NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

0
votes
2answers
236 views

selinux Missing type enforcement (TE) allow rule

When I run my FTP test to test for full functionality, I'm concerned on why am I getting an avc denial error on such a popular command, such as 'mkdir'? Here is the AVC denial message: type=AVC ...
2
votes
2answers
407 views

selinux avc: denied issue

I just setup a web hosting server with selinux in permissive mode, meaning it's unsecured but writing issues to the message log file. Once I have fixed all the avc: denied errors, I will put the ...
0
votes
1answer
641 views

ProFTPd and SELinux: mkdir Permission denied

I have a ProFTPd server on Centos 6.3 with SELinux Enforcing. My users are virtual users in a flat file. The users are chrooted to directories mounted via NFS. I've already set the following ...
0
votes
1answer
39 views

Download file without disabling selinux

I am developing a site in PHP on Linux Server where I need to download a file from Windows Server to Linux Machine. I can do it with Some Changes in SeLinux or setting some properties on it, i.e.: % ...
0
votes
1answer
308 views

Lighttpd fails with 403 - Forbidden with SELinux enabled

I've setup a CentOS 6.3 box with lighttpd, php-fpm and I can server both static files and PHP files with SELinux enabled if I leave the lighttpd home directory set to the default (/var/www/lighttpd). ...
0
votes
1answer
73 views

After trying to remove SELinux, system doesn't start; shows error of “unable to connect to system bus”

I had SELinux installed on my system which actually was a bit annoying. I tried to remove it. After that my system is unable to start. The error that is showing up is: unable to connect to system ...
2
votes
1answer
78 views

How to run selinux sanbdox with access to /dev/urandom

I'm trying to run my application inside an SELinux sandbox. My application needs access to /dev/urandom, and the default sandbox policy does not allow that. What is a simple method to allow my ...
0
votes
1answer
913 views

Change unconfined_u to system_u is failing [duplicate]

I've got a file on my apache/linux server. ls -Z gives: drwxr-xr-x. apache apache unconfined_u:object_r:httpd_sys_rw_content_t:s0 localization.smicloud.org I need to change unconfined_u to ...
-1
votes
1answer
31 views

if I'm only using a server to host webpages, should I be using SELINUX? [duplicate]

On my server, I have static and dynamic websites. Yes there are api links, but they aren't exactly open to the public. When is it appropriate to SELINUX? would this be an appropriate example of a good ...
0
votes
2answers
1k views

sshd[4344]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument?

OpenSSH_5.8p1, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 selinux-policy-2.4.6-338.el5 pam-0.99.6.2-12.el5 SELinux is running in permissive mode: # sestatus SELinux status: enabled ...
0
votes
1answer
749 views

Trying to get Apache and nodejs to play nice together, getting “setsebool: SELinux is disabled.”?

I am running Ubuntu, and an Apache server. I wanted to try out nodejs, and I wanted to run it through a virtualhost on Apache. I read this article and tried to follow the instructions: ...
0
votes
2answers
308 views

PHP Fatal error: date(): Timezone database is corrupt

I installed wordpress to CentOS from EPEL: yum install wordpress And it can only work if I manually disable SELinux. Otherwise I see this error: PHP Fatal error: date(): Timezone database is ...
1
vote
3answers
755 views

Selinux blocks wordpress in CentOS 6.3

I installed wordpress 3.5 to CentOS 6.3 using command: yum install wordpress and started httpd. Now I can see the following error in apache log: PHP Fatal error: require_once(): Failed opening ...
1
vote
1answer
219 views

openssh-lpk - Failed to get default SELinux security context for ldapuser

I'm trying to setup a ssh server with hardened-gentoo sources openssh (with openssh-lpk, which is the ldap flag on gentoo I think) and selinux enabled. On the Ldap-Server I have added an user ...
0
votes
3answers
298 views

restrict root access for certain files or filesystems

I want to store files for my users on encrypted filesystems. Every user would have his own filesystem with his own key. The user is able to log in to the system and mount his filesystem. When they are ...
1
vote
1answer
477 views

How to allow cron to send an email attachment?

SELinux is preventing cron from attaching a log file in the email with the following error: notice kernel [ 7148.923034] type=1400 audit(1359466501.857:5): avc: denied { read } for pid=3182 ...
0
votes
1answer
612 views

HOW do I get enforcing SElinux and postfix with custom milter to work?

I have an IPv4 setup of postfix on RHEL6 with SElinux in enforcing mode. All my attempts at incorporating opendkim fails miserably unless I leave enforcing mode. The errors I get when SElinux is ...
1
vote
1answer
183 views

Is there a way to share via SMB a filesystem mounted via NFS without disabling SElinux?

I have two CentOS hosts. The first is NAS and the second one is a diskless SMB server. The NAS server share folder via NFS and secure Ethernet connection with SMB server. SMB server shares content to ...
1
vote
1answer
184 views

Scientific Linux: soft lockup on quad opteron system

After an impressive uptime of 550 days without trouble our quad opteron system turned into a corrupted system a few days after I mounted an nfs-share from a FreeNAS-box. Ongoing sessions remained ...
3
votes
3answers
12k views

Where is the sshd log file on Red Hat Linux stored?

Can someone please tell me where to find the SSHD log on RedHat and SELinux.... I would like to view the log to see who is logging into my account..
4
votes
4answers
2k views

Trying to SSH in to remote computer but still asking for password

Trying to SSH in to remote computer but still asking for password. I have a number of computers running SElinux and only one of them is giving me a hard time using ssh without the password. I did ...
1
vote
2answers
1k views

SELinux: how to enable write access to Joomla cache directory?

I have set up SELinux on a Debian squeeze system, which runs a Joomla website. The Joomla PHP code wants to have write access to certain cache directories. The /var/log/messages file contains ...
3
votes
2answers
1k views

What is the difference between httpd_read_user_content and httpd_enable_homedirs?

The apache module of SELinux has two similar boolean parameters: httpd_read_user_content and httpd_enable_homedirs. Man page says the former allows httpd to read user content and the latter allow ...
1
vote
0answers
69 views

linux: upload / download difference on network shares

I have a Red Hat Enterprise Linux 6 (with SELinux) which shows significant differences of speed between download and upload (the latter significantly slower) of files shared over the LAN. The ...
-5
votes
3answers
185 views

What's the proper way to reset SELinux? [closed]

I'm using REDHAT 6.x and I think something went wrong so I'd like to reset EVERYTHING (selinux wise) and just redo it, how would one go about it?
0
votes
1answer
261 views

Unable to change user in security context of symlink

I have created a few symbolic links to replace some broken links in /etc/pam.d. The original links have system_u as the user. The newly created ones somehow have unconfined_u as the user. I am not ...
0
votes
2answers
126 views

I am trying to setup phpMyAdmin to use with a remote MySQL databases on Scientific Linux release 6.2

I am trying to setup phpMyAdmin to use with a remote MySQL databases on Scientific Linux release 6.2. If I use the mysql command line to connect to the remote database it works great but if I use ...
0
votes
1answer
75 views

Why do I have to do a setenforce 0 to cluster tomcat on Scientific Linux using mod_proxy

Why do I have to do a setenforce 0 to cluster tomcat on Scientific Linux using mod_proxy I am using Scientific Linux release 6.2 and trying to get mod_proxy working with httpd and tomcat. I want ...
0
votes
2answers
186 views

selinux permissive and type targeted

i am running centos 6.2 recently i noticed that apache was running with selinux enabled # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # ...
2
votes
1answer
72 views

What effect do the user and role labels have on a file in SELinux?

When running ls -dZ /, I get the following output: system_u:object_r:root_t:s0 Can the user and role fields have any effect access permissions involving a file? Do they mean anything?
1
vote
2answers
287 views

How can I do an SELINUX filesystem relabel without rebooting first?

I can touch the file /.autorelabel and reboot and during the initialization coming back up it will do the SELINUX relabel for me. But I want to do this in a different situation where the system has ...
1
vote
2answers
373 views

How to allow unprivileged apache/PHP to do a root task (CentOS)

I am setting up a sort of personal dropbox for our customers on a CentOS 6.3 machine. The server will be accessible thru SFTP and a proprietary http service base on PHP. This machine will be in our ...
2
votes
1answer
181 views

SELinux - CentOSx86_64: User command limitation

SELinux - CentOSx86_64: User command limitation Is SELinux the right tool for this job? If so, what is the best way to do it? I would like to limit a particular user to only running some list of ...
1
vote
1answer
70 views

selinux, git and var/www [closed]

Here's my situation: what i want to do is to "git clone" a project under /var/www. But since i'm logged into my server as idcuser selinux (I suppose :D) doesn't permit me to do it. How can I "give" ...
3
votes
1answer
593 views

CentOS - semanage - Delete range of ports

Surprisingly, could not find any clear information on how to delete a range of ports by way of semanage port. Here is a list of permutations I tried: semanage port -d -t http_port_t -p tcp 0-60000 ...
1
vote
1answer
140 views

selinux boolean allow_user_postgresql_connect has no effect

I'm setting up a new system which contains a postgresql database and I'm trying to lock down which machines are able to open a connection to the database. I'm trying to use the ...
1
vote
0answers
52 views

SELinux documentation [closed]

SELinux is still shipping with new version of Linux (like RHEL), and is still heavily used. However, if a problem occur its hard to find a forum post or answer that doesn’t just tell you to turn it ...
2
votes
1answer
1k views

httpd, vsftpd and the annoying selinux

I have a CentOS 6.3 installed with httpd running and vsftpd but I am unable to balance permission between the user able to upload over ftp and their website working. What I do: I create a user with ...
1
vote
1answer
912 views

CentOS - Configuring Puppet to play nice with SELinux

I am running into an issue every time I attempt to start the puppetmasterd service, for which I receive the following error message: root@service1 ~ # -> /etc/init.d/puppetmaster start Starting ...
4
votes
1answer
203 views

AD GIT SELinux RHEL 6 : Can not get SELinux to allow connetion to git

I have a problem with SELinux! I have installed git on Red Hat Enterprise 6 with AD group control and SSL Cert . Everything works fine if I do setenforce 0 ( set SELinux in detection only mode ) or ...
2
votes
1answer
347 views

SELinux - Allow multiple services access to same /home/dir

I currently have SELinux enabled and have been able to configure apache to allow access to /home/src/web with a chcon command granting the 'httpd_sys_content_t' type. But now I am trying to serve the ...
2
votes
1answer
425 views

'Can't convert nil into String' error upon Puppet run

When attempting to use modules copied into the Puppet modules directory, my puppet client returns ' Could not retrieve catalog from remote server: Error 400 on SERVER: can't convert nil in String' ...
1
vote
2answers
1k views

What does the .autorelabel file do in Linux?

What does the .autorelabel file located at the file root / do in Linux? I know its something to do with SELinux but I can't find any information as to what it actually does. I am running CentOS 6. ...
0
votes
2answers
1k views

Can't change mysql data folder CentOS 6

I've a server with CentOS 6.3 and Mysql installed on. I've created two partition, one for system and the bigger one for data mounted in /data Right after installed Mysql I've created the dir ...
0
votes
2answers
130 views

Centos 6.3 PERL CGI selinux file read access

I have a CGI script called index.cgi It is trying to read a log file called 10.128.0.242.2012.sep.20.downloaded.txt under the path /var/log/trafcount/ It appears that it is being blocked by selinux. ...
1
vote
1answer
602 views

Centos 6.3 PERL CGI selinux file read access

I have a CGI script called index.cgi It is trying to read a log file called 10.128.0.242.2012.sep.20.downloaded.txt under the path /var/log/trafcount/ It appears that it is being blocked by selinux. ...
0
votes
0answers
278 views

SELinux denies execute of script resulting in a complex looking custom policy

The heartbeat type polling tool nanny (part of Piranha / Linux Virtual Server / LVS / IPVS) is being denied access to my "sendprogram" scripts by SELinux. Setting the context alone is not sufficient. ...
0
votes
1answer
60 views

change selinux property of a file? [duplicate]

Possible Duplicate: Permission denied in vhost document root Apache cant process my files due to forbidden error, searching resulted that it might be because of selinux, how can I change ...
6
votes
1answer
1k views

How to run PhantomJS on CentOS with SELinux?

I'm trying to make a screenshot using PhantomJS on my CentOS 5 machine, but I can't get it to work together with SELinux. It works on an identical machine with SELinux disabled, so I really suspect ...
0
votes
1answer
2k views

redhat Apache fast-cgi selinux permissions

My apache installation is running php as fastcgi, and the virtual hosts are pointing to /home/*/public_html. and the fastcgi are home/*/cgi-bin/php.fcgi the public_html setup with selinux was: ...