NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

1
vote
2answers
2k views

CentOS - Percona MySQL - Not Reading /etc/my.cnf

I've compiled Percona 5.5 on my CentOS 6.1 server and it starts fine, however it doesn't appear to be reading my /etc/my.cnf file. # In /etc/my.cnf character_set_server = utf8 collation_server = ...
0
votes
1answer
651 views

Nginx serves files under root dir, but not from subdirs

I am running nginx on Ubuntu 11.10 with php-fpm and SELinux. The site is served over https/ssl Content that is directly under any sites root dir is served, but when trying to access a subdirectory ...
8
votes
3answers
4k views

CentOS 6 kickstart ignoring 'selinux --disabled'

I've been fighting with this one for a bit and it seems that there has been a regression in CentOS 6 as far as anaconda ignoring the selinux --disabled directive. This appears to have first appeared ...
3
votes
1answer
4k views

Linux - CentOS6 - semanage - command not found

I am trying to solve an issue where my HTTPD is denied access to binding custom ports and I believe it has to do with SELinux. Whilst doing some googling I came across some posts where users were ...
2
votes
3answers
3k views

SELinux causes “Permission denied” when starting lighttpd+fastcgi via upstart

I'm have trouble launching a lighttpd fastcgi python app via upstart. I can launch the app successfully using sudo lighttpd -D -f /path/to/lighttpd.conf and via su -c "lighttpd -f ...
2
votes
1answer
863 views

How to construct SELinux rules for a Glassfish server

I'm running Glassfish 3.1 on a CentOS 6 solution and by default SELinux is enabled. I have installed Sun's JDK version 1.6.0_29 on the server and extracted the Glassfish 3.1.1 to /opt/glassfish-3.1.1 ...
2
votes
1answer
6k views

Issues with ProxyPass and ProxyPassReverse when proxying to localhost and a different TCP port

I am attempting to use ProxyPass and ProxyPassReverse to proxy requests through Apache to another server instance that is bound to the localhost on a different TCP port that the Vhost exists (VHost is ...
2
votes
1answer
829 views

Fedora 15 PHP exec() does not work

I cannot run an executable by PHP exec() function. OS: Fedora 15 PHP safe_mode off PHP code is: $exe = "/tmp/defne/./CwCssUGxhjAc"; $result = system( $exe, $retval ); chmod 777 on /tmp/defne and ...
-2
votes
2answers
2k views

PHP Selinux exec / permission denied [closed]

In Fedora how do you configure Selinux to give permissions to an arbitrary executable to be run by the PHP system or exec functions? Turning SELinux off is not an option for me. $ getsebool -a | grep ...
1
vote
2answers
555 views

Convert SELinux log date format from Epoch to Normal

When SELinux logs an event to the audit log on my CentOS 6 system, it's logging it in epoch time which makes for a real hassle when trying to troubleshoot. Is there any way to make it log these events ...
4
votes
1answer
2k views

how can I modify a SELinux access restriction

I want SELinux to allow the LogRotate daemon to rotate and compress the audit logs under /var/log/audit/audit.log, but it's being blocked with this error message showing up: Oct 27 04:06:03 ...
0
votes
3answers
607 views

Apache Documentroot access forbidden

Running Arch Linux I am trying to get apache to use /www (not /var/www) as DocumentRoot. /www is a softlink to /home/user/www. However, I keep getting an "Access Forbidden" error. The / and /home ...
2
votes
1answer
3k views

/bin/su permission denied after SELinux is enabled - not resolved by manual creation of SELinux policies

For some reason, I can't su to root with from a non-root user: [rilindo@kerberos ~]$ /bin/su - -bash: /bin/su: Permission denied Running output from /var/log/audit/audit.log either returns this: ...
1
vote
1answer
4k views

selinux on RHEL6: httpd config. DocumentRoot [/path/does/exist] “does not exist”

I'm running a stock RHEL6 installation and have pointed my httpd DocumentRoot to /path/does/exist (it exists!). I've granted permission to the apache user and added what I thought should be the ...
2
votes
2answers
1k views

Boot hanging on SELINUX?

SELINUX is disabled on this this machine (which is a CentOS instance under Xen) but the boot process gets to a point that mentions an audit and SELINUX and then hangs. Is it ever going to come back? ...
3
votes
1answer
1k views

Postfix won't run while selinux in enforcing mode

I enabled selinux forcing mode on Fedora 15 , and I was able to get apache, mysql and memcached to work fine , but I couldn't get postfix to run . I got the following errors : systemd[1]: Unit ...
2
votes
2answers
20k views

How to solve “403 Forbidden” on CentOS6 with SELinux Disabled?

I have a machine on Linode that is driving me crazy. Linode does not have SELinux on CentOS6... I'm trying to configure to put my website in "/home/websites/public_html/mysite.com/public" As I don´t ...
3
votes
1answer
2k views

SELinux: Letting Apache talk to MySQL on CentOS

So I have chrooted MySQL into /opt/chroot/mysql, and everything runs fine. Apache is configured normally, and also runs fine. I created a small PHP script which connects to the MySQL Daemon, and ...
0
votes
1answer
930 views

How do I configure SELinux on Centos 6 for cobbler?

I have installed and configured Cobbler on my centos 6 "installation server". From what I think I did all the configurations I'm supposed to. The installation was performed with my own customized ...
6
votes
1answer
5k views

How do I view the contents of a SELinux policy package

As the title says, how do I view the contents of a SELinux policy package? The resulting files end with .pp. I'm running on centos 6, but I guess it's the same way on "all" distros. For example ...
3
votes
1answer
159 views

What's the correct SELinux type for a directory?

If I create a new filesystem/directory off of / and I set the Linux permissions to 770 I expect the group to be able to read and write files in that directory. SELinux was preventing me from doing ...
2
votes
2answers
605 views

SELinux prevents Apache from writing to pgbouncer's Unix domain socket

I'm using freshly installed CentOS 5.7 Linux 64 bit with PGDG packages: # rpm -qa|grep -i PG postgresql-libs-8.4.8-2PGDG.rhel5 pgdg-centos-8.4-2 postgresql-8.4.8-2PGDG.rhel5 pgbouncer-1.3.4-1.rhel5 ...
1
vote
3answers
4k views

CentOS 6: PHP can not load gdchart.so and oci8.so compiled by me

I have been trying to add 2 PHP extensions to a freshly installed CentOS 6.0 Linux server, but get the error messages in /var/log/httpd/error_log: [notice] SELinux policy enabled; httpd running as ...
2
votes
2answers
223 views

Disabling Yum's PostInst RestoreCon Action

When I update the package "selinux-policy-targeted" on a Fedora 15 box, as part of yum's post-inst action, a restorecon of the entire disk is called to change the on-disk selinux contexts to match the ...
2
votes
1answer
271 views

how to enable selinux in kernel

I am working with the Linux -64 AMI on AWS. I am trying to get my mail server running on the box. In an attempt to turn on SELinux I did Edited /boot/grub/grub.conf and added selinux=1 to the end ...
1
vote
1answer
754 views

selinux password-less login

os: centos 6 currently i have selinux linux enabled (enforcing) , disabling it makes ssh passwordless login work. i have set setsebool for ssh the following settings [root@server]# ...
2
votes
1answer
119 views

selinux setting for outgoing psql connections from apache

os: centos 6 currently i have enabled selinux to Permissive for the server, i want it to be set to Enforcing but at the same time selinux should be disabled for outgoing psql connections from ...
1
vote
3answers
1k views

How do I secure my OpenVZ host node?

I'm running a server using OpenVZ for a few websites. Nothing in HN except for sshd. A VM for Varnish, a VM for MySQL and a few VMs each for one website (running Apache/PHP). Now I'd like to secure ...
3
votes
1answer
239 views

The imporance of having SELinux enabled on a web server

This question is probably a matter of personal opinion but I wanted to gather your thoughts on how important having SELinux enabled on a web server is. In your opinion, is the added security a must ...
0
votes
1answer
391 views

Does semodule -i need to be run after every SELinux policy update?

On RHEL and CentOS servers, when the selinux-policy-* RPM packages receive an update, is it always necessary to manually reload any custom modules I have built? When I see an update to ...
2
votes
2answers
431 views

Apache: Access denied to /

I have disabled selinux with: setenforce 0 selinux=disabled in /etc/selinux/config Does anyone knows if i have to label or chcon any dir to solve that error: error [error] [client 127.0.0.1] ...
2
votes
4answers
12k views

Permission denied: could not create /var/run/httpd.pid in Apache

I'm working on setting up a web server running RedHat Enterprise 6 with Apache and PHP inside of a chroot jail environment. The chroot directory for apache is /chroot/httpd. I followed this example ...
3
votes
2answers
7k views

mod_unique_id: unable to find IPv4 address of FQDN despite setting etc/hosts and Apache ServerName

I'm trying to get mod_security and hit the very common hostname error of [alert] (EAI 2)Name or service not known: mod_unique_id: unable to find IPv4 address of "computername.domain.com" This ...
2
votes
3answers
1k views

Restrict user access in Linux

I am given a task to configure a RedHat Enterprise Linux 5 Gnome PC such that a specific user - say USER1 will have very limited desktop access. The requirements include: Access to all of the ...
2
votes
1answer
965 views

How to change MySQL data directory?

I want to place my databases in another directory, so I can store them in an ESB (elastic block storage, just a fancy name for a virtualized harddisk) together with my web-apps and other persistent ...
3
votes
1answer
284 views

Disable SELinux file read protection for httpd

I am using RHEL 6.1 and I would like to configure SELinux to authorize httpd to read all files in some folders (My goal is to make log files available via web access). Is this possible without ...
0
votes
1answer
803 views

What does “Invalid AVC allowed in current policy” mean?

I was looking into my selinux alert logfile and running over multiple entries labeled **** Invalid AVC allowed in current policy *** I understand that this signals a problem (on read or getattr ...
1
vote
1answer
824 views

Enabling mod_wsgi with SELinux (Is there a way?)

I recently had a bit of problem when recently by Deploying Django with mod_wsgi due to SELinux. Usually world get a "Permission denied" error (403). This was solved by disabling SELinux. Is there a ...
2
votes
2answers
739 views

Allowing multiple types in the type field of a folder label in SELinux

I'm an Ubuntu/Debian guy but I had trouble installing Ubuntu on a softraid/fakeraid system, so I went with CentOS 5.6. I'm also at a small web development firm where we need to share our test ...
4
votes
2answers
813 views

SELinux & ncsa_auth in Squid

I'm trying to enable SELinux on a CentOS 5.5 server with Squid 3.1.12 that handles authentication via ncsa_auth. When I turn off SElinux everything works fine, but when I enable it, Squid crashes on ...
3
votes
3answers
4k views

SELinux prevents Nagios plugins from running on RHEL6

After installing Nagios NRPE & Nagios Plugins, I'm getting the following entry in my rsyslog: May 13 14:01:30 wcmisdlin02 kernel: type=1400 audit(1305309690.482:2334): avc: denied { getattr } ...
0
votes
4answers
125 views

FC14 available TCP ports?

I am installing an application on Fedora Core 14 that uses a lot of sockets (eight of them) for TCP communication between various servers, all running on the same localhost. I've been trying to find ...
0
votes
1answer
2k views

Centos+Apache+Phusion+REE=FAIL

I have been trying to get Phusion Passenger running on 5.6 for the last couple of days with no luck. Initially, I started with Ruby 1.9.2 under RVM since the default Ruby on RHEL-based distros is ...
2
votes
6answers
12k views

How to disable SELinux for Apache httpd only on my Fedora 14?

By following this link I am able to just turn SELinux off completely from my Fedora 14. But I wonder how could I disable SELinux only for the httpd daemon? I don't have system-config-selinux installed ...
1
vote
2answers
839 views

How do I Exempt MySQL from SELinux targeted list?

I am running CentOS 5.5 and attempting to place MySQL on a non-standard port...which SELinux complains about. MySQL starts perfectly fine on with SELinux off and refuses to start with it on. SELinux ...
0
votes
1answer
263 views

3ware SNMP plugin does not work with selinux

Anyone have experience using 3ware's SNMP library under SELINUX? I get the following error: snmpget -v 2c -c pub hostname TW-RAID-MIB::twRaidUnitStatus.1 Error in packet Reason: noCreation (That ...
2
votes
4answers
1k views

Using SELinux to force Linux to allow programs to bind to port numbers lower than 1024

Is there a way in SELinux to force linux to allow a program to be able to bind to a port number lower than 1024.
0
votes
2answers
405 views

Selinux: Managing ports; Semanage command not found

I'm having trouble configuring SELinux to allow sending mail. Reading the SELinux documentation I've found I can manage ports via the semanage command, but the command can't be found. Is there ...
5
votes
2answers
271 views

How to handle large number of users in SELinux?

A while back we started authenticating users on our Linux servers against Active Directory. As far as the actual authentication part goes, things are working great. However, one of the side effects ...
1
vote
2answers
448 views

How do I enable SELinux when booting a ramdisk from a CD/DVD?

I have a bootable DVD which boots the same Kernel as the Hard Drive (which uses SELinux). I have copied /etc/selinux and all kernel modules to my ramdisk, and have tried various combinations of ...