NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

1
vote
2answers
893 views

Apache will not stop/start gracefully

CentOs 6 64bit running apache 2.2.15-29.el6.centos. When I try to stop/start or restart httpd I get an error that says it has failed. A tail of the error log is below. I also noticed that a ...
1
vote
1answer
117 views

If matchpathcon checks the SELinux context of a directory, what is the converse check for the service?

A page from Fedora docs describes a SELinux context problem with the example: "...instead of using /var/www/html/ for a website, an administrator wants to use /srv/myweb/. ... [However] SELinux ...
2
votes
1answer
307 views

sudo: PAM audit_log_acct_message() failed: Permission denied

.. any time I'm run sudo through NRPE, I'm get a following message in my /var/log/secure, and I can't figure out how to resolve it. sudo: PAM audit_log_acct_message() failed: Permission denied ...
0
votes
2answers
622 views

RHEL6: Selinux not logging AVC denial messages

I'm trying to configure a set of lockdown rules. My approach is to start with a restricted user, and use audit2allow messages to selective add permissions. My problem is that I don't see the expected ...
4
votes
1answer
179 views

SELinux: How to show all allowed rules for a type?

For an arbitrary object type, e.g. user_tmp_t, I want to know which processes are allowed to access this tag. How do I find all allow rules that reference user_tmp_t?
2
votes
1answer
887 views

Creating a public_html for a user on a Red Hat Linux Server

I'm just trying to make a public_html folder under my username on a Red Hat Linux Server (and it's all been a bit of a headache). I made the folder and set the permissions to 755. I wasn't sure how ...
3
votes
2answers
91 views

Relocated /var - now selinux is unhappy

I needed more space in the /var tree on a VM so I allocated some, booted in to runlevel 1 and copied over the folder to the new space. After changing the fstab entry for /var to reflect the new ...
4
votes
1answer
1k views

Granting sudo access to a SELinux confined user in freeIPA

I'm using freeIPA to define RBAC, HBAC and sudo rules, as well as SELinux user mappings for a domain of a couple hundred virtual machines, where I need to grant different levels of access to several ...
2
votes
1answer
241 views

How to make Puppet fix SELinux types for home directories?

We are using pam_mkhomedir.so to automatically create the home directories of users logging in with SSH. There is a bug in pam_mkhomedir that sets the SELinux contexts to home_root_t instead of ...
2
votes
1answer
289 views

SELinux remove or leave the old SSH port label?

I am following this (basic) security guide to change my Server's SSH port to something else. It says: $ semanage port -a -t ssh_port_t -p tcp 2345 #Change me ...which would add a new label on top ...
1
vote
1answer
39 views

Assign selinux context to the application without changing context of binary

Is there a way to assign custom SELinux context to the application despite the context that is assigned to it's binary?
0
votes
3answers
108 views

proftpd is accessing my.cnf

I use proftpd for virtual FTP hosting with MySQL. I've started writing fine-grained SELinux policies and found that it's trying to access my.cnf files. Question is what for and why? type=AVC ...
4
votes
1answer
947 views

RHEL6: Tomcat runs as unconfined Java user

I'm starting to configure RHEL6 to be a hardened Tomcat server and applying SELinux policies for access control. After installing RHEL6 and Tomcat6 (standalone, no httpd), I noticed that the Tomcat ...
1
vote
2answers
273 views

Redhat: How to create a new role with SELinux?

I can figure out how to map a SELinux user to an existing role, but how do I create new roles? I'm looking to create a restricted admin role for my box.
2
votes
1answer
441 views

SELinux: How to add a new security context?

I'm new to SELinux and am trying to add a new security context (label) to test denial. To do this, I try changing a filew to a new context: chcon -t new_t test But it fails with "Invalid argument". ...
4
votes
3answers
1k views

SELinux - canonical way of automatically applying a context on file creation

My current understanding is that you have to manually use restorecon to apply the desired context to a newly created file or directory unless you are happy with the context that it inherits from its ...
2
votes
2answers
2k views

Incrond running but not executing commands CentOS 6.4

I have copied this question over here from StackOverflow... I have installed incron from the EPEL repository (0.5.9) (before you ask; YES, I also tried downloading the source and compiling locally ...
2
votes
1answer
270 views

Gitolite3 over http selinux permissions

I'm trying to install gitolite3 on Centos6.4. It works, I can ssh and, after some trouble, I can also read, such as clone, through http and httpd. I am re-enabling selinux into permissive mode, that I ...
2
votes
0answers
230 views

Gitolite3 push and selinux access failure

I try to install gitolite3 with ssh and http. I have followed largely the official guide at gitolite3, but I am stumbling accross three remaining problems. When I $ git clone ...
2
votes
2answers
140 views

Httpd on Centos6 not listing directory contents

I have a folder (which is NOT the conventional /var/www/html folder!) /Server/Websites/Default on my Centos6.4 server. There is only one file, phpinfo.php (with the obvious code in it). Running ...
1
vote
1answer
184 views

vsftpd + vitual users + selinux

I can't make vsftpd to work and it is driving me crazy. The virtual users can connect, but they can't upload files or create folders. I hope someone can help me. I get this error in the ftp client: ...
1
vote
1answer
453 views

pure-ftpd auth blocked by SELinux

First, my setup. I'm using CentOS 6.4 and I installed pure-ftpd (plus the SELinux module) from the EPEL repositories : > rpm -q pure-ftpd pure-ftpd-selinux pure-ftpd-1.0.30-1.el6.x86_64 ...
0
votes
1answer
7k views

SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0

I kept getting the following notice in apache log when I start apache http server 2.2: SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0 even though I disabled ...
1
vote
2answers
2k views

Home directories created with wrong Selinux context

[root@tst-01 home]# ls -Z drwxr-xr-x. ujjain users system_u:object_r:home_root_t:s0 ujjain drwxr-xr-x. johndoe users system_u:object_r:home_root_t:s0 johndoe The selinux ...
1
vote
1answer
107 views

How to match selinux rules/transitions/labels/etc to modules

I need to match running/loaded selinux rules/transitions/labels/etc to the selinux policy modules where they are defined (semodules -l). I need this because I want to study some selinux policy modules ...
2
votes
1answer
1k views

Configure selinux to allow openldap on CentOS 6.4

I'm trying to run an OpenLDAP server on CentOS 6.4 with selinux enabled, but slapd is dieing as soon as it's started via /etc/init.d/slapd start. (init script reports OK; everything works fine after ...
3
votes
1answer
1k views

How can I query for all selinux rules/default file contexts/etc affecting a type

I need to know everything related to a selinux type on a running system's current rules: allow, allowaudit, dontaudit rules. files labeled with a context using the type. transitions. ...and any ...
3
votes
1answer
323 views

Selinux interfering with vboxwebsrv or phpvirtualbox

I have a brand new installation of Fedora 18, with a brand new installation of Virtualbox 4.2. I have spent a painful few hours trying to get phpVirtualBox working. Apache 2.4 and PHP 5.4 are ...
-3
votes
1answer
193 views

Changing user mail location in CentOS with SELinux Enabled

This is an practice RHCE question. I need to change the mail files from /var/spool/mail/user to /var/spool/user. Note that SELinux must remain enabled at all times. Will I need to change any folder ...
1
vote
1answer
1k views

Configure selinux to allow snmpd to read to a custom location

I have snmpd executing a script under /custom/location/myscript.sh. If I disable selinux all works well. If I enable selinux it stops working and if I do an audit2why I see the following: type=AVC ...
1
vote
1answer
153 views

SELinux Preventing Apache Start

When running in strict mode, SELinux would not let me start HTTPD since my mod_jk.so module was copied from an external server. I copied mod_jk.so externally since I couldn't find the package to ...
0
votes
1answer
579 views

Errors whilst installing kolab

i'm struggling for the past 2 days please help me anyone... [root@mail /]# setup-kolab Please supply a password for the LDAP administrator user 'admin', used to login to the graphical console of 389 ...
2
votes
2answers
2k views

setenforce: SELinux is disabled

I'm in a CentOS 5 machine, and try to install vsftpd. I want to configure ftp_home_dir using setsebool -P ftp_home_dir on but it says: setsebool: SELinux is disabled. I try to enable it using ...
0
votes
1answer
106 views

PHP Not running on specific directories [closed]

Ok. This is a pretty weird error: I made a folder named 'hello' at /etc/apache2/sites-enabled/ with hello.php. Then i created an Alias that told /hello would go to /etc/apache2/sites-enabled/hello. ...
0
votes
2answers
3k views

Selinux in permissive mode, ssh key based auth and locked account

I noticed something weird regarding ssh key based login and selinux in permissive mode. Let me introduce you the setup: The server is an updated Centos 6.4 x86_64. We create user without a password ...
-1
votes
1answer
75 views

SElinux policy to grant read access to /etc/my.cnf for httpd

How can I modify the SElinux policy to allow httpd to read /etc/my.cnf? Background: My web application connects to a mysql database. Instead of hardcoding the credentials in the code, they are stored ...
1
vote
2answers
2k views

Disable SeLinux permanently

I am running a virtualbox CentOS 6.4 (64 bit) server with Cobbler service. One of the steps is to disable SeLinux in order to prevent a python error when running service cobblers start. If I run ...
2
votes
3answers
410 views

Zabbix Trigger for SELinux (type=AVC) Errors

I would like to create a trigger in Zabbix to alert me anytime a type=AVC error appears in a CentOS 6 server's /var/log/audit/audit.log file. I've already tried creating a basic log scrape. E.g.: ...
2
votes
1answer
431 views

selinux disabled, but still enforcing?

I have some systems where, for various reasons, we want to completely disable selinux. To date, this has worked like a champ, with always using selinux=0 in the kickstarts and ensuring that ...
7
votes
1answer
702 views

How can I use SELinux to confine PHP scripts?

I want to compartmentalize different PHP applications on my SL6.4 (RHEL 6.4 rebuild) web server so that they cannot access each others' data. It seems that SELinux might be able to do this, but I am ...
0
votes
2answers
270 views

Check my Kernel for SELinux Support

I want to know if the kernel i am running has support for SELinux. What commands would i use to check this ?
2
votes
1answer
75 views

Adding to existing policy in selinux

I just created a custom policy and did the semodule -i test.te. I reran all my tests after a few days and I noticed there were additional AVC denials in the audit.log. I want to add the new stuff ...
2
votes
0answers
186 views

selinux “Possible mismatch between this policy…”

How do I go about troubleshooting the following error below: type=AVC msg=audit(1365523330.609:4846): avc: denied { append } for pid=12542 comm="FTPMan.pl" name="user_list" dev=dm-0 ino=2884237 ...
1
vote
1answer
77 views

selinux in enforcing mode

I do test driven development where all my APIs are tested with a batch of tests. Initially, I ran the tests in ‘permissive’ mode in selinux. So, I decided to enable selinux to ‘enforcing’ mode. ...
1
vote
3answers
504 views

selinux Missing type enforcement (TE) allow rule

When I run my FTP test to test for full functionality, I'm concerned on why am I getting an avc denial error on such a popular command, such as 'mkdir'? Here is the AVC denial message: type=AVC ...
3
votes
2answers
1k views

selinux avc: denied issue

I just setup a web hosting server with selinux in permissive mode, meaning it's unsecured but writing issues to the message log file. Once I have fixed all the avc: denied errors, I will put the ...
0
votes
1answer
936 views

ProFTPd and SELinux: mkdir Permission denied

I have a ProFTPd server on Centos 6.3 with SELinux Enforcing. My users are virtual users in a flat file. The users are chrooted to directories mounted via NFS. I've already set the following ...
0
votes
1answer
41 views

Download file without disabling selinux

I am developing a site in PHP on Linux Server where I need to download a file from Windows Server to Linux Machine. I can do it with Some Changes in SeLinux or setting some properties on it, i.e.: % ...
0
votes
1answer
444 views

Lighttpd fails with 403 - Forbidden with SELinux enabled

I've setup a CentOS 6.3 box with lighttpd, php-fpm and I can server both static files and PHP files with SELinux enabled if I leave the lighttpd home directory set to the default (/var/www/lighttpd). ...
0
votes
1answer
95 views

After trying to remove SELinux, system doesn't start; shows error of “unable to connect to system bus”

I had SELinux installed on my system which actually was a bit annoying. I tried to remove it. After that my system is unable to start. The error that is showing up is: unable to connect to system ...