to fcgiWrap socket?
I am under Fedora 31 (linux kernel 5.4.13, Nginx 1.16.1, fcgiwrap 1.1.0) running with SELinux in enforcing mode (policy: targeted 3.14.4-44.fc31).
My box hosts a server driven by Nginx. Part of it ...
0
votes
1
answer
199
views
Apache vhost privilege separation using mod_selinux
I have 2 sites/apps on a server; a proprietary app, and Nextcloud. Nextcloud will be using the files_external storage plugin which allows for local mounts, but I do NOT want it to be able to browse ...
0
votes
2
answers
2k
views
RHEL SELinux: /etc/sysconfig/selinux or /etc/selinux/config?
I am running CentOS Linux release 7.5.1804 (Core), and bumped into the usual set SELinux to Permissive task. But then my two sources gave me two different locations where the config should be set:
/...
2
votes
1
answer
594
views
Apache vhost privilege separation using SELinux contexts on CentOS8
I've got a server that will have several applications on it, one of which is proprietary code, and another with the ability to examine files on the server due to the nature of our needs. This will ...
0
votes
2
answers
504
views
SELinux port type to reserve port for user PHP in-built webserver
I am trying to get an application running which uses the PHP inbuilt webserver. It gives permission denied because of SELinux running on the system. There is no policy for the PHP inbuilt webserver as ...
0
votes
1
answer
11k
views
Selinux is preventing to start Tomcat
I have a problem when I launch tomcat on RHEL 8:
[root@TEST ~]# systemctl restart tomcat.service
Job for tomcat.service failed because the control process exited with error code.
See "systemctl ...
0
votes
2
answers
808
views
Linux blocking port-forwarded connection to SSH service
I'm trying to connect to my computer's SSH service from outside my network (Internet). The router is a Sagemcom 5655. In the router I configured port-forwarding as I did many times before in my life, ...
0
votes
1
answer
677
views
Unable to start docker container with systemd when SELinux is in enforcing state
When I start the Docker container which has systemd in it, with SELinux in enforcing state, I get an error message "No such file or directory" and the container does not start.
Audit logs ...
0
votes
1
answer
4k
views
Opening ports in SELinux: How to give a daemon permission to listen on predefined port type?
This is a fairly generic SELinux question, but with a specific example. I'm still fairly new to SELinux, so am regularly fighting with it!
I'd like to know if I can set up a daemon (in this case ...
0
votes
0
answers
44
views
Replicate SELinux issue on CentOS VM
I have a CentOS 7.6 virtual machine on my workplace's network that I have access to via SSH, and only SSH. I recently tried to install OKD on it and ran into a problem through which, after setting ...
0
votes
1
answer
367
views
Access through SSH to a SELinux enabled machine
first question here!
I have a CentOS 7 virtual machine using SELinux in my job's local network in which I want to install OKD.
The issue is that OKD requires SELinux to be enabled, and enabling it ...
0
votes
1
answer
2k
views
Why does Nginx not have permissions to open this file?
I started using Nginx today for the first time, and I'm also new to command line so please be gentle.
I have a CentOS 7 server that hosts an index.html file that I would like to access from the ...
0
votes
1
answer
384
views
selinux and ntp , dose selinux heve negative impact on ntp
we have redhat linux servers
in spite chrony.conf is set correctly with the right ntp servers
we see very strange behavior that time is still sync to ntp server but change from some reason
we ...
0
votes
2
answers
252
views
Setting SElinux Labels for a magento site on Centos 7
I was hoping someone could kindly help myself. I have a Magento site running on a Centos 7.6 server.
Now, the site is not correctly loading and looking in the messages.log I see numerous entries ...
2
votes
3
answers
2k
views
SELinux won't let me run sshd under port 443
I'm running Redhat 7.7. I am trying to let the ssh-service accept connections on both Port 22 and Port 443. I have allready opened the firewalld with
sudo firewall-cmd --add-port=443/tcp --permanent
...
1
vote
1
answer
3k
views
selinux blocks unconfined service from loading kernel module
I have a daemon running as unconfined_service_t SELinux type, on Redhat Enterprise Linux 8:
# ps -eZ | grep savd
system_u:system_r:unconfined_service_t:s0 693 ? 00:00:00 savd
It is trying to load a ...
4
votes
1
answer
733
views
Are custom SELinux policy modules portable?
If I take a policy created, say, using audit2allow -M and install it on multiple servers, will it work as expected or is there something special happening when the policies are created? Ideally I'd ...
0
votes
2
answers
163
views
CSRF warning on centOS where there shouldn't be [closed]
i am working on my own ERP in laravel with a seperate Vue.js Front. I was for a while working on a windows server with apache and it was working fine. The setup was a bit tricky in the beginning as i ...
2
votes
2
answers
2k
views
Does SElinux in enforcing mode cause delays in file access?
I have enabled SElinux in enforcing mode on Amazon Linux and see that the time taken for file access (read/write/update) has increased by an average of 2-4 seconds. The source process is Salt and the ...
0
votes
1
answer
336
views
semanage fcontext is not overwriting default policies
I'm trying to make some custom policy on selinux file context, but the default is not changing. Here is my commands:
semanage fcontext -a -t httpd_sys_content_t "/home/(.*)?"
semanage fcontext -a -t ...
0
votes
1
answer
771
views
How do I need to configure selinux in order to have 'setenforce 1' and still be able to run my webservices?
my problem is as follows:
I installed gitlab on a cloudserver of mine running CentOS7, and I configured it to use apache2/httpd instead of nginx as webserver.
For doing so I followed this answer on ...
1
vote
1
answer
4k
views
Destination unreachable (Host administratively prohibited) when allowed through FirewallD and SELinux
I am trying to connect to my VM which is running Oracle Database XE 18c on Oracle Linux 7.6 and using bridged networking through Oracle SQL developer, however I have found no luck.
I have permanently ...
0
votes
1
answer
485
views
SELinux is set to permissive but it's disabled, how to enable it?
I want to enable SELinux on my VPS but I can't do it.
/etc/selinux/config :
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - ...
0
votes
1
answer
375
views
Apache2 cannot open socket as a service
Platform: CentOS Linux release 7.5.1804
I have a freshly installed apache2 and I need to have it listening on a non-default port to fit the host's firewall policy.
I change the httpd.conf to have
...
0
votes
0
answers
211
views
Dhcpd won't start due to selinux
have searched tirelessly and can't find an answer to this thats not confusing. I have a clean install of centos 6.2 32bit on a machine I use as a router. with selinux enabled dhcpd refuses to start ...
1
vote
1
answer
248
views
SELinux: AIDE Trying to Access SSSD Socket
I'm getting SELinux denials indicating that /usr/sbin/aide is trying to access a socket used by SSSD: the socket path is /var/lib/sss/pipes/nss. Here is the relevant text from sealert:
Additional ...
3
votes
3
answers
2k
views
Selinux 'var_t' base type warning
I am currently 'lost' in the CentOS Selinux forest.
My setup involves setting up a WSGI socket in /var/www/demo/out which nginx uses to communicate with the UWSGI process. Whenever I request the page ...
1
vote
1
answer
2k
views
nginx reverse proxy for docker swarm - 502 bad gateway
I am running a docker swarm on "swarm.example.com". On the server, there's a container running that can be accessed on "swarm.example.com:3000".
On server "example.com" I'm running an nginx reverse ...
4
votes
1
answer
4k
views
Where can I find details on selinux Booleans
I'm running an openvpn server and I want to use SELinux. When it's activated I see a few "denied" events in the logs. I've used audit2allow to create a '.te' file. My question is about these lines ...
4
votes
2
answers
1k
views
semanage not changing file context
On my centos 7 machine, I have the following information:
[wmsodbc]> pwd
/WMSData1/tomcat/latest
[wmsodbc]> ls -lrt /WMSData1/tomcat/latest
lrwxrwxrwx. 1 tomcat tomcat 37 May 2 19:26 /WMSData1/...
2
votes
0
answers
1k
views
ERROR: Couldn't connect to Docker daemon at http+docker://localhost - is it running?
My environment:
# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.6 (Maipo)
# uname -a
Linux X.Y.Z 3.10.0-957.12.1.el7.x86_64 #1 SMP Wed Mar 20 11:34:37 UTC 2019 x86_64 x86_64 ...
1
vote
1
answer
417
views
SELinux Regression Test Failing
I have cloned the selinux-testsuite regression tests from: https://github.com/SELinuxProject/selinux-testsuite
I am running the tests in a CentOS Linux release 7.6.1810 (Core) VM. Which I don't ...
0
votes
0
answers
13
views
MariaDB fail to start (NO_NEW_PRIVILEGES) [duplicate]
I have a similar problem that here :
Why won't MariaDB start after upgrade (NO_NEW_PRIVILEGES)
But I can't upgrade the kernel (this is a vps).
Does someone have an idea ?
3
votes
2
answers
2k
views
Getting compiled Python mod_wsgi module working on Apache server with SElinux enforcing mode
Trying to get my Python/Django app working on a RedHat Server in an ideal setting. Could not use the mod_wsgi from the package as it has some dependency issue when checking for modules in my virtual ...
1
vote
0
answers
1k
views
nginx + uwsgi + django 502 bad gateway on aws ec2
I have successfully installed nginx and uwsgi on aws ec2 instance. But on hitting the public IP its showing "502 bad gateway". Though both nginx and uwsgi server status is running and active.
The ...