NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

0
votes
1answer
577 views

Change unconfined_u to system_u is failing [duplicate]

I've got a file on my apache/linux server. ls -Z gives: drwxr-xr-x. apache apache unconfined_u:object_r:httpd_sys_rw_content_t:s0 localization.smicloud.org I need to change unconfined_u to ...
0
votes
2answers
845 views

sshd[4344]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument?

OpenSSH_5.8p1, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 selinux-policy-2.4.6-338.el5 pam-0.99.6.2-12.el5 SELinux is running in permissive mode: # sestatus SELinux status: enabled ...
0
votes
1answer
692 views

Trying to get Apache and nodejs to play nice together, getting “setsebool: SELinux is disabled.”?

I am running Ubuntu, and an Apache server. I wanted to try out nodejs, and I wanted to run it through a virtualhost on Apache. I read this article and tried to follow the instructions: ...
0
votes
1answer
495 views

HOW do I get enforcing SElinux and postfix with custom milter to work?

I have an IPv4 setup of postfix on RHEL6 with SElinux in enforcing mode. All my attempts at incorporating opendkim fails miserably unless I leave enforcing mode. The errors I get when SElinux is ...
0
votes
1answer
168 views

Unable to change user in security context of symlink

I have created a few symbolic links to replace some broken links in /etc/pam.d. The original links have system_u as the user. The newly created ones somehow have unconfined_u as the user. I am not ...
0
votes
1answer
64 views

Why do I have to do a setenforce 0 to cluster tomcat on Scientific Linux using mod_proxy

Why do I have to do a setenforce 0 to cluster tomcat on Scientific Linux using mod_proxy I am using Scientific Linux release 6.2 and trying to get mod_proxy working with httpd and tomcat. I want ...
0
votes
2answers
127 views

selinux permissive and type targeted

i am running centos 6.2 recently i noticed that apache was running with selinux enabled # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # ...
0
votes
2answers
118 views

Centos 6.3 PERL CGI selinux file read access

I have a CGI script called index.cgi It is trying to read a log file called 10.128.0.242.2012.sep.20.downloaded.txt under the path /var/log/trafcount/ It appears that it is being blocked by selinux. ...
0
votes
1answer
54 views

change selinux property of a file? [duplicate]

Possible Duplicate: Permission denied in vhost document root Apache cant process my files due to forbidden error, searching resulted that it might be because of selinux, how can I change ...
0
votes
1answer
202 views

SELinux: allow Zend webapp to read/write to tree outside htdocs

I have a Zend web application running on a CentOS server with SELinux running in permissive mode (i.e. access-control decisions are recorded in /var/log/audit/audit.log but not enforced). The ...
0
votes
3answers
507 views

Apache Documentroot access forbidden

Running Arch Linux I am trying to get apache to use /www (not /var/www) as DocumentRoot. /www is a softlink to /home/user/www. However, I keep getting an "Access Forbidden" error. The / and /home ...
0
votes
1answer
823 views

How do I configure SELinux on Centos 6 for cobbler?

I have installed and configured Cobbler on my centos 6 "installation server". From what I think I did all the configurations I'm supposed to. The installation was performed with my own customized ...
0
votes
1answer
333 views

Does semodule -i need to be run after every SELinux policy update?

On RHEL and CentOS servers, when the selinux-policy-* RPM packages receive an update, is it always necessary to manually reload any custom modules I have built? When I see an update to ...
0
votes
1answer
566 views

What does “Invalid AVC allowed in current policy” mean?

I was looking into my selinux alert logfile and running over multiple entries labeled **** Invalid AVC allowed in current policy *** I understand that this signals a problem (on read or getattr ...
0
votes
4answers
124 views

FC14 available TCP ports?

I am installing an application on Fedora Core 14 that uses a lot of sockets (eight of them) for TCP communication between various servers, all running on the same localhost. I've been trying to find ...
0
votes
1answer
2k views

Centos+Apache+Phusion+REE=FAIL

I have been trying to get Phusion Passenger running on 5.6 for the last couple of days with no luck. Initially, I started with Ruby 1.9.2 under RVM since the default Ruby on RHEL-based distros is ...
0
votes
2answers
1k views

Give apache user permission to read directory

UPDATE: Saw this question: Why can't my apache process write to my world-writeable file? Could this be SELinux related, currently /etc/sysconfig/selinux is setting to permissive: ...
0
votes
1answer
166 views

kernel: audit(1298407016.926:258): avc: denied

My Server is showing following text in its log file. kernel: audit(1298407016.926:258): avc: denied { name_connect } for pid=13945 comm="httpd" dest=21 scontext=system_u:system_r:httpd_t:s0 ...
0
votes
2answers
1k views

Apache curl via HTTP proxy

I am trying to get PHP to execute a curl connection to another server. To connect to the server, we need to go via a proxy. Within bash, we have set the env-variable http_proxy and this works ...
0
votes
1answer
751 views

Cannot write log file 'ffmpeg2pass-0.log' for pass-1 encoding: Permission denied

Our PHP application is installed as 'root' on a Redhat5/CentOS system at: /var/www/html/beta/ After disabling SELINUX in order to allow these scripts to execute other programs on the system - ...
0
votes
1answer
317 views

SELinux has denied sendmail access to potentially mislabeled file(s)

Has everyone every recieved this SELinux error? SELinux has denied sendmail access to potentially mislabeled file(s) (2F746D702F746D70664A6163564B62202864656C6574656429) What is with that ...
0
votes
1answer
558 views

How can I start Fedora Directory Service with SELinux enabled?

I just did a fresh base install of fedora 12, and did a yum install 389-ds. I went through the included setup script (setup-ds-admin.pl) and everything started fine and was working normally. I could ...
0
votes
1answer
273 views

Can’t write to a file owned by the process with correct pemissions (may be selinux related)

I've got bind setup on a fresh install of Ubuntu Karmic I am trying to send bind some updates, but it fails with this message appearing in the logs kernel: [254421.299955] type=1503 ...
0
votes
1answer
769 views

Slackware and SELinux

I would like to learn and play with SELinux on Slackware, my distro of choice. The kernel already includes SELinux code, so that is not a problem. Slackware does not ship with PAM, and I would prefer ...
0
votes
0answers
6 views

SELinux, complains constantly about rm files in /tmp/

SELinux on my server is constantly flooded by messages like this: Apr 16 00:27:05 mail setroubleshoot: SELinux is preventing the rm from using potentially mislabeled files (/tmp/.font-unix). For ...
0
votes
0answers
24 views

Zabbix-server-mysql can't allocate shared memory - Access denied

I'm trying to run an instance of zabbix-server-mysql on Fedora 20, but Zabbix keeps saying that cant allocate shared memory space for history cache due to an Access Denied error. i'm sure that the ...
0
votes
0answers
17 views

Reading home files permission: Policy constraint violation

I want to confine a certain user to be able to bind a node.js server to a certain port. That bit is working. What isn't working is allowing said user to access his own files. audit2allow is telling ...
0
votes
1answer
60 views

RHEL SELinux blocking Apache access to PostgreSQL

I'm running a Django app that uses PostgreSQL. The server is running RHEL 6.5 with SELinux. I'm having an issue where the Django app can't connect to the DB, and I think it's because SELinux is ...
0
votes
1answer
56 views

My virtual users can't Chroot()

I'm configuring a Proftp server in a Fedora 20 Linux server. All my real users are loging in perfectly but not the case with the virtual users. Virtaul users are in the SQL table and mod_sql.c is ...
0
votes
1answer
15 views

VSFTPD - 0.00Kbyte/sec - intermittent

I can't get a good connection via FTP to my DigitalOcean server. I set it up following this guide. https://www.digitalocean.com/community/articles/how-to-set-up-vsftpd-on-centos-6--2 Symptoms: ...
0
votes
0answers
5 views

Apache: Pass phrase incorrect SSLPassPhraseDialog [duplicate]

On one of my servers I observe the following problem with SSL passphrase: some certs are passing it without asking for a password, while some others keep asking for it. I have set it up globally: ...
0
votes
1answer
157 views

Apache doesn't start: syntax error…DocumentRoot must be a directory

I read all the previous answer but I couldn't fix my problem.. I'm changing the server where my website is hosted and I'm setting again apache.. Now, after installing php, fail2ban, etc i have that ...
0
votes
1answer
139 views

Unable to start the Phusion Passenger - Cannot change the directory - Operation not permitted (errno=1)

I'm running Red Hat Enterprise Linux Server release 6.4 (Santiago) on Amazon EC2. I have installed Phusion Passenger via a gem. When I start httpd I have this error message in less ...
0
votes
0answers
58 views

Hidden 'neverallow' in selinux policy?

I intend to use 'enforce' selinux mode. First, i boot in permissive mode ( enforcing=0 in kernel cmdline ). After login in system, i collect all selinux policy violation from auditd logs and try to ...
0
votes
0answers
25 views

How to use run_init with processes in the background

I'm working on a CentOS 5.9 machine. There's a program that runs in the foreground instead of correctly forking a daemon. It's /etc/init.d/myprogram script has something like below: start() { ...
0
votes
1answer
51 views

google sitemap generator installation selinux

when i trying to install google sitemap generator i received this error Change security context of to system_u:object_r:httpd_modules_t install: WARNING: ignoring --context (-Z); this kernel is not ...
0
votes
0answers
44 views

RHEL6: Selinux execute rule not working

I want to configure a rule to allow a restricted user to execute 1 file (bash script) in /etc/init.d. I tagged this file as follows: -rwxr-xr-x. root root system_u:object_r:myappd_initrc_exec_t:s0 ...
0
votes
1answer
72 views

SELinux Preventing Apache Start

When running in strict mode, SELinux would not let me start HTTPD since my mod_jk.so module was copied from an external server. I copied mod_jk.so externally since I couldn't find the package to ...
0
votes
1answer
39 views

Adding to existing policy in selinux

I just created a custom policy and did the semodule -i test.te. I reran all my tests after a few days and I noticed there were additional AVC denials in the audit.log. I want to add the new stuff ...
0
votes
1answer
35 views

Download file without disabling selinux

I am developing a site in PHP on Linux Server where I need to download a file from Windows Server to Linux Machine. I can do it with Some Changes in SeLinux or setting some properties on it, i.e.: % ...
0
votes
1answer
68 views

After trying to remove SELinux, system doesn't start; shows error of “unable to connect to system bus”

I had SELinux installed on my system which actually was a bit annoying. I tried to remove it. After that my system is unable to start. The error that is showing up is: unable to connect to system ...
0
votes
2answers
237 views

PHP Fatal error: date(): Timezone database is corrupt

I installed wordpress to CentOS from EPEL: yum install wordpress And it can only work if I manually disable SELinux. Otherwise I see this error: PHP Fatal error: date(): Timezone database is ...
0
votes
0answers
233 views

SELinux denies execute of script resulting in a complex looking custom policy

The heartbeat type polling tool nanny (part of Piranha / Linux Virtual Server / LVS / IPVS) is being denied access to my "sendprogram" scripts by SELinux. Setting the context alone is not sufficient. ...
0
votes
1answer
220 views

Can sealert display the full command of a denied access request?

I am managing a Red Hat Enterprise 5 system using Chef. Something within sequence of configuration commands is generating selinux alerts such as: SELinux is preventing iptables (iptables_t) "read" to ...
0
votes
2answers
373 views

Can't open/forward port with Fedora15

I've got a server running Fedora 15. My end goal is to be able to forward any protocol over random port numbers (specified via iptables rules.) Let's say, for the time being, I want to forward port ...
0
votes
0answers
1k views

Httpd won't start because of permission denied

This happened after the server went down all of sudden, we couldn't access it only a minute later, when we attempted apache restart. the error below occurred: httpd: Syntax error on line 221 of ...
0
votes
1answer
540 views

Mounted NFS directory not writable by Apache / PHP

Need some help here with NFS. Here's what I have (all servers running CentOS 5.6 with SELinux): 172.17.20.1 - Primary server with static IP. Varnish redirects requests to the web servers. 172.17.20.2 ...
0
votes
1answer
236 views

SELinux AVC denies at boot

My Gentoo box is running Gentoo Hardened/SELinux (32bit), I followed the Gentoo Hardened Guide to install it and the machine doesn't boot. Here is an extract from dmesg: Mar 12 19:15:04 ...
0
votes
2answers
251 views

CentOS 5.6: Apache access permission after .htaccess upload

I was working on my home server remotely and wanted to make some changes to my .htaccess. I could not see this file using my FTP(filezilla) and thought there was none there. I decided to upload one I ...
0
votes
1answer
532 views

Nginx serves files under root dir, but not from subdirs

I am running nginx on Ubuntu 11.10 with php-fpm and SELinux. The site is served over https/ssl Content that is directly under any sites root dir is served, but when trying to access a subdirectory ...