Questions tagged [selinux]
NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.
692
questions
2
votes
2
answers
4k
views
Opening a firewall port in RHEL 6.8
I am struggling to determine if a specific port is open according to the firewall in Redhat 6.8
I want to open port 2222.
I have tried the following:
system-config-firewall, running as sudo , and I ...
- 121
2
votes
1
answer
5k
views
CentOs 7 & SELInux: User cant write in the Webroot of Apache
My user can't add, modify or delete apache/php files without sudo.
My enviroment is:
CentOS Linux release 7.2.1511
SELinux status: enabled
Current mode: ...
- 161
2
votes
2
answers
6k
views
Allowing httpd to run a bash script in /usr/bin/
Migrating a system from CentOS6 to RHEL7 with SELinux running Enforced. A php script makes a call to /usr/bin/processdata.sh to generate some data behind the scenes. This worked fine with the old ...
- 799
2
votes
5
answers
16k
views
Zabbix server SELinux policy
I have a Zabbix server running on a RHEL 7 box and when I use the web front end (on the same box) it says Zabbix server is not running.
If I disable SELinux and change nothing else, the web front end ...
- 41
2
votes
1
answer
994
views
SElinux sandbox fails to start from systemd service
I have a server that runs user submitted code, for evaluation.
I wrote a systemd service that starts a python application, that application then run the submitted code using SElinux sandbox.
The ...
- 123
2
votes
1
answer
2k
views
How to configure SELinux to allow apache to run git
I have a CentOS 6 server and I'm trying to get the apache web server to run git pull in a directory.
The php file is simply:
<?php
shellexec('cd /var/www/vhosts/domain;git pull');
However, ...
- 217
2
votes
2
answers
2k
views
Is it possible to persist selinux port statements across reboots?
Currently we need to run something like this every time we start up:
/usr/sbin/semanage port -a -t memcache_port_t -p tcp ${special-snowflake-port}
It would be great if we could persist this across ...
- 621
2
votes
2
answers
6k
views
Disable SeLinux permanently
I am running a virtualbox CentOS 6.4 (64 bit) server with Cobbler service. One of the steps is to disable SeLinux in order to prevent a python error when running service cobblers start. If I run ...
- 515
2
votes
1
answer
2k
views
Adding to existing policy in selinux
I just created a custom policy and did the semodule -i test.te.
I reran all my tests after a few days and I noticed there were additional AVC denials in the audit.log.
I want to add the new stuff ...
- 361
2
votes
2
answers
3k
views
How to allow unprivileged apache/PHP to do a root task (CentOS)
I am setting up a sort of personal dropbox for our customers on a CentOS 6.3 machine. The server will be accessible thru SFTP and a proprietary http service base on PHP. This machine will be in our ...
- 251
2
votes
3
answers
743
views
Can Solaris RBAC roles be ported to Linux using SElinux only?
We are migrating an application from Solaris to Linux and the main user is allowed, through the use of RBAC roles, to run a few system commands like svccfg/svcadm (chkconfig on redhat).
Is it ...
user126330
2
votes
2
answers
5k
views
Apache curl via HTTP proxy
I am trying to get PHP to execute a curl connection to another server. To connect to the server, we need to go via a proxy.
Within bash, we have set the env-variable http_proxy and this works ...
- 23
2
votes
3
answers
4k
views
Postfix master.pid ExecStartPre with exit status 255
When I restart the Postfix daemon on my Rockylinux server, It happen an restorecon error who don't avoid the starting of the service but still an error :
● postfix.service - Postfix Mail Transport ...
- 21
2
votes
1
answer
2k
views
Linux "ls -Z" shows question mark for security context
I've got some files that aren't being served on a site, and assuming it was a permissions issue I ran ls -Z but keep seeing ? in place of the security context:
-rw-rw-r-- pete pete ? ...
- 303
2
votes
1
answer
1k
views
What is Apache trying to do with port 80 that SELinux is blocking?
I have a small web server (CentOS 8) that runs a small php & mysql app. It also runs runs Nagios, BIND, and Postfix running as a secondary MX.
Everything seems to "work", and I've never ...
- 3,469
2
votes
2
answers
1k
views
MongoDB won't run if dbPath is symlinked
I have installed MongoDB 4.0.4 from the official repo. I followed these instructions. My OS is CentOS 7 and SELinux is in enforcing mode. If I use a dbPath value which is a symlink to another ...
- 143
2
votes
1
answer
2k
views
How to restrict root to access a directory used by other user with selinux
I want to restrict the root to access a folder/directory which is created by another user.So that only that user can access that folder not even root. Is there any selinux configuration to do so this ...
- 21
2
votes
3
answers
1k
views
centos7 xfs lmv cloning on smaller device
I'm going to repropose a question posted on stackoverflow a week ago, I'm sorry if someone found this spam but I still need help to solve this issue. I thought it could be useful also for others.
...
- 33
2
votes
1
answer
2k
views
View, compare, and copy SELinux configurations between machines?
I have two machines running the same JBoss and HTTPD setup. They started from the exact same install of RedHat 7 and the same process was followed to install everything on both machines.
On one ...
- 137
2
votes
1
answer
1k
views
Running logstash under SELinux
I want to run logstash as root to allow it to read all logs (granting it access to every log is very tiresome). However, I don't want it running amok on my server, I thought about constraining it ...
- 1,078
2
votes
1
answer
1k
views
SELinux preventing Fail2Ban from emailing notification via msmtp
I have msmtp as a null client connecting to my AWS SES account for SMTP, delivering alerts such as cron, monit and soon hopefully Fail2Ban to my email addresses. However, Fail2Ban isn't playing ball, ...
- 4,021
2
votes
1
answer
515
views
SELinux not enforcing apache write restrictions despite being enabled
Problem in a nutshell: SELinux does not protect files and directories labeled as httpd_sys_content_t from being written, deleted or changed when new/custom document root is created.
I have ...
2
votes
2
answers
1k
views
Selinux semanage delete or modify chain
I use on all my server port 24 for SSH. After change port i got error because Selinux block server SSHD restart
4 08:08:02 kvm452 sshd[18297]: error: Bind to port 24 on 0.0.0.0 failed: Permission ...
- 416
2
votes
2
answers
5k
views
How can I move /var/log/audit/audit.log to another partition
Fresh centos 6.5 with updates installed. We want to log auditd to a non persistent volume since we capture everything with splunk or logstash.
The destination dir is /mnt/ephemeral/audit/
# ls -l /...
- 376
2
votes
2
answers
2k
views
MySQL 5.6 and SELinux are arguing
CentOS 6.4(x64) / MySQL 5.6.10
Installed MySQL from source files and started it fine under it's original location (/var/lib/mysql). I moved everything to a different volume (/u0/mysql) and went ...
- 2,379
2
votes
1
answer
4k
views
Creating a public_html for a user on a Red Hat Linux Server
I'm just trying to make a public_html folder under my username on a Red Hat Linux Server
(and it's all been a bit of a headache).
I made the folder and set the permissions to 755.
I wasn't sure how ...
- 119
2
votes
1
answer
628
views
Gitolite3 over http selinux permissions
I'm trying to install gitolite3 on Centos6.4. It works, I can ssh and, after some trouble, I can also read, such as clone, through http and httpd. I am re-enabling selinux into permissive mode, that I ...
- 413
2
votes
1
answer
5k
views
Configure selinux to allow openldap on CentOS 6.4
I'm trying to run an OpenLDAP server on CentOS 6.4 with selinux enabled, but slapd is dieing as soon as it's started via /etc/init.d/slapd start. (init script reports OK; everything works fine after ...
- 1,024
2
votes
1
answer
738
views
What effect do the user and role labels have on a file in SELinux?
When running ls -dZ /, I get the following output:
system_u:object_r:root_t:s0
Can the user and role fields have any effect access permissions involving a file? Do they mean anything?
- 20.7k
2
votes
3
answers
1k
views
Unable to start SNMP in RHEL5 64-bit
I have installed net-snmp, net-snmp-utils and net-snmp-devel in my 64-bit Centos5 using yum.
The following are the packages I've installed:
net-snmp-devel-5.3.2.2-14.el5_7.1
net-snmp-utils-5.3.2.2-...
- 173
2
votes
2
answers
1k
views
Apache: Access denied to /
I have disabled selinux with:
setenforce 0
selinux=disabled
in /etc/selinux/config Does anyone knows if i have to label or chcon any dir to solve that error:
error [error] [client 127.0.0.1] (13)...
- 508
2
votes
1
answer
7k
views
selinux on RHEL6: httpd config. DocumentRoot [/path/does/exist] "does not exist"
I'm running a stock RHEL6 installation and have pointed my httpd DocumentRoot to /path/does/exist (it exists!). I've granted permission to the apache user and added what I thought should be the ...
- 95
2
votes
1
answer
4k
views
Create selinux context for systemd script?
I'm trying to create a systemd service that executes a custom script I wrote. It is just a backup script that I am using with a systemd timer. When I try to execute something simple in the systemd ...
- 23
2
votes
2
answers
884
views
Allow Samba and Podman to rw on same dir
I'm new to SElinux so I don't know much about how to use it. I want to run my Fedora Server using a samba share (already configured and working) and configured a podman container, mounting the same ...
2
votes
1
answer
2k
views
OpenVPN with PAM with systemd and SELinux
I am trying to set up an OpenVPN (2.4.9) server with PAM login on CentOS 8.2 and I am facing some strange issues.
Specifically, i can successfully athenticate if I start the server with the ExecStart ...
- 51
2
votes
1
answer
2k
views
SELinux with docker and traefik
I have a SELinux security problem on /run/docker.sock using traefik in docker.
docker ps works correctly, it's only a problem with traefik needing to map volume /var/run/docker.sock
Here is what I ...
- 141
2
votes
1
answer
966
views
Setting a port number inside my selinux module file
I'm trying to put together a small selinux module to further my understanding of selinux. I've defined a small daemon-like application type with its own port_type. The following code is a condensed ...
- 125
2
votes
1
answer
3k
views
Unable to access CentOS 7 Postgresql Server from another CentOS7 using PHP and PDO
The Beginning
Server 1 is my CentOS 7 production server. It contains Apache, ssh and a Postgresql database.
Server 2 is my CentOS 7 test server. It contains Apache, ssh and a test database.
Both ...
- 123
2
votes
1
answer
988
views
selinux mls ssh getting denied dyntransition - login failure
I am trying to learn SELinux and going though the Red Hat documentation for RHEL 7. I came upon the documentation for Multi Layer Security (MLS) and wanted to try it, so I set SELINUXTYPE=mls and ...
- 43
2
votes
2
answers
3k
views
SELinux - logrotate is not rotating NGINX logs
I am using CentOS, NGINX and Passenger to serve a Rails application.
I have SELinux activated, and have had a series of problems with logrotate.
I have been able to resolve most of the issues by ...
- 71
2
votes
1
answer
2k
views
SELinux: no audit errors but nginx permission errors
I try to isolate a SELinux problem with nging/munin. I see that error message in "/var/log/nging/error.log":
[crit] 8802#0: *55 connect() to unix:/var/run/munin/fcgi-html.sock
failed (13: ...
- 168
2
votes
1
answer
907
views
Why don't my domain transitions don't occur when the application binary is outside of the stardard binary directories?
I'm trying to set up a custom SELinux policy, but I'm having trouble getting the domain transitions to occur when the application binary is outside of the standard binary directories such as /bin, /...
- 121
2
votes
1
answer
303
views
Assign selinux context to the application without changing context of binary
Is there a way to assign custom SELinux context to the application despite the context that is assigned to it's binary?
- 4,634
2
votes
1
answer
2k
views
How to match selinux rules/transitions/labels/etc to modules
I need to match running/loaded selinux rules/transitions/labels/etc to the selinux policy modules where they are defined (semodules -l). I need this because I want to study some selinux policy modules ...
2
votes
3
answers
5k
views
SELinux causes "Permission denied" when starting lighttpd+fastcgi via upstart
I'm have trouble launching a lighttpd fastcgi python app via upstart. I can launch the app successfully using sudo lighttpd -D -f /path/to/lighttpd.conf and via su -c "lighttpd -f /path/to/lighttpd....
- 227
2
votes
1
answer
1k
views
how to enable selinux in kernel
I am working with the Linux -64 AMI on AWS. I am trying to get my mail server running on the box.
In an attempt to turn on SELinux I did
Edited /boot/grub/grub.conf and added selinux=1 to the end ...
- 267
2
votes
1
answer
1k
views
How to change MySQL data directory?
I want to place my databases in another directory, so I can store them in an ESB (elastic block storage, just a fancy name for a virtualized harddisk) together with my web-apps and other persistent ...
- 131
2
votes
2
answers
6k
views
MySQL tmpdir on /dev/shm with SELinux
On RHEL5, I have a small MySQL database that has to write temp files. To speed up this process, I would like to move the temporary directory to /dev/shm by putting the following line into my.cnf:
...
- 81
2
votes
1
answer
319
views
FAPolicyD overhead slowing down a server
We have a server with the Alma Linux 9.3 OS.
By default (as well as all current RHEL-like OSs) it has fapolicyd enabled.
There is also an application server (WildFly/JBoss/Java) running on that server....
- 193
2
votes
1
answer
1k
views
Timedatectl "Failed to parse bus message: Connection timed out" with systemd ExecPreStart while SELinux is enforcing
Using Oracle Linux 8.6 we're having an issue with timedatectl but only when it's run by systemd(239-58.0.1.el8_6.3) during ExecStartPre in a .service definition file and SELinux is set to Enforcing.
...
- 143