NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

1
vote
2answers
2k views

rsyslog-mysql on CentOS 5.3 does not have permission to access the mysql.sock

After installing and configuring both MySQL and rsyslog with the mysql extensions I get the following error in /var/log/messages: rsyslogd:db error (2002): Can't connect to local MySQL server ...
0
votes
3answers
296 views

restrict root access for certain files or filesystems

I want to store files for my users on encrypted filesystems. Every user would have his own filesystem with his own key. The user is able to log in to the system and mount his filesystem. When they are ...
0
votes
1answer
53 views

PHP Not running on specific directories [closed]

Ok. This is a pretty weird error: I made a folder named 'hello' at /etc/apache2/sites-enabled/ with hello.php. Then i created an Alias that told /hello would go to /etc/apache2/sites-enabled/hello. ...
0
votes
2answers
364 views

enabling CentOS selinux

I installed Centos 5.5 and by deafult SElinux was disabled. I did changes in /etc/selinux/config and now it looks like this. SELINUX=enforcing SELINUXTYPE=targeted SETLOCALDEFS=0 and rebooted ...
0
votes
2answers
259 views

RHEL6: Selinux not logging AVC denial messages

I'm trying to configure a set of lockdown rules. My approach is to start with a restricted user, and use audit2allow messages to selective add permissions. My problem is that I don't see the expected ...
0
votes
3answers
87 views

proftpd is accessing my.cnf

I use proftpd for virtual FTP hosting with MySQL. I've started writing fine-grained SELinux policies and found that it's trying to access my.cnf files. Question is what for and why? type=AVC ...
0
votes
1answer
306 views

Lighttpd fails with 403 - Forbidden with SELinux enabled

I've setup a CentOS 6.3 box with lighttpd, php-fpm and I can server both static files and PHP files with SELinux enabled if I leave the lighttpd home directory set to the default (/var/www/lighttpd). ...
0
votes
1answer
392 views

Do I need to chroot BIND 9 if I'm using AppArmor? [duplicate]

Possible Duplicate: bind9 in a chroot jail - necessary or not? I'm redoing my external dns servers and thinking about skipping chroot this time. And using apparmor or selinux as an ...
0
votes
1answer
354 views

SELinux Contexts

I am configuring Apache\PHP and noticed Apache complaining about permissions with the php shared object. Starting httpd: httpd: Syntax error on line 206 of /etc/httpd/conf/httpd.conf: Cannot load ...
0
votes
4answers
2k views

How does SELinux affect the /home directory?

I'm migrating a CentOS 5.3 system from MySQL to PostgreSQL. The way our machine is set up is that the biggest disk partition is mounted to /home. This is out of my control and is managed by the ...
0
votes
1answer
70 views

SELinux blocking sudo from zabbix_agentd

I have a custom user parameter for Zabbix that calls a hardware RAID CLI tool (arcconf / megacli) and checks if any arrays are degraded. Since these tools are root-only, I have configured sudoers to ...
0
votes
2answers
117 views

Check my Kernel for SELinux Support

I want to know if the kernel i am running has support for SELinux. What commands would i use to check this ?
0
votes
2answers
235 views

selinux Missing type enforcement (TE) allow rule

When I run my FTP test to test for full functionality, I'm concerned on why am I getting an avc denial error on such a popular command, such as 'mkdir'? Here is the AVC denial message: type=AVC ...
0
votes
1answer
2k views

redhat Apache fast-cgi selinux permissions

My apache installation is running php as fastcgi, and the virtual hosts are pointing to /home/*/public_html. and the fastcgi are home/*/cgi-bin/php.fcgi the public_html setup with selinux was: ...
0
votes
2answers
619 views

CGI script fails to open a socket (CentOS 6.2/Apache2)

I have a webserver running CentOS 6.2 and the latest Apache from repositories. Todey I encountered a problem when running an executable program via CGI on Apache. The program is supposed to connect to ...
0
votes
2answers
442 views

Selinux/MySQL permissions issue in a new iSCSI disk: not allowed default_t context

I've a server with MySQL installed and running, and an iSCSI disk (with multipath) connected and running OK. The iSCSI disk uses /emc as mountpoint. My problem is when I move MySQL datadir to a new ...
0
votes
2answers
1k views

Apache curl via HTTP proxy

I am trying to get PHP to execute a curl connection to another server. To connect to the server, we need to go via a proxy. Within bash, we have set the env-variable http_proxy and this works ...
0
votes
1answer
31 views

SELinux problems running Expect script from fail2ban

I have an Expect script that works fine if I run it manually, but fails when run as an action from Fail2ban. The error message is as follows: spawn /usr/bin/telnet 192.168.242.1 The system has no ...
0
votes
1answer
4k views

SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0

I kept getting the following notice in apache log when I start apache http server 2.2: SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0 even though I disabled ...
0
votes
2answers
2k views

Selinux in permissive mode, ssh key based auth and locked account

I noticed something weird regarding ssh key based login and selinux in permissive mode. Let me introduce you the setup: The server is an updated Centos 6.4 x86_64. We create user without a password ...
0
votes
2answers
1k views

Disable SeLinux permanently

I am running a virtualbox CentOS 6.4 (64 bit) server with Cobbler service. One of the steps is to disable SeLinux in order to prevent a python error when running service cobblers start. If I run ...
0
votes
1answer
640 views

ProFTPd and SELinux: mkdir Permission denied

I have a ProFTPd server on Centos 6.3 with SELinux Enforcing. My users are virtual users in a flat file. The users are chrooted to directories mounted via NFS. I've already set the following ...
0
votes
1answer
913 views

Change unconfined_u to system_u is failing [duplicate]

I've got a file on my apache/linux server. ls -Z gives: drwxr-xr-x. apache apache unconfined_u:object_r:httpd_sys_rw_content_t:s0 localization.smicloud.org I need to change unconfined_u to ...
0
votes
2answers
1k views

sshd[4344]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument?

OpenSSH_5.8p1, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 selinux-policy-2.4.6-338.el5 pam-0.99.6.2-12.el5 SELinux is running in permissive mode: # sestatus SELinux status: enabled ...
0
votes
1answer
746 views

Trying to get Apache and nodejs to play nice together, getting “setsebool: SELinux is disabled.”?

I am running Ubuntu, and an Apache server. I wanted to try out nodejs, and I wanted to run it through a virtualhost on Apache. I read this article and tried to follow the instructions: ...
0
votes
1answer
611 views

HOW do I get enforcing SElinux and postfix with custom milter to work?

I have an IPv4 setup of postfix on RHEL6 with SElinux in enforcing mode. All my attempts at incorporating opendkim fails miserably unless I leave enforcing mode. The errors I get when SElinux is ...
0
votes
1answer
261 views

Unable to change user in security context of symlink

I have created a few symbolic links to replace some broken links in /etc/pam.d. The original links have system_u as the user. The newly created ones somehow have unconfined_u as the user. I am not ...
0
votes
1answer
75 views

Why do I have to do a setenforce 0 to cluster tomcat on Scientific Linux using mod_proxy

Why do I have to do a setenforce 0 to cluster tomcat on Scientific Linux using mod_proxy I am using Scientific Linux release 6.2 and trying to get mod_proxy working with httpd and tomcat. I want ...
0
votes
2answers
185 views

selinux permissive and type targeted

i am running centos 6.2 recently i noticed that apache was running with selinux enabled # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # ...
0
votes
2answers
129 views

Centos 6.3 PERL CGI selinux file read access

I have a CGI script called index.cgi It is trying to read a log file called 10.128.0.242.2012.sep.20.downloaded.txt under the path /var/log/trafcount/ It appears that it is being blocked by selinux. ...
0
votes
1answer
60 views

change selinux property of a file? [duplicate]

Possible Duplicate: Permission denied in vhost document root Apache cant process my files due to forbidden error, searching resulted that it might be because of selinux, how can I change ...
0
votes
1answer
215 views

SELinux: allow Zend webapp to read/write to tree outside htdocs

I have a Zend web application running on a CentOS server with SELinux running in permissive mode (i.e. access-control decisions are recorded in /var/log/audit/audit.log but not enforced). The ...
0
votes
3answers
557 views

Apache Documentroot access forbidden

Running Arch Linux I am trying to get apache to use /www (not /var/www) as DocumentRoot. /www is a softlink to /home/user/www. However, I keep getting an "Access Forbidden" error. The / and /home ...
0
votes
1answer
868 views

How do I configure SELinux on Centos 6 for cobbler?

I have installed and configured Cobbler on my centos 6 "installation server". From what I think I did all the configurations I'm supposed to. The installation was performed with my own customized ...
0
votes
1answer
365 views

Does semodule -i need to be run after every SELinux policy update?

On RHEL and CentOS servers, when the selinux-policy-* RPM packages receive an update, is it always necessary to manually reload any custom modules I have built? When I see an update to ...
0
votes
1answer
670 views

What does “Invalid AVC allowed in current policy” mean?

I was looking into my selinux alert logfile and running over multiple entries labeled **** Invalid AVC allowed in current policy *** I understand that this signals a problem (on read or getattr ...
0
votes
4answers
124 views

FC14 available TCP ports?

I am installing an application on Fedora Core 14 that uses a lot of sockets (eight of them) for TCP communication between various servers, all running on the same localhost. I've been trying to find ...
0
votes
1answer
2k views

Centos+Apache+Phusion+REE=FAIL

I have been trying to get Phusion Passenger running on 5.6 for the last couple of days with no luck. Initially, I started with Ruby 1.9.2 under RVM since the default Ruby on RHEL-based distros is ...
0
votes
2answers
1k views

Give apache user permission to read directory

UPDATE: Saw this question: Why can't my apache process write to my world-writeable file? Could this be SELinux related, currently /etc/sysconfig/selinux is setting to permissive: ...
0
votes
1answer
173 views

kernel: audit(1298407016.926:258): avc: denied

My Server is showing following text in its log file. kernel: audit(1298407016.926:258): avc: denied { name_connect } for pid=13945 comm="httpd" dest=21 scontext=system_u:system_r:httpd_t:s0 ...
0
votes
1answer
835 views

Cannot write log file 'ffmpeg2pass-0.log' for pass-1 encoding: Permission denied

Our PHP application is installed as 'root' on a Redhat5/CentOS system at: /var/www/html/beta/ After disabling SELINUX in order to allow these scripts to execute other programs on the system - ...
0
votes
1answer
369 views

SELinux has denied sendmail access to potentially mislabeled file(s)

Has everyone every recieved this SELinux error? SELinux has denied sendmail access to potentially mislabeled file(s) (2F746D702F746D70664A6163564B62202864656C6574656429) What is with that ...
0
votes
1answer
573 views

How can I start Fedora Directory Service with SELinux enabled?

I just did a fresh base install of fedora 12, and did a yum install 389-ds. I went through the included setup script (setup-ds-admin.pl) and everything started fine and was working normally. I could ...
0
votes
1answer
274 views

Can’t write to a file owned by the process with correct pemissions (may be selinux related)

I've got bind setup on a fresh install of Ubuntu Karmic I am trying to send bind some updates, but it fails with this message appearing in the logs kernel: [254421.299955] type=1503 ...
0
votes
1answer
818 views

Slackware and SELinux

I would like to learn and play with SELinux on Slackware, my distro of choice. The kernel already includes SELinux code, so that is not a problem. Slackware does not ship with PAM, and I would prefer ...
0
votes
1answer
30 views

Audit says nothing to do, yet puppet won't run with SELinux enforcing

I'm determined to get my puppet master running with SELinux set to enforcing. If I make it permissive, it runs fine. I'm on RHEL 7, with systemd, apache2, passenger 4, and puppet 3. I've gone ...
0
votes
0answers
33 views

Setting up muli-project web development server

I'm trying to set up a development server that will be used for several (web) projects by different teams (consisting of different people, some of which may be involved with more than one project). I ...
0
votes
1answer
66 views

httpd (WordPress) gets avc denied write (SELinux)

I'm getting following message in my /var/log/audit/audit.log: type=AVC msg=audit(1402615093.053:68): avc: denied { write } for pid=799 comm="httpd" name="php" dev="xvda1" ino=8667365 ...
0
votes
0answers
25 views

SELinux, complains constantly about rm files in /tmp/

SELinux on my server is constantly flooded by messages like this: Apr 16 00:27:05 mail setroubleshoot: SELinux is preventing the rm from using potentially mislabeled files (/tmp/.font-unix). For ...
0
votes
0answers
55 views

Reading home files permission: Policy constraint violation

I want to confine a certain user to be able to bind a node.js server to a certain port. That bit is working. What isn't working is allowing said user to access his own files. audit2allow is telling ...