Questions tagged [selinux]

NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

Filter by
Sorted by
Tagged with
0 votes
1 answer
499 views

httpd trying to access root-owned session files

While looking into what's been causing a server to lock up/crash, I found many selinux messages in /var/log/messages. For example: setroubleshoot: SELinux is preventing /usr/sbin/httpd from getattr ...
Reese's user avatar
  • 148
2 votes
2 answers
14k views

SELinux interfering with Apache / PHP [duplicate]

On my installation of CentOS 7, SELinux is enabled by default. This is preventing Apache from properly reading PHP files in the standard /var/www/html document root (the browser is blank when ...
Grant_Bailey's user avatar
1 vote
1 answer
3k views

Centos 7 with SElinux: openvpn and DNS

I'm trying to use openvpn as client on centos 7. It works fine, but i cannot get DNS from server. As you know, there is no resolvconf in new Centos, so, standard update-resolv-conf script doesn't work....
ckorzhik's user avatar
  • 115
1 vote
2 answers
2k views

Centos: rsyslog blocks sshd and also local login if selinux is active

I have a very curious problem on an centos 6.5(now 6.6) machine. After an update between june 11th and october 21th the trouble begins (packages: http://pastebin.com/gXvaycLL). After a restart in ...
Christopher Lorenz's user avatar
1 vote
0 answers
419 views

Possible to prevent access to /tmp for a specific user via SELinux?

I'm sort of learning the edges of SELinux and I'm wondering if it's possible to prevent a specific user from accessing /tmp. Clearly it's a bad idea to dork all permissions, so I'm hoping that ...
OldTroll's user avatar
  • 1,706
1 vote
1 answer
12k views

Centos 7 and OpenVPN: how make them friends?

I'm trying to install OpenVPN server on Centos 7 and faced with next problem: [root@msk ~]# /etc/init.d/openvpn start Starting openvpn (via systemctl): [ OK ] [root@msk ~]# ...
Psychozoic's user avatar
0 votes
1 answer
1k views

Varnish 4 service won't start because of selinux

I've installed varnish 4 on my new centos 6.5 box. I've activated EPEL repo to install varnish from http://repo.varnish-cache.org/redhat/varnish-4.0/ After installing and configuring my default.vcl I ...
k4cy's user avatar
  • 213
6 votes
1 answer
9k views

How should I configure SELinux when running nginx inside Docker

There's a good article in Docker's documentation about security with Docker: https://docs.docker.com/articles/security/ However, it's not very clear to me how root-privileged processes in the ...
vcarel's user avatar
  • 434
1 vote
2 answers
4k views

Apache can't connect to remote MySQL, but mysql command line from same server can

Symptoms: I am running CentOS 6. I can connect to the remote MySQL from the command line: mysql -h a.b.c.d -u user -p -D db. Laravel artisan commands run on the local command line can also connect: ...
bishop's user avatar
  • 1,095
1 vote
1 answer
2k views

auditd auid changes after su

I try to implement individual accountability for my RHEL systems using selinux and the audit.log. I followed the instructions given here: Log all commands run by admins on production servers If I ...
fetch101's user avatar
1 vote
1 answer
687 views

Configuration for Ubuntu SELinux with sshd

I am trying to set-up SELinux in an Ubuntu Trusty server, who is an Amazon EC2 instance. I followed the Debian documentation about installing SELinux. The installation work well as seen by : root@...
Nekyz's user avatar
  • 11
7 votes
1 answer
2k views

SELinux: cannot confine Firefox process to mozilla_t domain

My goal is to execute Firefox in the mozilla_t domain instead of unconfined_t. The machine runs Fedora 20 with SELinux in enforcing mode. Unfortunately, I can't seem to get this right. No matter ...
user avatar
1 vote
1 answer
1k views

Sharing Collectd data with Apache on CentOS (SELinux)

My CentOS 7 VPS has SELinux enabled and is monitored by Collectd. It uses rrdtool to log the reported data. Pommi released a great solution that made me able to review all data on a webpage called CGP ...
Tom's user avatar
  • 123
16 votes
4 answers
23k views

SELinux preventing Apache from writing to a file

SELinux is preventing the apache user from writing to a log file which it owns. When I do setenforce 0 it works. Otherwise it shows this error IOError: [Errno 13] Permission denied: '/var/www/webapp/...
Clodoaldo's user avatar
  • 433
1 vote
1 answer
10k views

svn: Can't open file '/var/www/svn/repo/db/txn-current-lock': Permission denied

On Fedora os, I have problem to access SVN Repo and commit via HTTP. Here is my config file /etc/httpd/conf.d/subversion.conf LoadModule dav_svn_module modules/mod_dav_svn.so LoadModule ...
Emax's user avatar
  • 127
1 vote
1 answer
1k views

Audit says nothing to do, yet puppet won't run with SELinux enforcing

I'm determined to get my puppet master running with SELinux set to enforcing. If I make it permissive, it runs fine. I'm on RHEL 7, with systemd, apache2, passenger 4, and puppet 3. I've gone ...
Mojo's user avatar
  • 965
0 votes
1 answer
643 views

SELinux problems running Expect script from fail2ban

I have an Expect script that works fine if I run it manually, but fails when run as an action from Fail2ban. The error message is as follows: spawn /usr/bin/telnet 192.168.242.1 The system has no ...
miken32's user avatar
  • 964
4 votes
2 answers
6k views

New Dovecot install not allowing login, giving permissions error despite saying that permissions "appear ok"

I'm installing dovecot onto a Virtualbox VM running Ubuntu Server 64-bit 14.04 guest. Dovecot itself is being installed into a Docker container (I'm not sure that that's relevant here, but am noting ...
J L's user avatar
  • 151
4 votes
1 answer
12k views

SELinux blocking sudo from zabbix_agentd

I have a custom user parameter for Zabbix that calls a hardware RAID CLI tool (arcconf / megacli) and checks if any arrays are degraded. Since these tools are root-only, I have configured sudoers to ...
lmz's user avatar
  • 379
5 votes
1 answer
4k views

Unable to re-enable SELinux

Up until now we have disabled SELinux as our Standard Operating Procedure -- before you tell me off, I know. That's why we're enabling it now we've got time to. Our normal procedure was to: Set ...
fukawi2's user avatar
  • 5,436
-2 votes
1 answer
168 views

Difference between target policy 18 and 24 in SELinux

I recently started to learning SELinux and I am so new on that. So I've faced an issue and I have question, I use CentOS 6.5 and I am learning SElinux via video training. Into the video training ...
Debian's user avatar
  • 51
0 votes
0 answers
64 views

Setting up muli-project web development server

I'm trying to set up a development server that will be used for several (web) projects by different teams (consisting of different people, some of which may be involved with more than one project). I ...
Bart Platak's user avatar
1 vote
0 answers
71 views

SELinux module for a specific file rather than an entire context

I've created an SELinux module that works great for a specific context. What I would like to know is, is it possible to restrict this module to only function for specific files with that context? For ...
Simon's user avatar
  • 19
5 votes
1 answer
6k views

SELinux for RHEL not persistant after reboot

So in the Red Hat exam they want you to use SELinux. If for example you install vsftp, then do setsebool -P ftp_home_dir=1 or setsebool -P ftp_home_dir on to allow the users on the server to access ...
user3571487's user avatar
1 vote
1 answer
3k views

How do I fix this dovecot SELinux error in audit.log on CentOS?

I'm getting these SELinux errors in /var/log/audit/audit.log for dovecot. type=USER_AUTH msg=audit(1404794536.249:100679): user pid=28375 uid=0 auid=0 ses=2700 subj=unconfined_u:system_r:...
Chloe's user avatar
  • 1,174
2 votes
1 answer
900 views

Why don't my domain transitions don't occur when the application binary is outside of the stardard binary directories?

I'm trying to set up a custom SELinux policy, but I'm having trouble getting the domain transitions to occur when the application binary is outside of the standard binary directories such as /bin, /...
Grammin's user avatar
  • 121
3 votes
2 answers
4k views

CentOS Selinux config enforcing but unable to start

I recently discovered selinux is disabled, but config file saying selinux enforcing mode setted. I read about possibilities about why selinux is disabled. I am suspecting on kernel. But I can't find ...
Sencer H.'s user avatar
  • 582
1 vote
1 answer
3k views

Why does Fedora 20 still deny access to home directories after enabling SELinux httpd_read_user_content and setting files to httpd_user_content_t?

On my Fedora 20, I've learned that to allow write access to files by processes like PHP via Apache, the process owner, which is in my case apache, must have write permissions to the files. Also, since ...
Spencer Williams's user avatar
0 votes
1 answer
4k views

httpd (WordPress) gets avc denied write (SELinux)

I'm getting following message in my /var/log/audit/audit.log: type=AVC msg=audit(1402615093.053:68): avc: denied { write } for pid=799 comm="httpd" name="php" dev="xvda1" ino=8667365 scontext=...
alexus's user avatar
  • 13.4k
3 votes
2 answers
5k views

How do I allow apache to rotate logs in user home directory with SELinux enabled?

Our development machine has multiple users, and their various sites are stored in /home/username/apache. In these folders are sub-folders like conf containing the virtual host config, logs containing ...
Leonard Challis's user avatar
2 votes
1 answer
2k views

How to configure SELinux to allow apache to run git

I have a CentOS 6 server and I'm trying to get the apache web server to run git pull in a directory. The php file is simply: <?php shellexec('cd /var/www/vhosts/domain;git pull'); However, ...
wyred's user avatar
  • 217
2 votes
2 answers
2k views

Is it possible to persist selinux port statements across reboots?

Currently we need to run something like this every time we start up: /usr/sbin/semanage port -a -t memcache_port_t -p tcp ${special-snowflake-port} It would be great if we could persist this across ...
Blue Warrior NFB's user avatar
7 votes
2 answers
8k views

SElinux label for php-fpm sockets

I'm attempting to set up multiple instances of php-fpm to run multiple versions of php through apache 2.2 running on centos 6.5. At some point in the future this will end up in a shared hosting ...
Mikk3lRo's user avatar
  • 183
1 vote
1 answer
34 views

Disabling network access for a group of users but allowing smtp only

We have an environment where our users ssh into the system and their shell is set to simply launch Mutt on their $HOME/Maildir. We want to restrict our users to only be able to send/receive mail. We ...
unixpipe's user avatar
1 vote
1 answer
2k views

Zabbix & SNMPTT.log file access denied

I'm having a problem with a file accesed by ZAbbix to proccess all the SNMP trap data using a file /var/log/snmptt/snmptt.log. ZAbbix_proxy.log 23323:20140430:105246.532 sleeping for 5 seconds ...
Rafael's user avatar
  • 155
2 votes
3 answers
5k views

Enable selinux to allow mysql files to be read and written on a nfs share

I have moved my /var/lib/mysql directory to an nfs share, updated all the config files and created symbolic links where appropriate. This works when I have selinux turned off, but mysqld fails to ...
user5013's user avatar
  • 233
-1 votes
2 answers
2k views

Why am I getting permission error from tftp server?

I'm trying to tftp an image to an ASA 5500 and I'm getting this error: TFTP failure: RX TFTP Error Packet TFTP OP Code: Error Packet Error Msg: Permission denied
AXE Labs's user avatar
  • 1,559
1 vote
1 answer
2k views

SELinux access denied error for bash scripts triggered from perl-cgi script

I have a automation framework which use Perl-CGI for running scripts at server. As we have SELinux enabled I am getting access denied errors when the script try to run a bash script. Below is the ...
Abhinav's user avatar
  • 225
1 vote
1 answer
1k views

Reading home files permission: Policy constraint violation

I want to confine a certain user to be able to bind a node.js server to a certain port. That bit is working. What isn't working is allowing said user to access his own files. audit2allow is telling ...
Jelle De Loecker's user avatar
4 votes
1 answer
12k views

SELinux permissions for LogRotate and Apache

With the directory structure: /www/live/website1/app/ /www/live/website1/files/ /www/live/website1/logs/ Where Apache needs at least the following access: app: read-only access, but read-write is ...
Craig Francis's user avatar
5 votes
2 answers
8k views

RHEL SELinux blocking Apache access to PostgreSQL

I'm running a Django app that uses PostgreSQL. The server is running RHEL 6.5 with SELinux. I'm having an issue where the Django app can't connect to the DB, and I think it's because SELinux is ...
Geoff's user avatar
  • 171
0 votes
1 answer
209 views

My virtual users can't Chroot()

I'm configuring a Proftp server in a Fedora 20 Linux server. All my real users are loging in perfectly but not the case with the virtual users. Virtaul users are in the SQL table and mod_sql.c is ...
Rafael's user avatar
  • 155
0 votes
1 answer
528 views

VSFTPD - 0.00Kbyte/sec - intermittent

I can't get a good connection via FTP to my DigitalOcean server. I set it up following this guide. Symptoms: Sometimes I can upload the file I am working on, sometimes I can not. (same file, same ...
Heath's user avatar
  • 1
2 votes
2 answers
2k views

SELinux preventing /etc/aliases email pipe to script from working

When somebody sends an email to my server, e.g. [email protected] I want it to pipe to a PHP script. So in my /etc/aliases file I have: ...
Daniel Procter's user avatar
5 votes
2 answers
18k views

sftp gives permission denied only when chrooted?

I have configured sshd_conf on my centos box as below: Match group pilots ChrootDirectory /home/pilots ForceCommand internal-sftp X11Forwarding no AllowTcpForwarding no and the directory /home/...
ibrewster's user avatar
  • 397
1 vote
0 answers
348 views

How to write a file from Apache CGI in a user home directory on CentOS

I made a CGI in Python and it works unless I try to write to a file in a user's home. I activated allow_httpd_anon_write and allow_http_sys_script_anon_write to true with graphical tool for ...
Ufo.rob's user avatar
  • 11
1 vote
1 answer
189 views

Do linux security modules (LSM) run on virtual server (vServer)? [closed]

I have a vServer for 10 EUR/month from 1und1 and I know that it is not a dedicated machine (meaning I have less control). I know that I can use some the system as root, yet the kernel is untouchable. ...
humanityANDpeace's user avatar
1 vote
1 answer
853 views

SELinux policy issue

As qemu & KVM are working fine with SELinux out of the box I'd like to enable SELinux to improve guest isolation on my CentOS 6 server. The problem is that I'm using a 3rd parity virtualization ...
justlovingIT's user avatar
5 votes
3 answers
16k views

How to configure SELinux to allow specific services to communicate with Avahi?

I have a service, running on a Fedora 20 machine, that when started attempts to register services with Avahi. This works perfectly if my service is started while SELinux is in permissive mode, but the ...
Louis Daprato's user avatar
2 votes
1 answer
3k views

Apache passphrase working sometimes

On one of my servers I observe the following problem with SSL passphrase: some certs are passing it without asking for a password, while some others keep asking for it. I have set it up globally: ...
nonus25's user avatar
  • 261

1
7 8
9
10 11
14