NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

1
vote
1answer
892 views

SElinux on Debian Jessie missing default policy

I want to enable SElinux on Debian Jessie. In order to do this, I followed the guide on https://wiki.debian.org/SELinux/Setup. However, when I run the apt-get command, the selinux-policy-default ...
1
vote
1answer
633 views

SELINUX blocking php-fpm and nginx working together?

I'm having some issues with SELINUX. When trying to visit my website I get 403 forbidden from nginx and the server pops up with an error and says to use grep NGINX /var/log/audit/audit.log | ...
1
vote
3answers
2k views

Zabbix server SELinux policy

I have a Zabbix server running on a RHEL 7 box and when I use the web front end (on the same box) it says Zabbix server is not running. If I disable SELinux and change nothing else, the web front end ...
1
vote
2answers
4k views

LDAP user authentication on CentOS 7: Permission denied

I configured LDAP on CentOs 7 and now I'm trying to configure external user authentication. Browsing I found this: https://www.centos.org/docs/5/html/Deployment_Guide-en-US/s1-ldap-pam.html that is ...
1
vote
1answer
378 views

SELinux policy issue

As qemu & KVM are working fine with SELinux out of the box I'd like to enable SELinux to improve guest isolation on my CentOS 6 server. The problem is that I'm using a 3rd parity virtualization ...
1
vote
1answer
620 views

Why can't I shutdown running kvm instance?

I have running kvm instance: =# virsh list --all Id Name State ---------------------------------------------------- 2 debian-test running When ...
1
vote
1answer
311 views

vsftpd + vitual users + selinux

I can't make vsftpd to work and it is driving me crazy. The virtual users can connect, but they can't upload files or create folders. I hope someone can help me. I get this error in the ftp client: ...
1
vote
1answer
665 views

pure-ftpd auth blocked by SELinux

First, my setup. I'm using CentOS 6.4 and I installed pure-ftpd (plus the SELinux module) from the EPEL repositories : > rpm -q pure-ftpd pure-ftpd-selinux pure-ftpd-1.0.30-1.el6.x86_64 pure-ftpd-...
1
vote
1answer
1k views

ProFTPd and SELinux: mkdir Permission denied

I have a ProFTPd server on Centos 6.3 with SELinux Enforcing. My users are virtual users in a flat file. The users are chrooted to directories mounted via NFS. I've already set the following policy:...
1
vote
1answer
381 views

Scientific Linux: soft lockup on quad opteron system

After an impressive uptime of 550 days without trouble our quad opteron system turned into a corrupted system a few days after I mounted an nfs-share from a FreeNAS-box. Ongoing sessions remained ...
1
vote
1answer
913 views

Centos 6.3 PERL CGI selinux file read access

I have a CGI script called index.cgi It is trying to read a log file called 10.128.0.242.2012.sep.20.downloaded.txt under the path /var/log/trafcount/ It appears that it is being blocked by selinux. ...
1
vote
3answers
3k views

Why isn't my cronjob running?

I have a cronjob in /etc/cron.d/mycron that looks like this: 0 3 * * * apache php /path/to/my/script.php In the same file there are other cronjobs begin run as root and other users (which ...
1
vote
1answer
488 views

What's preventing the Apache user making outbound connections?

curl http://example.com data retrieved ok sudo -u apache curl http://example.com 20 seconds later curl: (7) couldn't connect to host What would cause this, and how can I change it? I'm running ...
1
vote
3answers
2k views

How do I secure my OpenVZ host node?

I'm running a server using OpenVZ for a few websites. Nothing in HN except for sshd. A VM for Varnish, a VM for MySQL and a few VMs each for one website (running Apache/PHP). Now I'd like to secure ...
1
vote
2answers
834 views

Selinux: Managing ports; Semanage command not found

I'm having trouble configuring SELinux to allow sending mail. Reading the SELinux documentation I've found I can manage ports via the semanage command, but the command can't be found. Is there ...
1
vote
2answers
2k views

How to secure JBoss application server using SELinux

I want to secure RedHat 5.4 application server by SELinux (targeted policy) and have several questions 1, where can i get SELinux sources (/etc/selinux//src/policy/)There seems to be no such package ...
1
vote
2answers
3k views

MySQL tmpdir on /dev/shm with SELinux

On RHEL5, I have a small MySQL database that has to write temp files. To speed up this process, I would like to move the temporary directory to /dev/shm by putting the following line into my.cnf: ...
1
vote
1answer
12 views

SELinux rules in CentOS 7 with Samba and SSSD on Kerberos Ticket generation

I've built a simple File Server with Samba and Netatalk running on CentOS 7.2. Everything is working as expected except for SELinux that's denying Samba to authenticate due to a policy of denying ...
1
vote
1answer
26 views

Allow SELinux, Nginx to read local file and make outbound connection

I am a new admin to a server which uses CentOS 7, nginix and php-fpm. There is a web form that needs to read a local file (prod.pem) and then make an outbound connection to either: gateway.push....
1
vote
1answer
32 views

Why won't apache allow symbolic links, with SELinux?

I have a simple scenario: I want to symlink /home/leonard/apache/sandbox/markdown to /home/leonard/github/markdown-editor, so that the markdown-editor can be viewed from my browser. I setup the link ...
1
vote
1answer
57 views

Change selinux context for TLS cacert.pem

I need to make /etc/pki/CA/certs/cacert.pem have the same context as all the other files in /etc/pki: system_u:object_r:cert_t:s0 Tried restorecon -vR /etc/pki and semanage fcontext but the file ...
1
vote
1answer
45 views

selinux mls ssh getting denied dyntransition - login failure

I am trying to learn SELinux and going though the Red Hat documentation for RHEL 7. I came upon the documentation for Multi Layer Security (MLS) and wanted to try it, so I set SELINUXTYPE=mls and ...
1
vote
2answers
617 views

Permission denied with Openshift PersistentStorage on GlusterFS

I'm trying to use OpenShift with PersistentStorage on a GusterFS cluster. I'm starting one of the default templates : mysql-persistent I've installed a GlusterFS cluster and create a volume ...
1
vote
1answer
115 views

iptables outgoing default policy is accept, but some ports appear blocked

I'm new to servers and iptables. I have a web app (happens to be bugzilla) running on my Centos 6.7 apache/httpd server, and it attempts to connect out to the web (updates.bugzilla.org) via port 80. ...
1
vote
1answer
107 views

SELinux preventing Fail2Ban from emailing notification via msmtp

I have msmtp as a null client connecting to my AWS SES account for SMTP, delivering alerts such as cron, monit and soon hopefully Fail2Ban to my email addresses. However, Fail2Ban isn't playing ball, ...
1
vote
1answer
72 views

Log/Audit everything allowed by SELinux

I'm profiling some proprietary software to construct a set of permission requirements and SELinux policies to allow it to install and run on Oracle Linux (or any RHEL derivative). I'm running SELinux ...
1
vote
1answer
439 views

SELinux Permissive enabled; httpd error reporting

I kept getting the following notice in apache /var/log/messages and many others same messages : kernel: type=1400 audit(1422862414.790:3222): avc: denied { getattr } for pid=2484 comm="deliver" path="...
1
vote
2answers
656 views

nginx suddenly redirecting everything to 403 page, can this be debugged or traced?

I'm not sure what happened to my nginx install. Suddenly all page requests are being redirected to the 403 page. Yesterday I tried to add a user agent to block, restarted service from that point ...
1
vote
1answer
109 views

selinux, file not matching file_contexts.local

semanage fcontext -a -t puppet_etc_t "/etc/puppet/environments(/.*)?" cat /etc/selinux/targeted/contexts/files/file_contexts.local # This file is auto-generated by libsemanage # Do not edit directly....
1
vote
1answer
2k views

svn: Can't open file '/var/www/svn/repo/db/txn-current-lock': Permission denied

On Fedora os, I have problem to access SVN Repo and commit via HTTP. Here is my config file /etc/httpd/conf.d/subversion.conf LoadModule dav_svn_module modules/mod_dav_svn.so LoadModule ...
1
vote
1answer
627 views

SELinux for RHEL not persistant after reboot

So in the Red Hat exam they want you to use SELinux. If for example you install vsftp, then do setsebool -P ftp_home_dir=1 or setsebool -P ftp_home_dir on to allow the users on the server to access ...
1
vote
1answer
1k views

How do I fix this dovecot SELinux error in audit.log on CentOS?

I'm getting these SELinux errors in /var/log/audit/audit.log for dovecot. type=USER_AUTH msg=audit(1404794536.249:100679): user pid=28375 uid=0 auid=0 ses=2700 subj=unconfined_u:system_r:...
1
vote
1answer
537 views

SELinux access denied error for bash scripts triggered from perl-cgi script

I have a automation framework which use Perl-CGI for running scripts at server. As we have SELinux enabled I am getting access denied errors when the script try to run a bash script. Below is the ...
1
vote
1answer
131 views

Do linux security modules (LSM) run on virtual server (vServer)? [closed]

I have a vServer for 10 EUR/month from 1und1 and I know that it is not a dedicated machine (meaning I have less control). I know that I can use some the system as root, yet the kernel is untouchable. ...
1
vote
1answer
2k views

Configure SElinux to allow rsync from a remote machine

I've set up a Debian machine with SElinux and except rsync from a remote machine everything works fine. I already created some module with additional rights using audit2allow, and now all errors in ...
1
vote
1answer
664 views

SElinux process killed while trying to set boolean

I've got a strange problem. I can not allow apache to connect to database at my CentOC 6.4 box: [root@centos6 ~]# setsebool -P httpd_can_network_connect on Killed [root@centos6 ~]# sestatus -b | grep ...
1
vote
2answers
657 views

Redhat: How to create a new role with SELinux?

I can figure out how to map a SELinux user to an existing role, but how do I create new roles? I'm looking to create a restricted admin role for my box.
1
vote
1answer
153 views

How to match selinux rules/transitions/labels/etc to modules

I need to match running/loaded selinux rules/transitions/labels/etc to the selinux policy modules where they are defined (semodules -l). I need this because I want to study some selinux policy modules ...
1
vote
1answer
3k views

Configure selinux to allow snmpd to read to a custom location

I have snmpd executing a script under /custom/location/myscript.sh. If I disable selinux all works well. If I enable selinux it stops working and if I do an audit2why I see the following: type=AVC ...
1
vote
1answer
302 views

SELinux Preventing Apache Start

When running in strict mode, SELinux would not let me start HTTPD since my mod_jk.so module was copied from an external server. I copied mod_jk.so externally since I couldn't find the package to ...
1
vote
1answer
93 views

selinux in enforcing mode

I do test driven development where all my APIs are tested with a batch of tests. Initially, I ran the tests in ‘permissive’ mode in selinux. So, I decided to enable selinux to ‘enforcing’ mode. ...
1
vote
2answers
3k views

selinux permissive and type targeted

i am running centos 6.2 recently i noticed that apache was running with selinux enabled # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # ...
1
vote
1answer
37 views

List all files with specified selinux context

How do I list all the files with specific selinux context such as - 'system_u:object_r:svirt_image_t:s0:c332,c575' etc ??
1
vote
1answer
3k views

OpenVPN up directive not working

I'm having trouble setting up OpenVPN on my server running CentOS 6.2. I have used OpenVPN on this server before and it worked (although that was with Ubuntu, now I'm using CentOS). I just reformatted ...
1
vote
2answers
3k views

CentOS - Percona MySQL - Not Reading /etc/my.cnf

I've compiled Percona 5.5 on my CentOS 6.1 server and it starts fine, however it doesn't appear to be reading my /etc/my.cnf file. # In /etc/my.cnf character_set_server = utf8 collation_server = ...
1
vote
2answers
655 views

How do I enable SELinux when booting a ramdisk from a CD/DVD?

I have a bootable DVD which boots the same Kernel as the Hard Drive (which uses SELinux). I have copied /etc/selinux and all kernel modules to my ramdisk, and have tried various combinations of ...
1
vote
1answer
257 views

Disable permissive SELinux setroubleshoot browser notices?

I'm running CentOS 5.4 with SELinux in permissive mode. I still get setroubleshoot browser notices in the taskbar. How do I turn these off without fulling disabling SELinux?
1
vote
1answer
624 views

SElinux in ubuntu

Has anyone installed SW Linux in Ubuntu? what were your results? does it come with all the same default rules that the Redhat installation does? I like the security of SE linux, but I have a ...
1
vote
1answer
2k views

mod_fcgid + Python + Apache 2.2 / RHEL 5 : output to error_log, not browser

I'm trying to get a Django + mod_fcgid setup working (mod_wsgi is tricky as I have a statically-linked Python. Don't ask.) While this was trivial on my Mac OS X development box, getting it running on ...
1
vote
0answers
12 views

xdebug remote centos host from mac

I have a server running CentOS7, PHP7.0.7 with php-fpm, and SELinux. I am trying to debug a PHP script running on that server. And I have a Mac machine that runs PHPstorm where I intend to do the ...