NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

1
vote
2answers
676 views

Redhat: How to create a new role with SELinux?

I can figure out how to map a SELinux user to an existing role, but how do I create new roles? I'm looking to create a restricted admin role for my box.
2
votes
1answer
1k views

SELinux: How to add a new security context?

I'm new to SELinux and am trying to add a new security context (label) to test denial. To do this, I try changing a filew to a new context: chcon -t new_t test But it fails with "Invalid argument". ...
4
votes
3answers
2k views

SELinux - canonical way of automatically applying a context on file creation

My current understanding is that you have to manually use restorecon to apply the desired context to a newly created file or directory unless you are happy with the context that it inherits from its ...
3
votes
2answers
5k views

Incrond running but not executing commands CentOS 6.4

I have copied this question over here from StackOverflow... I have installed incron from the EPEL repository (0.5.9) (before you ask; YES, I also tried downloading the source and compiling locally (0....
2
votes
1answer
371 views

Gitolite3 over http selinux permissions

I'm trying to install gitolite3 on Centos6.4. It works, I can ssh and, after some trouble, I can also read, such as clone, through http and httpd. I am re-enabling selinux into permissive mode, that I ...
2
votes
0answers
324 views

Gitolite3 push and selinux access failure

I try to install gitolite3 with ssh and http. I have followed largely the official guide at gitolite3, but I am stumbling accross three remaining problems. When I $ git clone http://florian@server/...
2
votes
2answers
173 views

Httpd on Centos6 not listing directory contents

I have a folder (which is NOT the conventional /var/www/html folder!) /Server/Websites/Default on my Centos6.4 server. There is only one file, phpinfo.php (with the obvious code in it). Running http://...
1
vote
1answer
313 views

vsftpd + vitual users + selinux

I can't make vsftpd to work and it is driving me crazy. The virtual users can connect, but they can't upload files or create folders. I hope someone can help me. I get this error in the ftp client: ...
1
vote
1answer
678 views

pure-ftpd auth blocked by SELinux

First, my setup. I'm using CentOS 6.4 and I installed pure-ftpd (plus the SELinux module) from the EPEL repositories : > rpm -q pure-ftpd pure-ftpd-selinux pure-ftpd-1.0.30-1.el6.x86_64 pure-ftpd-...
0
votes
1answer
11k views

SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0

I kept getting the following notice in apache log when I start apache http server 2.2: SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0 even though I disabled ...
2
votes
3answers
4k views

Home directories created with wrong Selinux context

[root@tst-01 home]# ls -Z drwxr-xr-x. ujjain users system_u:object_r:home_root_t:s0 ujjain drwxr-xr-x. johndoe users system_u:object_r:home_root_t:s0 johndoe The selinux ...
1
vote
1answer
156 views

How to match selinux rules/transitions/labels/etc to modules

I need to match running/loaded selinux rules/transitions/labels/etc to the selinux policy modules where they are defined (semodules -l). I need this because I want to study some selinux policy modules ...
2
votes
1answer
2k views

Configure selinux to allow openldap on CentOS 6.4

I'm trying to run an OpenLDAP server on CentOS 6.4 with selinux enabled, but slapd is dieing as soon as it's started via /etc/init.d/slapd start. (init script reports OK; everything works fine after ...
3
votes
1answer
5k views

How can I query for all selinux rules/default file contexts/etc affecting a type

I need to know everything related to a selinux type on a running system's current rules: allow, allowaudit, dontaudit rules. files labeled with a context using the type. transitions. ...and any ...
3
votes
1answer
585 views

Selinux interfering with vboxwebsrv or phpvirtualbox

I have a brand new installation of Fedora 18, with a brand new installation of Virtualbox 4.2. I have spent a painful few hours trying to get phpVirtualBox working. Apache 2.4 and PHP 5.4 are ...
-3
votes
1answer
296 views

Changing user mail location in CentOS with SELinux Enabled

This is an practice RHCE question. I need to change the mail files from /var/spool/mail/user to /var/spool/user. Note that SELinux must remain enabled at all times. Will I need to change any folder ...
1
vote
1answer
3k views

Configure selinux to allow snmpd to read to a custom location

I have snmpd executing a script under /custom/location/myscript.sh. If I disable selinux all works well. If I enable selinux it stops working and if I do an audit2why I see the following: type=AVC ...
1
vote
1answer
308 views

SELinux Preventing Apache Start

When running in strict mode, SELinux would not let me start HTTPD since my mod_jk.so module was copied from an external server. I copied mod_jk.so externally since I couldn't find the package to ...
0
votes
1answer
747 views

Errors whilst installing kolab

i'm struggling for the past 2 days please help me anyone... [root@mail /]# setup-kolab Please supply a password for the LDAP administrator user 'admin', used to login to the graphical console of 389 ...
4
votes
2answers
6k views

setenforce: SELinux is disabled

I'm in a CentOS 5 machine, and try to install vsftpd. I want to configure ftp_home_dir using setsebool -P ftp_home_dir on but it says: setsebool: SELinux is disabled. I try to enable it using ...
0
votes
1answer
320 views

PHP Not running on specific directories [closed]

Ok. This is a pretty weird error: I made a folder named 'hello' at /etc/apache2/sites-enabled/ with hello.php. Then i created an Alias that told /hello would go to /etc/apache2/sites-enabled/hello. ...
0
votes
2answers
4k views

Selinux in permissive mode, ssh key based auth and locked account

I noticed something weird regarding ssh key based login and selinux in permissive mode. Let me introduce you the setup: The server is an updated Centos 6.4 x86_64. We create user without a password (...
-1
votes
1answer
109 views

SElinux policy to grant read access to /etc/my.cnf for httpd

How can I modify the SElinux policy to allow httpd to read /etc/my.cnf? Background: My web application connects to a mysql database. Instead of hardcoding the credentials in the code, they are stored ...
2
votes
2answers
3k views

Disable SeLinux permanently

I am running a virtualbox CentOS 6.4 (64 bit) server with Cobbler service. One of the steps is to disable SeLinux in order to prevent a python error when running service cobblers start. If I run ...
2
votes
3answers
552 views

Zabbix Trigger for SELinux (type=AVC) Errors

I would like to create a trigger in Zabbix to alert me anytime a type=AVC error appears in a CentOS 6 server's /var/log/audit/audit.log file. I've already tried creating a basic log scrape. E.g.: ...
2
votes
1answer
919 views

selinux disabled, but still enforcing?

I have some systems where, for various reasons, we want to completely disable selinux. To date, this has worked like a champ, with always using selinux=0 in the kickstarts and ensuring that /etc/...
7
votes
1answer
926 views

How can I use SELinux to confine PHP scripts?

I want to compartmentalize different PHP applications on my SL6.4 (RHEL 6.4 rebuild) web server so that they cannot access each others' data. It seems that SELinux might be able to do this, but I am ...
0
votes
2answers
566 views

Check my Kernel for SELinux Support

I want to know if the kernel i am running has support for SELinux. What commands would i use to check this ?
2
votes
1answer
113 views

Adding to existing policy in selinux

I just created a custom policy and did the semodule -i test.te. I reran all my tests after a few days and I noticed there were additional AVC denials in the audit.log. I want to add the new stuff ...
2
votes
1answer
536 views

selinux “Possible mismatch between this policy…”

How do I go about troubleshooting the following error below: type=AVC msg=audit(1365523330.609:4846): avc: denied { append } for pid=12542 comm="FTPMan.pl" name="user_list" dev=dm-0 ino=2884237 ...
1
vote
1answer
94 views

selinux in enforcing mode

I do test driven development where all my APIs are tested with a batch of tests. Initially, I ran the tests in ‘permissive’ mode in selinux. So, I decided to enable selinux to ‘enforcing’ mode. ...
2
votes
3answers
1k views

selinux Missing type enforcement (TE) allow rule

When I run my FTP test to test for full functionality, I'm concerned on why am I getting an avc denial error on such a popular command, such as 'mkdir'? Here is the AVC denial message: type=AVC msg=...
3
votes
2answers
4k views

selinux avc: denied issue

I just setup a web hosting server with selinux in permissive mode, meaning it's unsecured but writing issues to the message log file. Once I have fixed all the avc: denied errors, I will put the ...
1
vote
1answer
1k views

ProFTPd and SELinux: mkdir Permission denied

I have a ProFTPd server on Centos 6.3 with SELinux Enforcing. My users are virtual users in a flat file. The users are chrooted to directories mounted via NFS. I've already set the following policy:...
0
votes
1answer
46 views

Download file without disabling selinux

I am developing a site in PHP on Linux Server where I need to download a file from Windows Server to Linux Machine. I can do it with Some Changes in SeLinux or setting some properties on it, i.e.: % ...
0
votes
1answer
599 views

Lighttpd fails with 403 - Forbidden with SELinux enabled

I've setup a CentOS 6.3 box with lighttpd, php-fpm and I can server both static files and PHP files with SELinux enabled if I leave the lighttpd home directory set to the default (/var/www/lighttpd). ...
0
votes
1answer
111 views

After trying to remove SELinux, system doesn't start; shows error of “unable to connect to system bus”

I had SELinux installed on my system which actually was a bit annoying. I tried to remove it. After that my system is unable to start. The error that is showing up is: unable to connect to system ...
2
votes
1answer
197 views

How to run selinux sanbdox with access to /dev/urandom

I'm trying to run my application inside an SELinux sandbox. My application needs access to /dev/urandom, and the default sandbox policy does not allow that. What is a simple method to allow my ...
0
votes
1answer
4k views

Change unconfined_u to system_u is failing [duplicate]

I've got a file on my apache/linux server. ls -Z gives: drwxr-xr-x. apache apache unconfined_u:object_r:httpd_sys_rw_content_t:s0 localization.smicloud.org I need to change unconfined_u to ...
-1
votes
1answer
39 views

if I'm only using a server to host webpages, should I be using SELINUX? [duplicate]

On my server, I have static and dynamic websites. Yes there are api links, but they aren't exactly open to the public. When is it appropriate to SELINUX? would this be an appropriate example of a good ...
0
votes
2answers
2k views

sshd[4344]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument?

OpenSSH_5.8p1, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 selinux-policy-2.4.6-338.el5 pam-0.99.6.2-12.el5 SELinux is running in permissive mode: # sestatus SELinux status: enabled ...
0
votes
1answer
1k views

Trying to get Apache and nodejs to play nice together, getting “setsebool: SELinux is disabled.”?

I am running Ubuntu, and an Apache server. I wanted to try out nodejs, and I wanted to run it through a virtualhost on Apache. I read this article and tried to follow the instructions: http://...
0
votes
2answers
716 views

PHP Fatal error: date(): Timezone database is corrupt

I installed wordpress to CentOS from EPEL: yum install wordpress And it can only work if I manually disable SELinux. Otherwise I see this error: PHP Fatal error: date(): Timezone database is ...
1
vote
4answers
2k views

Selinux blocks wordpress in CentOS 6.3

I installed wordpress 3.5 to CentOS 6.3 using command: yum install wordpress and started httpd. Now I can see the following error in apache log: PHP Fatal error: require_once(): Failed opening ...
1
vote
1answer
490 views

openssh-lpk - Failed to get default SELinux security context for ldapuser

I'm trying to setup a ssh server with hardened-gentoo sources openssh (with openssh-lpk, which is the ldap flag on gentoo I think) and selinux enabled. On the Ldap-Server I have added an user "...
0
votes
3answers
821 views

restrict root access for certain files or filesystems

I want to store files for my users on encrypted filesystems. Every user would have his own filesystem with his own key. The user is able to log in to the system and mount his filesystem. When they are ...
1
vote
1answer
1k views

How to allow cron to send an email attachment?

SELinux is preventing cron from attaching a log file in the email with the following error: notice kernel [ 7148.923034] type=1400 audit(1359466501.857:5): avc: denied { read } for pid=3182 ...
0
votes
1answer
1k views

HOW do I get enforcing SElinux and postfix with custom milter to work?

I have an IPv4 setup of postfix on RHEL6 with SElinux in enforcing mode. All my attempts at incorporating opendkim fails miserably unless I leave enforcing mode. The errors I get when SElinux is ...
3
votes
1answer
632 views

Is there a way to share via SMB a filesystem mounted via NFS without disabling SElinux?

I have two CentOS hosts. The first is NAS and the second one is a diskless SMB server. The NAS server share folder via NFS and secure Ethernet connection with SMB server. SMB server shares content to ...
1
vote
1answer
384 views

Scientific Linux: soft lockup on quad opteron system

After an impressive uptime of 550 days without trouble our quad opteron system turned into a corrupted system a few days after I mounted an nfs-share from a FreeNAS-box. Ongoing sessions remained ...