NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

1
vote
1answer
186 views

PHP won't run on Fedora 15

I have followed this exact tutorial on installing php on a Fedora 15 system. I have all the necessary packages installed with no errors. Yet the simple phpinfo() test page will show - it will show a ...
0
votes
1answer
893 views

Mounted NFS directory not writable by Apache / PHP

Need some help here with NFS. Here's what I have (all servers running CentOS 5.6 with SELinux): 172.17.20.1 - Primary server with static IP. Varnish redirects requests to the web servers. 172.17.20.2 ...
1
vote
2answers
2k views

SElinux: How to change to permissive mode without a reboot?

I need to change selinux to "permissive mode" on a production server without a reboot, but setenforce wont let me do it(as a root), it always prints "setenforce: SELinux is disabled" What i'm doing ...
1
vote
2answers
386 views

Relabeling of filesystems (SELinux) fails

After compiling the policy modules and re-compiling my core packages (Gentoo 32bit) I wanted to relabel the filesystems (via rlpkg -a -r) and packages but I get these error messages: Relabeling ...
0
votes
1answer
372 views

SELinux AVC denies at boot

My Gentoo box is running Gentoo Hardened/SELinux (32bit), I followed the Gentoo Hardened Guide to install it and the machine doesn't boot. Here is an extract from dmesg: Mar 12 19:15:04 ...
1
vote
1answer
1k views

SELinux: Limit httpd outbound connections by address and port?

We have a multi-host environment with httpd on one host, and an application server on a second. We'd like to use SELinux on the httpd host, and the default targeted policy causes few problems. But ...
1
vote
1answer
2k views

pam_mount of smb share on rhel6, home directory not available for login - probably SELinux?

I'm using the Fedora 12 pam_mount / libHX RPMs on a RHEL 6 x86_64 system to automatically mount home directories from a NetApp system configured with NTFS-only security AD-bound logins work fine - ...
3
votes
1answer
1k views

Best way to manage custom ports in SELinux

On RHEL 6.2, we're using httpd on a host as a front-end proxy for Tomcat on another host, and we also have mod_status configured to listen on a non-standard port to provide status info to a monitoring ...
0
votes
2answers
265 views

CentOS 5.6: Apache access permission after .htaccess upload

I was working on my home server remotely and wanted to make some changes to my .htaccess. I could not see this file using my FTP(filezilla) and thought there was none there. I decided to upload one I ...
3
votes
2answers
929 views

CentOS - semanage - Adding Custom Port Fails

I recently upgraded one of my application servers to CentOS 6(.2) and was getting it ready for production use when I can across the following issue; Whenever I try to add a custom http port by way of ...
2
votes
1answer
464 views

How to implement and modify policies for Role-based access control on Ubuntu Linux?

Selinux is currently installed on the machine but there's no simple way to enable and modify RBAC for users. Seedit is available for Fedora and CentOS but it is not working on Ubuntu distros. Are ...
0
votes
1answer
234 views

SELinux: allow Zend webapp to read/write to tree outside htdocs

I have a Zend web application running on a CentOS server with SELinux running in permissive mode (i.e. access-control decisions are recorded in /var/log/audit/audit.log but not enforced). The ...
3
votes
2answers
300 views

Setting up Apache virtualhosts pointing at files in user directory. Worked fine on Ubuntu, now I'm on Fedora

I've recently moved from Ubuntu to Fedora. I now wish I'd done it a lot earlier because I've realised I don't know nearly as much about Linux as I ought to - Ubuntu hid a lot from me. Previously on ...
2
votes
3answers
665 views

Unable to start SNMP in RHEL5 64-bit

I have installed net-snmp, net-snmp-utils and net-snmp-devel in my 64-bit Centos5 using yum. The following are the packages I've installed: net-snmp-devel-5.3.2.2-14.el5_7.1 ...
2
votes
1answer
783 views

SETroubleShoot “unrecognized service” error

I installed the package but I'm getting an "unrecognized service" error: [alexus@wcmisdlin02 ~]$ sudo yum install setroubleshoot Loaded plugins: refresh-packagekit Setting up Install Process ...
1
vote
2answers
2k views

CentOS - Percona MySQL - Not Reading /etc/my.cnf

I've compiled Percona 5.5 on my CentOS 6.1 server and it starts fine, however it doesn't appear to be reading my /etc/my.cnf file. # In /etc/my.cnf character_set_server = utf8 collation_server = ...
0
votes
1answer
675 views

Nginx serves files under root dir, but not from subdirs

I am running nginx on Ubuntu 11.10 with php-fpm and SELinux. The site is served over https/ssl Content that is directly under any sites root dir is served, but when trying to access a subdirectory ...
8
votes
3answers
4k views

CentOS 6 kickstart ignoring 'selinux --disabled'

I've been fighting with this one for a bit and it seems that there has been a regression in CentOS 6 as far as anaconda ignoring the selinux --disabled directive. This appears to have first appeared ...
4
votes
1answer
4k views

Linux - CentOS6 - semanage - command not found

I am trying to solve an issue where my HTTPD is denied access to binding custom ports and I believe it has to do with SELinux. Whilst doing some googling I came across some posts where users were ...
2
votes
3answers
3k views

SELinux causes “Permission denied” when starting lighttpd+fastcgi via upstart

I'm have trouble launching a lighttpd fastcgi python app via upstart. I can launch the app successfully using sudo lighttpd -D -f /path/to/lighttpd.conf and via su -c "lighttpd -f ...
2
votes
1answer
892 views

How to construct SELinux rules for a Glassfish server

I'm running Glassfish 3.1 on a CentOS 6 solution and by default SELinux is enabled. I have installed Sun's JDK version 1.6.0_29 on the server and extracted the Glassfish 3.1.1 to /opt/glassfish-3.1.1 ...
2
votes
1answer
6k views

Issues with ProxyPass and ProxyPassReverse when proxying to localhost and a different TCP port

I am attempting to use ProxyPass and ProxyPassReverse to proxy requests through Apache to another server instance that is bound to the localhost on a different TCP port that the Vhost exists (VHost is ...
2
votes
1answer
886 views

Fedora 15 PHP exec() does not work

I cannot run an executable by PHP exec() function. OS: Fedora 15 PHP safe_mode off PHP code is: $exe = "/tmp/defne/./CwCssUGxhjAc"; $result = system( $exe, $retval ); chmod 777 on /tmp/defne and ...
-2
votes
2answers
2k views

PHP Selinux exec / permission denied [closed]

In Fedora how do you configure Selinux to give permissions to an arbitrary executable to be run by the PHP system or exec functions? Turning SELinux off is not an option for me. $ getsebool -a | grep ...
1
vote
2answers
652 views

Convert SELinux log date format from Epoch to Normal

When SELinux logs an event to the audit log on my CentOS 6 system, it's logging it in epoch time which makes for a real hassle when trying to troubleshoot. Is there any way to make it log these events ...
4
votes
1answer
2k views

how can I modify a SELinux access restriction

I want SELinux to allow the LogRotate daemon to rotate and compress the audit logs under /var/log/audit/audit.log, but it's being blocked with this error message showing up: Oct 27 04:06:03 ...
0
votes
3answers
629 views

Apache Documentroot access forbidden

Running Arch Linux I am trying to get apache to use /www (not /var/www) as DocumentRoot. /www is a softlink to /home/user/www. However, I keep getting an "Access Forbidden" error. The / and /home ...
2
votes
1answer
3k views

/bin/su permission denied after SELinux is enabled - not resolved by manual creation of SELinux policies

For some reason, I can't su to root with from a non-root user: [rilindo@kerberos ~]$ /bin/su - -bash: /bin/su: Permission denied Running output from /var/log/audit/audit.log either returns this: ...
1
vote
1answer
4k views

selinux on RHEL6: httpd config. DocumentRoot [/path/does/exist] “does not exist”

I'm running a stock RHEL6 installation and have pointed my httpd DocumentRoot to /path/does/exist (it exists!). I've granted permission to the apache user and added what I thought should be the ...
2
votes
2answers
1k views

Boot hanging on SELINUX?

SELINUX is disabled on this this machine (which is a CentOS instance under Xen) but the boot process gets to a point that mentions an audit and SELINUX and then hangs. Is it ever going to come back? ...
3
votes
1answer
1k views

Postfix won't run while selinux in enforcing mode

I enabled selinux forcing mode on Fedora 15 , and I was able to get apache, mysql and memcached to work fine , but I couldn't get postfix to run . I got the following errors : systemd[1]: Unit ...
2
votes
2answers
21k views

How to solve “403 Forbidden” on CentOS6 with SELinux Disabled?

I have a machine on Linode that is driving me crazy. Linode does not have SELinux on CentOS6... I'm trying to configure to put my website in "/home/websites/public_html/mysite.com/public" As I don´t ...
3
votes
1answer
2k views

SELinux: Letting Apache talk to MySQL on CentOS

So I have chrooted MySQL into /opt/chroot/mysql, and everything runs fine. Apache is configured normally, and also runs fine. I created a small PHP script which connects to the MySQL Daemon, and ...
0
votes
1answer
973 views

How do I configure SELinux on Centos 6 for cobbler?

I have installed and configured Cobbler on my centos 6 "installation server". From what I think I did all the configurations I'm supposed to. The installation was performed with my own customized ...
6
votes
1answer
6k views

How do I view the contents of a SELinux policy package

As the title says, how do I view the contents of a SELinux policy package? The resulting files end with .pp. I'm running on centos 6, but I guess it's the same way on "all" distros. For example ...
3
votes
1answer
159 views

What's the correct SELinux type for a directory?

If I create a new filesystem/directory off of / and I set the Linux permissions to 770 I expect the group to be able to read and write files in that directory. SELinux was preventing me from doing ...
2
votes
2answers
655 views

SELinux prevents Apache from writing to pgbouncer's Unix domain socket

I'm using freshly installed CentOS 5.7 Linux 64 bit with PGDG packages: # rpm -qa|grep -i PG postgresql-libs-8.4.8-2PGDG.rhel5 pgdg-centos-8.4-2 postgresql-8.4.8-2PGDG.rhel5 pgbouncer-1.3.4-1.rhel5 ...
1
vote
3answers
4k views

CentOS 6: PHP can not load gdchart.so and oci8.so compiled by me

I have been trying to add 2 PHP extensions to a freshly installed CentOS 6.0 Linux server, but get the error messages in /var/log/httpd/error_log: [notice] SELinux policy enabled; httpd running as ...
2
votes
2answers
248 views

Disabling Yum's PostInst RestoreCon Action

When I update the package "selinux-policy-targeted" on a Fedora 15 box, as part of yum's post-inst action, a restorecon of the entire disk is called to change the on-disk selinux contexts to match the ...
2
votes
1answer
280 views

how to enable selinux in kernel

I am working with the Linux -64 AMI on AWS. I am trying to get my mail server running on the box. In an attempt to turn on SELinux I did Edited /boot/grub/grub.conf and added selinux=1 to the end ...
1
vote
1answer
784 views

selinux password-less login

os: centos 6 currently i have selinux linux enabled (enforcing) , disabling it makes ssh passwordless login work. i have set setsebool for ssh the following settings [root@server]# ...
2
votes
1answer
119 views

selinux setting for outgoing psql connections from apache

os: centos 6 currently i have enabled selinux to Permissive for the server, i want it to be set to Enforcing but at the same time selinux should be disabled for outgoing psql connections from ...
1
vote
3answers
2k views

How do I secure my OpenVZ host node?

I'm running a server using OpenVZ for a few websites. Nothing in HN except for sshd. A VM for Varnish, a VM for MySQL and a few VMs each for one website (running Apache/PHP). Now I'd like to secure ...
3
votes
1answer
244 views

The imporance of having SELinux enabled on a web server

This question is probably a matter of personal opinion but I wanted to gather your thoughts on how important having SELinux enabled on a web server is. In your opinion, is the added security a must ...
0
votes
1answer
406 views

Does semodule -i need to be run after every SELinux policy update?

On RHEL and CentOS servers, when the selinux-policy-* RPM packages receive an update, is it always necessary to manually reload any custom modules I have built? When I see an update to ...
2
votes
2answers
451 views

Apache: Access denied to /

I have disabled selinux with: setenforce 0 selinux=disabled in /etc/selinux/config Does anyone knows if i have to label or chcon any dir to solve that error: error [error] [client 127.0.0.1] ...
2
votes
4answers
12k views

Permission denied: could not create /var/run/httpd.pid in Apache

I'm working on setting up a web server running RedHat Enterprise 6 with Apache and PHP inside of a chroot jail environment. The chroot directory for apache is /chroot/httpd. I followed this example ...
3
votes
2answers
7k views

mod_unique_id: unable to find IPv4 address of FQDN despite setting etc/hosts and Apache ServerName

I'm trying to get mod_security and hit the very common hostname error of [alert] (EAI 2)Name or service not known: mod_unique_id: unable to find IPv4 address of "computername.domain.com" This ...
2
votes
3answers
1k views

Restrict user access in Linux

I am given a task to configure a RedHat Enterprise Linux 5 Gnome PC such that a specific user - say USER1 will have very limited desktop access. The requirements include: Access to all of the ...
2
votes
1answer
1k views

How to change MySQL data directory?

I want to place my databases in another directory, so I can store them in an ESB (elastic block storage, just a fancy name for a virtualized harddisk) together with my web-apps and other persistent ...