Questions tagged [selinux]

NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

Filter by
Sorted by
Tagged with
0 votes
1 answer
2k views

How to fix SElinux contexts and labels after restoring from backup

I have a server running Centos7/XFS with SElinux that had a problem (unrelated to SElinux) and had to be restored from a snapshot that was several weeks old. This server also makes a nightly rsync ...
Peleion's user avatar
  • 303
0 votes
1 answer
2k views

Rsyslog / CentOS 8 / no write logs|no catch?

I use rsyslog (8.37.0-13) on CentOS 8 (CentOS Linux release 8.1.1911) and I've type error with my configuration. My rsyslog.conf is : module(load="imuxsock") module(load="imjournal") module(load="...
celine's user avatar
  • 13
0 votes
2 answers
558 views

Determine if Linux account locked when SELinux protects shadow

I am trying to run a script which gets the username of every locked account on a Linux system. The server is a Gentoo Hardened Server with SELinux. I tried by writing some Python which looks in /...
John Tate's user avatar
  • 179
1 vote
2 answers
5k views

Permission denied: AH02478: failed to create proxy mutex

Running a local centos 7 apache webserver, recently it stopped working. Journalctl don't say anything other then service failed. Only the error_log in /var/log/httpd/ says: [core:notice] [pid 5026:...
Tim's user avatar
  • 43
1 vote
0 answers
80 views

SELinux prevents Apache from scheduling at job

I have an application that submits tasks to cloud services that create certain time-sensitive assets. The services take an unknown amount of time to process, and in addition the assets may be ...
EK0's user avatar
  • 235
0 votes
0 answers
4k views

rsync postgres backup to another directory

I have CentOS 7 (3.10.0-1062.18.1.el7.x86_64) with SELinux enabled. PostgreSQL 12 installed (not sure if it is related). I try to backup database and move backup files to another disk. How I create ...
adontz's user avatar
  • 347
1 vote
1 answer
782 views

How can one identify what changes the SELinux file context of a file?

I'm noticing some files within a web directory with changed file contexts that deviates from system policy. There are developers that run git pull against at a higher part of the web directory and I'm ...
TopherIsSwell's user avatar
4 votes
1 answer
3k views

semodule_package command not found

Hello im trying to install MongoDB on CentOS7. It says there to configure SELInux, which i followed. On the third step, it says to execute the following; checkmodule -M -m -o mongodb_cgroup_memory....
lemoncodes's user avatar
8 votes
2 answers
25k views

SELinux blocking execution in systemd unit

I use Fedora 31 and tried to set up a Teamspeak server. When I look in journalctl -u teamspeak I get the following error: mar 09 22:22:46 melchior systemd[1]: Started Teamspeak server. mar 09 22:22:...
runfalk's user avatar
  • 261
2 votes
1 answer
2k views

SELinux with docker and traefik

I have a SELinux security problem on /run/docker.sock using traefik in docker. docker ps works correctly, it's only a problem with traefik needing to map volume /var/run/docker.sock Here is what I ...
pdem's user avatar
  • 141
0 votes
2 answers
608 views

Apache Webserver - Selinux, directory permission

I trying to set up apache on centos 8. The service is running. When i test with wget, I get 403 $ wget 127.0.0.1:9000 ...
The Fool's user avatar
  • 117
0 votes
1 answer
1k views

Allow apache service to execute command on another user with sudo. Set correctly SELinux

I want allow PHP script to execute external command with another user with exec. For this, I call my command like : exec('sudo -u username /usr/bin/command -a arg1 --arg2 arg2'); In sudoers rules, I ...
Isopote42's user avatar
  • 157
1 vote
1 answer
289 views

Allow rsync to write to httpd_user_content_t

We have rsyncd running as a daemon on our frontend web servers. We push web app updates out via rsync. We're looking at cutting down the noise in auditd and fixing up some of the issues from SELinux (...
Noodles's user avatar
  • 1,396
0 votes
1 answer
3k views

SELinux logrotate issue

It seems the topic is quite popular... So I figured I have issues with my logrotate not being able to rotate tomcat logs. Logrotate configuration is set in /etc/logrotate.d/tomcat as /opt/tomcat/...
Philipp Grigoryev's user avatar
4 votes
2 answers
9k views

Why is SELinux blocking my Zabbix agent's sudo calls?

I have some Zabbix checks that require sudo. These are the contents of /etc/sudoers.d/zabbix zabbix ALL=(ALL) NOPASSWD: /bin/yum history zabbix ALL=(ALL) NOPASSWD: /bin/needs-restarting zabbix ...
Rens Verhage's user avatar
1 vote
1 answer
897 views

SELinux, Nginx and fcgiWrap: how to allow access to fcgiWrap socket?

I am under Fedora 31 (linux kernel 5.4.13, Nginx 1.16.1, fcgiwrap 1.1.0) running with SELinux in enforcing mode (policy: targeted 3.14.4-44.fc31). My box hosts a server driven by Nginx. Part of it ...
ajlittoz's user avatar
  • 111
0 votes
1 answer
199 views

Apache vhost privilege separation using mod_selinux

I have 2 sites/apps on a server; a proprietary app, and Nextcloud. Nextcloud will be using the files_external storage plugin which allows for local mounts, but I do NOT want it to be able to browse ...
oucil's user avatar
  • 598
0 votes
2 answers
2k views

RHEL SELinux: /etc/sysconfig/selinux or /etc/selinux/config?

I am running CentOS Linux release 7.5.1804 (Core), and bumped into the usual set SELinux to Permissive task. But then my two sources gave me two different locations where the config should be set: /...
Lefty G Balogh's user avatar
2 votes
1 answer
594 views

Apache vhost privilege separation using SELinux contexts on CentOS8

I've got a server that will have several applications on it, one of which is proprietary code, and another with the ability to examine files on the server due to the nature of our needs. This will ...
oucil's user avatar
  • 598
0 votes
2 answers
504 views

SELinux port type to reserve port for user PHP in-built webserver

I am trying to get an application running which uses the PHP inbuilt webserver. It gives permission denied because of SELinux running on the system. There is no policy for the PHP inbuilt webserver as ...
Kaizu's user avatar
  • 15
0 votes
1 answer
11k views

Selinux is preventing to start Tomcat

I have a problem when I launch tomcat on RHEL 8: [root@TEST ~]# systemctl restart tomcat.service Job for tomcat.service failed because the control process exited with error code. See "systemctl ...
Oskar's user avatar
  • 1
0 votes
2 answers
808 views

Linux blocking port-forwarded connection to SSH service

I'm trying to connect to my computer's SSH service from outside my network (Internet). The router is a Sagemcom 5655. In the router I configured port-forwarding as I did many times before in my life, ...
Eduardo G.R.'s user avatar
0 votes
1 answer
677 views

Unable to start docker container with systemd when SELinux is in enforcing state

When I start the Docker container which has systemd in it, with SELinux in enforcing state, I get an error message "No such file or directory" and the container does not start. Audit logs ...
champion's user avatar
  • 101
0 votes
1 answer
4k views

Opening ports in SELinux: How to give a daemon permission to listen on predefined port type?

This is a fairly generic SELinux question, but with a specific example. I'm still fairly new to SELinux, so am regularly fighting with it! I'd like to know if I can set up a daemon (in this case ...
Alex Leach's user avatar
  • 1,737
0 votes
0 answers
44 views

Replicate SELinux issue on CentOS VM

I have a CentOS 7.6 virtual machine on my workplace's network that I have access to via SSH, and only SSH. I recently tried to install OKD on it and ran into a problem through which, after setting ...
Javier Riera Chirivella's user avatar
0 votes
1 answer
367 views

Access through SSH to a SELinux enabled machine

first question here! I have a CentOS 7 virtual machine using SELinux in my job's local network in which I want to install OKD. The issue is that OKD requires SELinux to be enabled, and enabling it ...
Javier Riera Chirivella's user avatar
0 votes
1 answer
2k views

Why does Nginx not have permissions to open this file?

I started using Nginx today for the first time, and I'm also new to command line so please be gentle. I have a CentOS 7 server that hosts an index.html file that I would like to access from the ...
BeetleJuice's user avatar
0 votes
1 answer
384 views

selinux and ntp , dose selinux heve negative impact on ntp

we have redhat linux servers in spite chrony.conf is set correctly with the right ntp servers we see very strange behavior that time is still sync to ntp server but change from some reason we ...
shalom's user avatar
  • 501
0 votes
2 answers
252 views

Setting SElinux Labels for a magento site on Centos 7

I was hoping someone could kindly help myself. I have a Magento site running on a Centos 7.6 server. Now, the site is not correctly loading and looking in the messages.log I see numerous entries ...
Vaishal Patel's user avatar
2 votes
3 answers
2k views

SELinux won't let me run sshd under port 443

I'm running Redhat 7.7. I am trying to let the ssh-service accept connections on both Port 22 and Port 443. I have allready opened the firewalld with sudo firewall-cmd --add-port=443/tcp --permanent ...
MadMike's user avatar
  • 163
1 vote
1 answer
3k views

selinux blocks unconfined service from loading kernel module

I have a daemon running as unconfined_service_t SELinux type, on Redhat Enterprise Linux 8: # ps -eZ | grep savd system_u:system_r:unconfined_service_t:s0 693 ? 00:00:00 savd It is trying to load a ...
Douglas Leeder's user avatar
4 votes
1 answer
733 views

Are custom SELinux policy modules portable?

If I take a policy created, say, using audit2allow -M and install it on multiple servers, will it work as expected or is there something special happening when the policies are created? Ideally I'd ...
Mark C's user avatar
  • 187
0 votes
2 answers
163 views

CSRF warning on centOS where there shouldn't be [closed]

i am working on my own ERP in laravel with a seperate Vue.js Front. I was for a while working on a windows server with apache and it was working fine. The setup was a bit tricky in the beginning as i ...
The Architect's user avatar
2 votes
2 answers
2k views

Does SElinux in enforcing mode cause delays in file access?

I have enabled SElinux in enforcing mode on Amazon Linux and see that the time taken for file access (read/write/update) has increased by an average of 2-4 seconds. The source process is Salt and the ...
sce's user avatar
  • 123
0 votes
1 answer
336 views

semanage fcontext is not overwriting default policies

I'm trying to make some custom policy on selinux file context, but the default is not changing. Here is my commands: semanage fcontext -a -t httpd_sys_content_t "/home/(.*)?" semanage fcontext -a -t ...
Tchelo's user avatar
  • 11
0 votes
1 answer
771 views

How do I need to configure selinux in order to have 'setenforce 1' and still be able to run my webservices?

my problem is as follows: I installed gitlab on a cloudserver of mine running CentOS7, and I configured it to use apache2/httpd instead of nginx as webserver. For doing so I followed this answer on ...
Daniel's user avatar
  • 105
1 vote
1 answer
4k views

Destination unreachable (Host administratively prohibited) when allowed through FirewallD and SELinux

I am trying to connect to my VM which is running Oracle Database XE 18c on Oracle Linux 7.6 and using bridged networking through Oracle SQL developer, however I have found no luck. I have permanently ...
Brandon's user avatar
  • 111
0 votes
1 answer
485 views

SELinux is set to permissive but it's disabled, how to enable it?

I want to enable SELinux on my VPS but I can't do it. /etc/selinux/config : # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - ...
qux's user avatar
  • 11
0 votes
1 answer
375 views

Apache2 cannot open socket as a service

Platform: CentOS Linux release 7.5.1804 I have a freshly installed apache2 and I need to have it listening on a non-default port to fit the host's firewall policy. I change the httpd.conf to have ...
djna's user avatar
  • 325
0 votes
0 answers
211 views

Dhcpd won't start due to selinux

have searched tirelessly and can't find an answer to this thats not confusing. I have a clean install of centos 6.2 32bit on a machine I use as a router. with selinux enabled dhcpd refuses to start ...
Jacqueline Loriault's user avatar
1 vote
1 answer
248 views

SELinux: AIDE Trying to Access SSSD Socket

I'm getting SELinux denials indicating that /usr/sbin/aide is trying to access a socket used by SSSD: the socket path is /var/lib/sss/pipes/nss. Here is the relevant text from sealert: Additional ...
Nester's user avatar
  • 31
3 votes
3 answers
2k views

Selinux 'var_t' base type warning

I am currently 'lost' in the CentOS Selinux forest. My setup involves setting up a WSGI socket in /var/www/demo/out which nginx uses to communicate with the UWSGI process. Whenever I request the page ...
ExcellentAverage's user avatar
1 vote
1 answer
2k views

nginx reverse proxy for docker swarm - 502 bad gateway

I am running a docker swarm on "swarm.example.com". On the server, there's a container running that can be accessed on "swarm.example.com:3000". On server "example.com" I'm running an nginx reverse ...
Branislav B.'s user avatar
4 votes
1 answer
4k views

Where can I find details on selinux Booleans

I'm running an openvpn server and I want to use SELinux. When it's activated I see a few "denied" events in the logs. I've used audit2allow to create a '.te' file. My question is about these lines ...
D.Fitz's user avatar
  • 170
4 votes
2 answers
1k views

semanage not changing file context

On my centos 7 machine, I have the following information: [wmsodbc]> pwd /WMSData1/tomcat/latest [wmsodbc]> ls -lrt /WMSData1/tomcat/latest lrwxrwxrwx. 1 tomcat tomcat 37 May 2 19:26 /WMSData1/...
Tony B's user avatar
  • 264
2 votes
0 answers
1k views

ERROR: Couldn't connect to Docker daemon at http+docker://localhost - is it running?

My environment: # cat /etc/redhat-release Red Hat Enterprise Linux Server release 7.6 (Maipo) # uname -a Linux X.Y.Z 3.10.0-957.12.1.el7.x86_64 #1 SMP Wed Mar 20 11:34:37 UTC 2019 x86_64 x86_64 ...
alexus's user avatar
  • 13.4k
1 vote
1 answer
417 views

SELinux Regression Test Failing

I have cloned the selinux-testsuite regression tests from: https://github.com/SELinuxProject/selinux-testsuite I am running the tests in a CentOS Linux release 7.6.1810 (Core) VM. Which I don't ...
nolandda's user avatar
  • 193
0 votes
0 answers
13 views

MariaDB fail to start (NO_NEW_PRIVILEGES) [duplicate]

I have a similar problem that here : Why won't MariaDB start after upgrade (NO_NEW_PRIVILEGES) But I can't upgrade the kernel (this is a vps). Does someone have an idea ?
user2267379's user avatar
3 votes
2 answers
2k views

Getting compiled Python mod_wsgi module working on Apache server with SElinux enforcing mode

Trying to get my Python/Django app working on a RedHat Server in an ideal setting. Could not use the mod_wsgi from the package as it has some dependency issue when checking for modules in my virtual ...
Evolutionary's user avatar
1 vote
0 answers
1k views

nginx + uwsgi + django 502 bad gateway on aws ec2

I have successfully installed nginx and uwsgi on aws ec2 instance. But on hitting the public IP its showing "502 bad gateway". Though both nginx and uwsgi server status is running and active. The ...
Jatin Goyal's user avatar

1 2
3
4 5
14