NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

2
votes
0answers
206 views

Gitolite3 push and selinux access failure

I try to install gitolite3 with ssh and http. I have followed largely the official guide at gitolite3, but I am stumbling accross three remaining problems. When I $ git clone ...
2
votes
2answers
126 views

Httpd on Centos6 not listing directory contents

I have a folder (which is NOT the conventional /var/www/html folder!) /Server/Websites/Default on my Centos6.4 server. There is only one file, phpinfo.php (with the obvious code in it). Running ...
1
vote
1answer
152 views

vsftpd + vitual users + selinux

I can't make vsftpd to work and it is driving me crazy. The virtual users can connect, but they can't upload files or create folders. I hope someone can help me. I get this error in the ftp client: ...
1
vote
1answer
388 views

pure-ftpd auth blocked by SELinux

First, my setup. I'm using CentOS 6.4 and I installed pure-ftpd (plus the SELinux module) from the EPEL repositories : > rpm -q pure-ftpd pure-ftpd-selinux pure-ftpd-1.0.30-1.el6.x86_64 ...
0
votes
1answer
6k views

SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0

I kept getting the following notice in apache log when I start apache http server 2.2: SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0 even though I disabled ...
1
vote
2answers
1k views

Home directories created with wrong Selinux context

[root@tst-01 home]# ls -Z drwxr-xr-x. ujjain users system_u:object_r:home_root_t:s0 ujjain drwxr-xr-x. johndoe users system_u:object_r:home_root_t:s0 johndoe The selinux ...
1
vote
1answer
88 views

How to match selinux rules/transitions/labels/etc to modules

I need to match running/loaded selinux rules/transitions/labels/etc to the selinux policy modules where they are defined (semodules -l). I need this because I want to study some selinux policy modules ...
2
votes
1answer
779 views

Configure selinux to allow openldap on CentOS 6.4

I'm trying to run an OpenLDAP server on CentOS 6.4 with selinux enabled, but slapd is dieing as soon as it's started via /etc/init.d/slapd start. (init script reports OK; everything works fine after ...
3
votes
1answer
754 views

How can I query for all selinux rules/default file contexts/etc affecting a type

I need to know everything related to a selinux type on a running system's current rules: allow, allowaudit, dontaudit rules. files labeled with a context using the type. transitions. ...and any ...
3
votes
1answer
256 views

Selinux interfering with vboxwebsrv or phpvirtualbox

I have a brand new installation of Fedora 18, with a brand new installation of Virtualbox 4.2. I have spent a painful few hours trying to get phpVirtualBox working. Apache 2.4 and PHP 5.4 are ...
-3
votes
1answer
159 views

Changing user mail location in CentOS with SELinux Enabled

This is an practice RHCE question. I need to change the mail files from /var/spool/mail/user to /var/spool/user. Note that SELinux must remain enabled at all times. Will I need to change any folder ...
1
vote
1answer
1k views

Configure selinux to allow snmpd to read to a custom location

I have snmpd executing a script under /custom/location/myscript.sh. If I disable selinux all works well. If I enable selinux it stops working and if I do an audit2why I see the following: type=AVC ...
1
vote
1answer
121 views

SELinux Preventing Apache Start

When running in strict mode, SELinux would not let me start HTTPD since my mod_jk.so module was copied from an external server. I copied mod_jk.so externally since I couldn't find the package to ...
0
votes
1answer
504 views

Errors whilst installing kolab

i'm struggling for the past 2 days please help me anyone... [root@mail /]# setup-kolab Please supply a password for the LDAP administrator user 'admin', used to login to the graphical console of 389 ...
2
votes
2answers
2k views

setenforce: SELinux is disabled

I'm in a CentOS 5 machine, and try to install vsftpd. I want to configure ftp_home_dir using setsebool -P ftp_home_dir on but it says: setsebool: SELinux is disabled. I try to enable it using ...
0
votes
1answer
68 views

PHP Not running on specific directories [closed]

Ok. This is a pretty weird error: I made a folder named 'hello' at /etc/apache2/sites-enabled/ with hello.php. Then i created an Alias that told /hello would go to /etc/apache2/sites-enabled/hello. ...
0
votes
2answers
3k views

Selinux in permissive mode, ssh key based auth and locked account

I noticed something weird regarding ssh key based login and selinux in permissive mode. Let me introduce you the setup: The server is an updated Centos 6.4 x86_64. We create user without a password ...
-1
votes
1answer
62 views

SElinux policy to grant read access to /etc/my.cnf for httpd

How can I modify the SElinux policy to allow httpd to read /etc/my.cnf? Background: My web application connects to a mysql database. Instead of hardcoding the credentials in the code, they are stored ...
0
votes
2answers
1k views

Disable SeLinux permanently

I am running a virtualbox CentOS 6.4 (64 bit) server with Cobbler service. One of the steps is to disable SeLinux in order to prevent a python error when running service cobblers start. If I run ...
2
votes
3answers
374 views

Zabbix Trigger for SELinux (type=AVC) Errors

I would like to create a trigger in Zabbix to alert me anytime a type=AVC error appears in a CentOS 6 server's /var/log/audit/audit.log file. I've already tried creating a basic log scrape. E.g.: ...
2
votes
1answer
367 views

selinux disabled, but still enforcing?

I have some systems where, for various reasons, we want to completely disable selinux. To date, this has worked like a champ, with always using selinux=0 in the kickstarts and ensuring that ...
7
votes
1answer
604 views

How can I use SELinux to confine PHP scripts?

I want to compartmentalize different PHP applications on my SL6.4 (RHEL 6.4 rebuild) web server so that they cannot access each others' data. It seems that SELinux might be able to do this, but I am ...
0
votes
2answers
205 views

Check my Kernel for SELinux Support

I want to know if the kernel i am running has support for SELinux. What commands would i use to check this ?
2
votes
1answer
69 views

Adding to existing policy in selinux

I just created a custom policy and did the semodule -i test.te. I reran all my tests after a few days and I noticed there were additional AVC denials in the audit.log. I want to add the new stuff ...
2
votes
0answers
147 views

selinux “Possible mismatch between this policy…”

How do I go about troubleshooting the following error below: type=AVC msg=audit(1365523330.609:4846): avc: denied { append } for pid=12542 comm="FTPMan.pl" name="user_list" dev=dm-0 ino=2884237 ...
1
vote
1answer
66 views

selinux in enforcing mode

I do test driven development where all my APIs are tested with a batch of tests. Initially, I ran the tests in ‘permissive’ mode in selinux. So, I decided to enable selinux to ‘enforcing’ mode. ...
1
vote
3answers
366 views

selinux Missing type enforcement (TE) allow rule

When I run my FTP test to test for full functionality, I'm concerned on why am I getting an avc denial error on such a popular command, such as 'mkdir'? Here is the AVC denial message: type=AVC ...
2
votes
2answers
923 views

selinux avc: denied issue

I just setup a web hosting server with selinux in permissive mode, meaning it's unsecured but writing issues to the message log file. Once I have fixed all the avc: denied errors, I will put the ...
0
votes
1answer
865 views

ProFTPd and SELinux: mkdir Permission denied

I have a ProFTPd server on Centos 6.3 with SELinux Enforcing. My users are virtual users in a flat file. The users are chrooted to directories mounted via NFS. I've already set the following ...
0
votes
1answer
40 views

Download file without disabling selinux

I am developing a site in PHP on Linux Server where I need to download a file from Windows Server to Linux Machine. I can do it with Some Changes in SeLinux or setting some properties on it, i.e.: % ...
0
votes
1answer
393 views

Lighttpd fails with 403 - Forbidden with SELinux enabled

I've setup a CentOS 6.3 box with lighttpd, php-fpm and I can server both static files and PHP files with SELinux enabled if I leave the lighttpd home directory set to the default (/var/www/lighttpd). ...
0
votes
1answer
87 views

After trying to remove SELinux, system doesn't start; shows error of “unable to connect to system bus”

I had SELinux installed on my system which actually was a bit annoying. I tried to remove it. After that my system is unable to start. The error that is showing up is: unable to connect to system ...
2
votes
1answer
99 views

How to run selinux sanbdox with access to /dev/urandom

I'm trying to run my application inside an SELinux sandbox. My application needs access to /dev/urandom, and the default sandbox policy does not allow that. What is a simple method to allow my ...
0
votes
1answer
1k views

Change unconfined_u to system_u is failing [duplicate]

I've got a file on my apache/linux server. ls -Z gives: drwxr-xr-x. apache apache unconfined_u:object_r:httpd_sys_rw_content_t:s0 localization.smicloud.org I need to change unconfined_u to ...
-1
votes
1answer
32 views

if I'm only using a server to host webpages, should I be using SELINUX? [duplicate]

On my server, I have static and dynamic websites. Yes there are api links, but they aren't exactly open to the public. When is it appropriate to SELINUX? would this be an appropriate example of a good ...
0
votes
2answers
1k views

sshd[4344]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument?

OpenSSH_5.8p1, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 selinux-policy-2.4.6-338.el5 pam-0.99.6.2-12.el5 SELinux is running in permissive mode: # sestatus SELinux status: enabled ...
0
votes
1answer
831 views

Trying to get Apache and nodejs to play nice together, getting “setsebool: SELinux is disabled.”?

I am running Ubuntu, and an Apache server. I wanted to try out nodejs, and I wanted to run it through a virtualhost on Apache. I read this article and tried to follow the instructions: ...
0
votes
2answers
472 views

PHP Fatal error: date(): Timezone database is corrupt

I installed wordpress to CentOS from EPEL: yum install wordpress And it can only work if I manually disable SELinux. Otherwise I see this error: PHP Fatal error: date(): Timezone database is ...
1
vote
3answers
1k views

Selinux blocks wordpress in CentOS 6.3

I installed wordpress 3.5 to CentOS 6.3 using command: yum install wordpress and started httpd. Now I can see the following error in apache log: PHP Fatal error: require_once(): Failed opening ...
1
vote
1answer
271 views

openssh-lpk - Failed to get default SELinux security context for ldapuser

I'm trying to setup a ssh server with hardened-gentoo sources openssh (with openssh-lpk, which is the ldap flag on gentoo I think) and selinux enabled. On the Ldap-Server I have added an user ...
0
votes
3answers
364 views

restrict root access for certain files or filesystems

I want to store files for my users on encrypted filesystems. Every user would have his own filesystem with his own key. The user is able to log in to the system and mount his filesystem. When they are ...
1
vote
1answer
633 views

How to allow cron to send an email attachment?

SELinux is preventing cron from attaching a log file in the email with the following error: notice kernel [ 7148.923034] type=1400 audit(1359466501.857:5): avc: denied { read } for pid=3182 ...
0
votes
1answer
781 views

HOW do I get enforcing SElinux and postfix with custom milter to work?

I have an IPv4 setup of postfix on RHEL6 with SElinux in enforcing mode. All my attempts at incorporating opendkim fails miserably unless I leave enforcing mode. The errors I get when SElinux is ...
1
vote
1answer
287 views

Is there a way to share via SMB a filesystem mounted via NFS without disabling SElinux?

I have two CentOS hosts. The first is NAS and the second one is a diskless SMB server. The NAS server share folder via NFS and secure Ethernet connection with SMB server. SMB server shares content to ...
6
votes
3answers
18k views

Where is the sshd log file on Red Hat Linux stored?

Can someone please tell me where to find the SSHD log on RedHat and SELinux.... I would like to view the log to see who is logging into my account..
6
votes
4answers
4k views

Trying to SSH in to remote computer but still asking for password

Trying to SSH in to remote computer but still asking for password. I have a number of computers running SElinux and only one of them is giving me a hard time using ssh without the password. I did ...
1
vote
2answers
2k views

SELinux: how to enable write access to Joomla cache directory?

I have set up SELinux on a Debian squeeze system, which runs a Joomla website. The Joomla PHP code wants to have write access to certain cache directories. The /var/log/messages file contains ...
3
votes
2answers
1k views

What is the difference between httpd_read_user_content and httpd_enable_homedirs?

The apache module of SELinux has two similar boolean parameters: httpd_read_user_content and httpd_enable_homedirs. Man page says the former allows httpd to read user content and the latter allow ...
1
vote
0answers
69 views

linux: upload / download difference on network shares

I have a Red Hat Enterprise Linux 6 (with SELinux) which shows significant differences of speed between download and upload (the latter significantly slower) of files shared over the LAN. The ...
-5
votes
3answers
263 views

What's the proper way to reset SELinux? [closed]

I'm using REDHAT 6.x and I think something went wrong so I'd like to reset EVERYTHING (selinux wise) and just redo it, how would one go about it?