NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

1
vote
1answer
227 views

Disable permissive SELinux setroubleshoot browser notices?

I'm running CentOS 5.4 with SELinux in permissive mode. I still get setroubleshoot browser notices in the taskbar. How do I turn these off without fulling disabling SELinux?
1
vote
1answer
623 views

SElinux in ubuntu

Has anyone installed SW Linux in Ubuntu? what were your results? does it come with all the same default rules that the Redhat installation does? I like the security of SE linux, but I have a ...
1
vote
1answer
2k views

mod_fcgid + Python + Apache 2.2 / RHEL 5 : output to error_log, not browser

I'm trying to get a Django + mod_fcgid setup working (mod_wsgi is tricky as I have a statically-linked Python. Don't ask.) While this was trivial on my Mac OS X development box, getting it running on ...
1
vote
0answers
33 views

Selinux: Shorewall will not respond to fail2ban

I am using fail2ban with shorewall and my Fedora 21 server & cloud. All flooded with the following error message: SELinux is preventing shorewall from write access on the file ...
1
vote
1answer
24 views

SELinux - first attempt to restrict file by type - fails to fail

I have a Centos 6 Linux box. I read tutorials on SELinux and wanted to try it out. Here are steps I followed, set SELINUX=enforcing in /etc/selinux/config turned on SELINUX with setenforce 1 service ...
1
vote
0answers
88 views

How to power down Cloudstack configured with XenServer Hypervisors

I have three XenServers(6.2) configured in a single pool. I also have a Cloudstack (CentOS 6.5) Management interface controlling them all. Everything is up and running but I can not figure out how to ...
1
vote
1answer
48 views

Trying to track down why httpd would be trying to connect to a tor port

I'm seeing occasional selinux denied messages in my logs that I believe indicate that the httpd process is trying to connect to a tor port: type=AVC msg=audit(1423247604.799:1966): avc: denied { ...
1
vote
1answer
176 views

SELinux Permissive enabled; httpd error reporting

I kept getting the following notice in apache /var/log/messages and many others same messages : kernel: type=1400 audit(1422862414.790:3222): avc: denied { getattr } for pid=2484 comm="deliver" ...
1
vote
2answers
278 views

nginx suddenly redirecting everything to 403 page, can this be debugged or traced?

I'm not sure what happened to my nginx install. Suddenly all page requests are being redirected to the 403 page. Yesterday I tried to add a user agent to block, restarted service from that point ...
1
vote
0answers
73 views

SElinux sandbox fails to start from systemd service

I have a server that runs user submitted code, for evaluation. I wrote a systemd service that starts a python application, that application then run the submitted code using SElinux sandbox. The ...
1
vote
2answers
997 views

Centos: rsyslog blocks sshd and also local login if selinux is active

I have a very curious problem on an centos 6.5(now 6.6) machine. After an update between june 11th and october 21th the trouble begins (packages: http://pastebin.com/gXvaycLL). After a restart in ...
1
vote
0answers
82 views

Possible to prevent access to /tmp for a specific user via SELinux?

I'm sort of learning the edges of SELinux and I'm wondering if it's possible to prevent a specific user from accessing /tmp. Clearly it's a bad idea to dork all permissions, so I'm hoping that ...
1
vote
1answer
94 views

auditd auid changes after su

I try to implement individual accountability for my RHEL systems using selinux and the audit.log. I followed the instructions given here: Log all commands run by admins on production servers If I ...
1
vote
0answers
17 views

SELinux module for a specific file rather than an entire context

I've created an SELinux module that works great for a specific context. What I would like to know is, is it possible to restrict this module to only function for specific files with that context? For ...
1
vote
1answer
2k views

Why does Fedora 20 still deny access to home directories after enabling SELinux httpd_read_user_content and setting files to httpd_user_content_t?

On my Fedora 20, I've learned that to allow write access to files by processes like PHP via Apache, the process owner, which is in my case apache, must have write permissions to the files. Also, since ...
1
vote
1answer
24 views

Disabling network access for a group of users but allowing smtp only

We have an environment where our users ssh into the system and their shell is set to simply launch Mutt on their $HOME/Maildir. We want to restrict our users to only be able to send/receive mail. We ...
1
vote
1answer
392 views

Zabbix & SNMPTT.log file access denied

I'm having a problem with a file accesed by ZAbbix to proccess all the SNMP trap data using a file /var/log/snmptt/snmptt.log. ZAbbix_proxy.log 23323:20140430:105246.532 sleeping for 5 seconds ...
1
vote
1answer
586 views

Enable selinux to allow mysql files to be read and written on a nfs share

I have moved my /var/lib/mysql directory to an nfs share, updated all the config files and created symbolic links where appropriate. This works when I have selinux turned off, but mysqld fails to ...
1
vote
0answers
64 views

How to write a file from Apache CGI in a user home directory on CentOS

I made a CGI in Python and it works unless I try to write to a file in a user's home. I activated allow_httpd_anon_write and allow_http_sys_script_anon_write to true with graphical tool for ...
1
vote
1answer
439 views

Apache passphrase working sometimes

On one of my servers I observe the following problem with SSL passphrase: some certs are passing it without asking for a password, while some others keep asking for it. I have set it up globally: ...
1
vote
1answer
498 views

SElinux process killed while trying to set boolean

I've got a strange problem. I can not allow apache to connect to database at my CentOC 6.4 box: [root@centos6 ~]# setsebool -P httpd_can_network_connect on Killed [root@centos6 ~]# sestatus -b | grep ...
1
vote
1answer
357 views

openssh-lpk - Failed to get default SELinux security context for ldapuser

I'm trying to setup a ssh server with hardened-gentoo sources openssh (with openssh-lpk, which is the ldap flag on gentoo I think) and selinux enabled. On the Ldap-Server I have added an user ...
1
vote
1answer
894 views

How to allow cron to send an email attachment?

SELinux is preventing cron from attaching a log file in the email with the following error: notice kernel [ 7148.923034] type=1400 audit(1359466501.857:5): avc: denied { read } for pid=3182 ...
1
vote
0answers
70 views

linux: upload / download difference on network shares

I have a Red Hat Enterprise Linux 6 (with SELinux) which shows significant differences of speed between download and upload (the latter significantly slower) of files shared over the LAN. The ...
1
vote
2answers
1k views

How can I do an SELINUX filesystem relabel without rebooting first?

I can touch the file /.autorelabel and reboot and during the initialization coming back up it will do the SELINUX relabel for me. But I want to do this in a different situation where the system has ...
1
vote
1answer
85 views

selinux, git and var/www [closed]

Here's my situation: what i want to do is to "git clone" a project under /var/www. But since i'm logged into my server as idcuser selinux (I suppose :D) doesn't permit me to do it. How can I "give" ...
1
vote
1answer
2k views

CentOS - Configuring Puppet to play nice with SELinux

I am running into an issue every time I attempt to start the puppetmasterd service, for which I receive the following error message: root@service1 ~ # -> /etc/init.d/puppetmaster start Starting ...
1
vote
0answers
69 views

SELinux - Prevent users in the user_t domain from creating sockets

I need untrusted users to execute Ruby and Python scripts via SSH on a Fedora 17 machine with a minimal impact on system integrity and security. A SSH wrapper will ensure only Ruby and Python ...
1
vote
2answers
569 views

'/var/spool/cron' is not a directory, bailing out. when trying to work with crontab via PHP's shell_exec

I am creating a web application. Part of the functionality is depending on that the user can start/stop a cronjob that imports emails. It doesn't work. Just to make sure I'm on the right track, as ...
1
vote
1answer
195 views

PHP won't run on Fedora 15

I have followed this exact tutorial on installing php on a Fedora 15 system. I have all the necessary packages installed with no errors. Yet the simple phpinfo() test page will show - it will show a ...
1
vote
2answers
437 views

Relabeling of filesystems (SELinux) fails

After compiling the policy modules and re-compiling my core packages (Gentoo 32bit) I wanted to relabel the filesystems (via rlpkg -a -r) and packages but I get these error messages: Relabeling ...
1
vote
1answer
2k views

pam_mount of smb share on rhel6, home directory not available for login - probably SELinux?

I'm using the Fedora 12 pam_mount / libHX RPMs on a RHEL 6 x86_64 system to automatically mount home directories from a NetApp system configured with NTFS-only security AD-bound logins work fine - ...
1
vote
1answer
856 views

selinux password-less login

os: centos 6 currently i have selinux linux enabled (enforcing) , disabling it makes ssh passwordless login work. i have set setsebool for ssh the following settings [root@server]# ...
1
vote
1answer
159 views

How to access virtual guest centos on windowsxp remotely

I have installed CentOS(domain 0) as a Base OS then using XEN tool virt-manager, I have created another CentOS5(domU) as virtual guestOS. I can easily access base CentOS(domain 0) by windows ...
1
vote
2answers
2k views

rsyslog-mysql on CentOS 5.3 does not have permission to access the mysql.sock

After installing and configuring both MySQL and rsyslog with the mysql extensions I get the following error in /var/log/messages: rsyslogd:db error (2002): Can't connect to local MySQL server ...
1
vote
3answers
52 views

How to disable SELINUX for systemd script?

I have a systemd script in CentOS 7 which doesn't run properly unless I disable SELINUX. Is it possible to somehow have SELINUX enabled on the system but disable it only for this systemd script? The ...
0
votes
3answers
512 views

restrict root access for certain files or filesystems

I want to store files for my users on encrypted filesystems. Every user would have his own filesystem with his own key. The user is able to log in to the system and mount his filesystem. When they are ...
0
votes
1answer
135 views

PHP Not running on specific directories [closed]

Ok. This is a pretty weird error: I made a folder named 'hello' at /etc/apache2/sites-enabled/ with hello.php. Then i created an Alias that told /hello would go to /etc/apache2/sites-enabled/hello. ...
0
votes
2answers
439 views

enabling CentOS selinux

I installed Centos 5.5 and by deafult SElinux was disabled. I did changes in /etc/selinux/config and now it looks like this. SELINUX=enforcing SELINUXTYPE=targeted SETLOCALDEFS=0 and rebooted ...
0
votes
2answers
734 views

RHEL6: Selinux not logging AVC denial messages

I'm trying to configure a set of lockdown rules. My approach is to start with a restricted user, and use audit2allow messages to selective add permissions. My problem is that I don't see the expected ...
0
votes
3answers
111 views

proftpd is accessing my.cnf

I use proftpd for virtual FTP hosting with MySQL. I've started writing fine-grained SELinux policies and found that it's trying to access my.cnf files. Question is what for and why? type=AVC ...
0
votes
1answer
462 views

Lighttpd fails with 403 - Forbidden with SELinux enabled

I've setup a CentOS 6.3 box with lighttpd, php-fpm and I can server both static files and PHP files with SELinux enabled if I leave the lighttpd home directory set to the default (/var/www/lighttpd). ...
0
votes
1answer
488 views

Do I need to chroot BIND 9 if I'm using AppArmor? [duplicate]

Possible Duplicate: bind9 in a chroot jail - necessary or not? I'm redoing my external dns servers and thinking about skipping chroot this time. And using apparmor or selinux as an ...
0
votes
1answer
449 views

SELinux Contexts

I am configuring Apache\PHP and noticed Apache complaining about permissions with the php shared object. Starting httpd: httpd: Syntax error on line 206 of /etc/httpd/conf/httpd.conf: Cannot load ...
0
votes
4answers
2k views

How does SELinux affect the /home directory?

I'm migrating a CentOS 5.3 system from MySQL to PostgreSQL. The way our machine is set up is that the biggest disk partition is mounted to /home. This is out of my control and is managed by the ...
0
votes
1answer
35 views

What are soundd daemons, and why does nginx need the type under SELinux?

Curious what is soundd daemon. The wiki at http://wiki.centos.org/TipsAndTricks/SelinuxBooleans says it is "soundd daemon" but I'm not finding much additional info on internet. To get nginx ...
0
votes
1answer
49 views

SELinux - mysql/ and httpdoc/ in same folder?

Looks like my old faithful LAMP directory structure has come unstuck with SELinux. I prefer everything in the same place. CentOS 6.6 Apache 2.2.15 MySQL 6.5 /DATA/ /DATA/httpdocs/ /DATA/mysql/ ...
0
votes
1answer
82 views

Selinux “Add context Rule to Semanage” [closed]

As you add or change a new rule to fcontext semanage to any directory and apply, egg: # How to add this rule for apply changes whit restoreconf -Rv /var/www/html(/.*)?/media(/.*)? ...
0
votes
2answers
310 views

Check my Kernel for SELinux Support

I want to know if the kernel i am running has support for SELinux. What commands would i use to check this ?
0
votes
1answer
2k views

redhat Apache fast-cgi selinux permissions

My apache installation is running php as fastcgi, and the virtual hosts are pointing to /home/*/public_html. and the fastcgi are home/*/cgi-bin/php.fcgi the public_html setup with selinux was: ...