NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

1
vote
0answers
69 views

linux: upload / download difference on network shares

I have a Red Hat Enterprise Linux 6 (with SELinux) which shows significant differences of speed between download and upload (the latter significantly slower) of files shared over the LAN. The ...
1
vote
2answers
570 views

How can I do an SELINUX filesystem relabel without rebooting first?

I can touch the file /.autorelabel and reboot and during the initialization coming back up it will do the SELINUX relabel for me. But I want to do this in a different situation where the system has ...
1
vote
1answer
76 views

selinux, git and var/www [closed]

Here's my situation: what i want to do is to "git clone" a project under /var/www. But since i'm logged into my server as idcuser selinux (I suppose :D) doesn't permit me to do it. How can I "give" ...
1
vote
1answer
1k views

CentOS - Configuring Puppet to play nice with SELinux

I am running into an issue every time I attempt to start the puppetmasterd service, for which I receive the following error message: root@service1 ~ # -> /etc/init.d/puppetmaster start Starting ...
1
vote
0answers
61 views

SELinux - Prevent users in the user_t domain from creating sockets

I need untrusted users to execute Ruby and Python scripts via SSH on a Fedora 17 machine with a minimal impact on system integrity and security. A SSH wrapper will ensure only Ruby and Python ...
1
vote
2answers
477 views

'/var/spool/cron' is not a directory, bailing out. when trying to work with crontab via PHP's shell_exec

I am creating a web application. Part of the functionality is depending on that the user can start/stop a cronjob that imports emails. It doesn't work. Just to make sure I'm on the right track, as ...
1
vote
1answer
184 views

PHP won't run on Fedora 15

I have followed this exact tutorial on installing php on a Fedora 15 system. I have all the necessary packages installed with no errors. Yet the simple phpinfo() test page will show - it will show a ...
1
vote
2answers
379 views

Relabeling of filesystems (SELinux) fails

After compiling the policy modules and re-compiling my core packages (Gentoo 32bit) I wanted to relabel the filesystems (via rlpkg -a -r) and packages but I get these error messages: Relabeling ...
1
vote
1answer
2k views

pam_mount of smb share on rhel6, home directory not available for login - probably SELinux?

I'm using the Fedora 12 pam_mount / libHX RPMs on a RHEL 6 x86_64 system to automatically mount home directories from a NetApp system configured with NTFS-only security AD-bound logins work fine - ...
1
vote
1answer
770 views

selinux password-less login

os: centos 6 currently i have selinux linux enabled (enforcing) , disabling it makes ssh passwordless login work. i have set setsebool for ssh the following settings [root@server]# ...
1
vote
1answer
158 views

How to access virtual guest centos on windowsxp remotely

I have installed CentOS(domain 0) as a Base OS then using XEN tool virt-manager, I have created another CentOS5(domU) as virtual guestOS. I can easily access base CentOS(domain 0) by windows ...
1
vote
2answers
2k views

rsyslog-mysql on CentOS 5.3 does not have permission to access the mysql.sock

After installing and configuring both MySQL and rsyslog with the mysql extensions I get the following error in /var/log/messages: rsyslogd:db error (2002): Can't connect to local MySQL server ...
0
votes
3answers
361 views

restrict root access for certain files or filesystems

I want to store files for my users on encrypted filesystems. Every user would have his own filesystem with his own key. The user is able to log in to the system and mount his filesystem. When they are ...
0
votes
1answer
68 views

PHP Not running on specific directories [closed]

Ok. This is a pretty weird error: I made a folder named 'hello' at /etc/apache2/sites-enabled/ with hello.php. Then i created an Alias that told /hello would go to /etc/apache2/sites-enabled/hello. ...
0
votes
2answers
384 views

enabling CentOS selinux

I installed Centos 5.5 and by deafult SElinux was disabled. I did changes in /etc/selinux/config and now it looks like this. SELINUX=enforcing SELINUXTYPE=targeted SETLOCALDEFS=0 and rebooted ...
0
votes
1answer
2k views

Centos 7 and OpenVPN: how make them friends?

I'm trying to install OpenVPN server on Centos 7 and faced with next problem: [root@msk ~]# /etc/init.d/openvpn start Starting openvpn (via systemctl): [ OK ] [root@msk ~]# ...
0
votes
1answer
496 views

SELinux blocking sudo from zabbix_agentd

I have a custom user parameter for Zabbix that calls a hardware RAID CLI tool (arcconf / megacli) and checks if any arrays are degraded. Since these tools are root-only, I have configured sudoers to ...
0
votes
2answers
456 views

RHEL6: Selinux not logging AVC denial messages

I'm trying to configure a set of lockdown rules. My approach is to start with a restricted user, and use audit2allow messages to selective add permissions. My problem is that I don't see the expected ...
0
votes
3answers
104 views

proftpd is accessing my.cnf

I use proftpd for virtual FTP hosting with MySQL. I've started writing fine-grained SELinux policies and found that it's trying to access my.cnf files. Question is what for and why? type=AVC ...
0
votes
1answer
393 views

Lighttpd fails with 403 - Forbidden with SELinux enabled

I've setup a CentOS 6.3 box with lighttpd, php-fpm and I can server both static files and PHP files with SELinux enabled if I leave the lighttpd home directory set to the default (/var/www/lighttpd). ...
0
votes
1answer
441 views

Do I need to chroot BIND 9 if I'm using AppArmor? [duplicate]

Possible Duplicate: bind9 in a chroot jail - necessary or not? I'm redoing my external dns servers and thinking about skipping chroot this time. And using apparmor or selinux as an ...
0
votes
1answer
372 views

SELinux Contexts

I am configuring Apache\PHP and noticed Apache complaining about permissions with the php shared object. Starting httpd: httpd: Syntax error on line 206 of /etc/httpd/conf/httpd.conf: Cannot load ...
0
votes
4answers
2k views

How does SELinux affect the /home directory?

I'm migrating a CentOS 5.3 system from MySQL to PostgreSQL. The way our machine is set up is that the biggest disk partition is mounted to /home. This is out of my control and is managed by the ...
0
votes
2answers
203 views

Check my Kernel for SELinux Support

I want to know if the kernel i am running has support for SELinux. What commands would i use to check this ?
0
votes
1answer
2k views

redhat Apache fast-cgi selinux permissions

My apache installation is running php as fastcgi, and the virtual hosts are pointing to /home/*/public_html. and the fastcgi are home/*/cgi-bin/php.fcgi the public_html setup with selinux was: ...
0
votes
2answers
711 views

CGI script fails to open a socket (CentOS 6.2/Apache2)

I have a webserver running CentOS 6.2 and the latest Apache from repositories. Todey I encountered a problem when running an executable program via CGI on Apache. The program is supposed to connect to ...
0
votes
2answers
463 views

Selinux/MySQL permissions issue in a new iSCSI disk: not allowed default_t context

I've a server with MySQL installed and running, and an iSCSI disk (with multipath) connected and running OK. The iSCSI disk uses /emc as mountpoint. My problem is when I move MySQL datadir to a new ...
0
votes
2answers
1k views

Apache curl via HTTP proxy

I am trying to get PHP to execute a curl connection to another server. To connect to the server, we need to go via a proxy. Within bash, we have set the env-variable http_proxy and this works ...
0
votes
2answers
113 views

SELinux interfering with Apache / PHP [duplicate]

On my installation of CentOS 7, SELinux is enabled by default. This is preventing Apache from properly reading PHP files in the standard /var/www/html document root (the browser is blank when ...
0
votes
1answer
223 views

Apache can't connect to remote MySQL, but mysql command line from same server can

Symptoms: I am running CentOS 6. I can connect to the remote MySQL from the command line: mysql -h a.b.c.d -u user -p -D db. Laravel artisan commands run on the local command line can also connect: ...
0
votes
1answer
75 views

SELinux problems running Expect script from fail2ban

I have an Expect script that works fine if I run it manually, but fails when run as an action from Fail2ban. The error message is as follows: spawn /usr/bin/telnet 192.168.242.1 The system has no ...
0
votes
1answer
6k views

SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0

I kept getting the following notice in apache log when I start apache http server 2.2: SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0 even though I disabled ...
0
votes
1answer
502 views

Errors whilst installing kolab

i'm struggling for the past 2 days please help me anyone... [root@mail /]# setup-kolab Please supply a password for the LDAP administrator user 'admin', used to login to the graphical console of 389 ...
0
votes
2answers
2k views

Selinux in permissive mode, ssh key based auth and locked account

I noticed something weird regarding ssh key based login and selinux in permissive mode. Let me introduce you the setup: The server is an updated Centos 6.4 x86_64. We create user without a password ...
0
votes
2answers
1k views

Disable SeLinux permanently

I am running a virtualbox CentOS 6.4 (64 bit) server with Cobbler service. One of the steps is to disable SeLinux in order to prevent a python error when running service cobblers start. If I run ...
0
votes
1answer
864 views

ProFTPd and SELinux: mkdir Permission denied

I have a ProFTPd server on Centos 6.3 with SELinux Enforcing. My users are virtual users in a flat file. The users are chrooted to directories mounted via NFS. I've already set the following ...
0
votes
1answer
1k views

Change unconfined_u to system_u is failing [duplicate]

I've got a file on my apache/linux server. ls -Z gives: drwxr-xr-x. apache apache unconfined_u:object_r:httpd_sys_rw_content_t:s0 localization.smicloud.org I need to change unconfined_u to ...
0
votes
2answers
1k views

sshd[4344]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument?

OpenSSH_5.8p1, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 selinux-policy-2.4.6-338.el5 pam-0.99.6.2-12.el5 SELinux is running in permissive mode: # sestatus SELinux status: enabled ...
0
votes
1answer
829 views

Trying to get Apache and nodejs to play nice together, getting “setsebool: SELinux is disabled.”?

I am running Ubuntu, and an Apache server. I wanted to try out nodejs, and I wanted to run it through a virtualhost on Apache. I read this article and tried to follow the instructions: ...
0
votes
1answer
774 views

HOW do I get enforcing SElinux and postfix with custom milter to work?

I have an IPv4 setup of postfix on RHEL6 with SElinux in enforcing mode. All my attempts at incorporating opendkim fails miserably unless I leave enforcing mode. The errors I get when SElinux is ...
0
votes
1answer
367 views

Unable to change user in security context of symlink

I have created a few symbolic links to replace some broken links in /etc/pam.d. The original links have system_u as the user. The newly created ones somehow have unconfined_u as the user. I am not ...
0
votes
1answer
89 views

Why do I have to do a setenforce 0 to cluster tomcat on Scientific Linux using mod_proxy

Why do I have to do a setenforce 0 to cluster tomcat on Scientific Linux using mod_proxy I am using Scientific Linux release 6.2 and trying to get mod_proxy working with httpd and tomcat. I want ...
0
votes
2answers
464 views

selinux permissive and type targeted

i am running centos 6.2 recently i noticed that apache was running with selinux enabled # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # ...
0
votes
2answers
138 views

Centos 6.3 PERL CGI selinux file read access

I have a CGI script called index.cgi It is trying to read a log file called 10.128.0.242.2012.sep.20.downloaded.txt under the path /var/log/trafcount/ It appears that it is being blocked by selinux. ...
0
votes
1answer
65 views

change selinux property of a file? [duplicate]

Possible Duplicate: Permission denied in vhost document root Apache cant process my files due to forbidden error, searching resulted that it might be because of selinux, how can I change ...
0
votes
1answer
230 views

SELinux: allow Zend webapp to read/write to tree outside htdocs

I have a Zend web application running on a CentOS server with SELinux running in permissive mode (i.e. access-control decisions are recorded in /var/log/audit/audit.log but not enforced). The ...
0
votes
3answers
620 views

Apache Documentroot access forbidden

Running Arch Linux I am trying to get apache to use /www (not /var/www) as DocumentRoot. /www is a softlink to /home/user/www. However, I keep getting an "Access Forbidden" error. The / and /home ...
0
votes
1answer
944 views

How do I configure SELinux on Centos 6 for cobbler?

I have installed and configured Cobbler on my centos 6 "installation server". From what I think I did all the configurations I'm supposed to. The installation was performed with my own customized ...
0
votes
1answer
397 views

Does semodule -i need to be run after every SELinux policy update?

On RHEL and CentOS servers, when the selinux-policy-* RPM packages receive an update, is it always necessary to manually reload any custom modules I have built? When I see an update to ...
0
votes
1answer
830 views

What does “Invalid AVC allowed in current policy” mean?

I was looking into my selinux alert logfile and running over multiple entries labeled **** Invalid AVC allowed in current policy *** I understand that this signals a problem (on read or getattr ...