NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

0
votes
0answers
10 views

CentOS 6 Apache 2.2 SELinux uploaded files 403 forbidden [duplicate]

We are running Magento 1.8.1.0 and for one of the upload folders in *document root*/media, namely the folder wysiwyg SELinux applies rights that makes uploaded content unreachable (403 Forbidden). We ...
1
vote
1answer
22 views

Why won't apache allow symbolic links, with SELinux?

I have a simple scenario: I want to symlink /home/leonard/apache/sandbox/markdown to /home/leonard/github/markdown-editor, so that the markdown-editor can be viewed from my browser. I setup the link ...
1
vote
1answer
1k views

Mounted NFS directory not writable by Apache / PHP

Need some help here with NFS. Here's what I have (all servers running CentOS 5.6 with SELinux): 172.17.20.1 - Primary server with static IP. Varnish redirects requests to the web servers. 172.17.20.2 ...
-1
votes
0answers
25 views

CentoOS / Apache Cant reach webserver [on hold]

I have CentoOS 7.2 and Apache/2.4.6 The Iptables are disabled/stopped. SeLinux is also disabled. setenforce 0 I can ping the sites on my vhosts list from outside the network and also can ping others ...
0
votes
1answer
10k views

SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0

I kept getting the following notice in apache log when I start apache http server 2.2: SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0 even though I disabled ...
2
votes
0answers
30 views

SELinux preventing access to /var/log due to Docker

I have a Docker container that should read logs, including those from the host itself. So I mount the volume /var/log using the z flag. This changes the SELinux context on the files inside /var/log ...
0
votes
1answer
78 views

SELinux setup for MongoDB

I'm trying to install MongoDB on CentOS 7.2 from the mongodb.org repository. So far so good, but the hoster has created a secondary disk (/mongo) for all the MongoDB data files. This clashes with the ...
2
votes
2answers
181 views

Allowing httpd to run a bash script in /usr/bin/

Migrating a system from CentOS6 to RHEL7 with SELinux running Enforced. A php script makes a call to /usr/bin/processdata.sh to generate some data behind the scenes. This worked fine with the old ...
1
vote
3answers
2k views

Zabbix server SELinux policy

I have a Zabbix server running on a RHEL 7 box and when I use the web front end (on the same box) it says Zabbix server is not running. If I disable SELinux and change nothing else, the web front end ...
0
votes
1answer
51 views

SELinux preventing Asterisk from connecting to IMAP server for voicemail

I am running Asterisk on Fedora 23 and am using the voicemail IMAP module to store voicemails to Gmail. When SELinux is in enforcing mode it prevents Asterisk from connecting to Gmail. Here is the ...
1
vote
3answers
85 views

SELinux blocks nrpe access to MariaDB

I have a few virtual machines in the same LAN monitored by Icinga2 via NRPE. [Machine A] CentOS 6 Icinga2. [Machine B] CentOS 6 MariaDB v10.1.12 properly running Datadir and socket settings ...
-1
votes
0answers
28 views

Centos 7 vsftpd - cannot modify files or rename folders - no write permission

I have just installed fresh centos 7 relase and i try to configure an vsftpd server. Server is set to use local users. Want i want to achive is to be able to write to /var/www/html There are ...
2
votes
0answers
15 views

How can I configure SELinux to let rsyslogd run my program?

I'm trying to use SELinux with a system which has rsyslogd call a binary: # rsyslog configuration file module(load="omprog") template( name="snmp_template" type="string" string="%msg%\007" ) ...
7
votes
2answers
11k views

How do I view the contents of a SELinux policy package

As the title says, how do I view the contents of a SELinux policy package? The resulting files end with .pp. I'm running on centos 6, but I guess it's the same way on "all" distros. For example ...
8
votes
1answer
94 views

CentOS 7 - Directories created through VSFTPD not inheriting SELinux contexts

Our company has a webserver with CentOS 7 and our customers manage their websites through FTP (vsftpd). SELinux is in enforcing mode. The issue is that data created/uploadad through VSFTPD is not ...
0
votes
1answer
33 views

libsepol.policydb_read: policydb magic number

I'm trying to create a selinux .te file from a .pp file but the tools on fc22 don't work. Is this a bug or should I be doing something different? Environment: fc22 [root@fc20-64 ~]# rpm -q ...
1
vote
1answer
36 views

centos 7 & SELinux & ldconfig

Have Centos 7 virtual instance running on a shared host. They using VMWare vSphere hypervisor. It is a customized minimal install plus openssh and vmware tools. All updates applied. SELinux is ...
2
votes
0answers
20 views

How do I go about creating a systemd selinux policy domain?

How can I create an selinux policy to govern my systemd unit? I am creating a daemon that will be managed by systemd and I'd like to create an appropriate selinux policy to go with it. I've tried ...
1
vote
3answers
132 views

proftpd is accessing my.cnf

I use proftpd for virtual FTP hosting with MySQL. I've started writing fine-grained SELinux policies and found that it's trying to access my.cnf files. Question is what for and why? type=AVC ...
1
vote
1answer
35 views

SELinux context for apache ldap ssl

Question What SELinux context do I need, for what file to get apache ldap (over ssl) auth to work? Or is it a network protocol or system call or something else entirely? Environment Apache 2.4 on ...
1
vote
1answer
39 views

Change selinux context for TLS cacert.pem

I need to make /etc/pki/CA/certs/cacert.pem have the same context as all the other files in /etc/pki: system_u:object_r:cert_t:s0 Tried restorecon -vR /etc/pki and semanage fcontext but the file ...
0
votes
1answer
25 views

Wrong SELinux labels on NFS homes?

I have NFS (v4) home directories. The NFS server is a Synology (DSM 5.2), the client is a FC 23. The client gets autofs settings from a freeIPA server: ipa automountmap-add default auto.home ipa ...
1
vote
2answers
146 views

How can I tell SELinux to permit nginx access to a unix socket without audit2allow?

I have nginx forwarding requests to gunicorn via a unix socket at /run/gunicorn/socket. By default, this behavior is not permitted by SELinux: grep nginx /var/log/audit/audit.log type=SERVICE_START ...
0
votes
1answer
134 views

VSFTPD - 0.00Kbyte/sec - intermittent

I can't get a good connection via FTP to my DigitalOcean server. I set it up following this guide. Symptoms: Sometimes I can upload the file I am working on, sometimes I can not. (same file, same ...
2
votes
2answers
2k views

New Dovecot install not allowing login, giving permissions error despite saying that permissions “appear ok”

I'm installing dovecot onto a Virtualbox VM running Ubuntu Server 64-bit 14.04 guest. Dovecot itself is being installed into a Docker container (I'm not sure that that's relevant here, but am noting ...
1
vote
1answer
31 views

selinux mls ssh getting denied dyntransition - login failure

I am trying to learn SELinux and going though the Red Hat documentation for RHEL 7. I came upon the documentation for Multi Layer Security (MLS) and wanted to try it, so I set SELINUXTYPE=mls and ...
0
votes
1answer
22 views

pam_tty audit logs gives too much of not required information

We are using pam_tty to record all the commands that user types. We are interested in monitoring the user commands. In the audit.log, when we grep for USER_TTY, there is too much of logging that ...
0
votes
1answer
55 views

Can't open port

I can't open port 25 and 587. Background information: I am running CentOS 7 with firewalld and httpd. Now I want to run a mailserver. I started with installing postfix. Then I added firewall rules for ...
1
vote
1answer
631 views

pure-ftpd auth blocked by SELinux

First, my setup. I'm using CentOS 6.4 and I installed pure-ftpd (plus the SELinux module) from the EPEL repositories : > rpm -q pure-ftpd pure-ftpd-selinux pure-ftpd-1.0.30-1.el6.x86_64 ...
-2
votes
1answer
27 views

How we can see SElinux policies running on a centos system?? [closed]

I am given with an assignment that how we can see what selinux policies are running on a system(centos), as i am a new and dont know about the system
2
votes
1answer
51 views

use Sudo in apache

I am using CentOS 6 and trying to call sudo in Apache using this command: exec("sudo -u kouser whoami 2>&1",$output,$code); However SElinux add a line to output array(2) { [0]=> ...
0
votes
0answers
23 views

snv + http protocols with SElinux

I was asked to run the subversion with http and svn protocols on CentOS 7 os. Installed apache and subversion. The issue arises when apache and subversion are to access the repository. Apache works ...
2
votes
1answer
125 views

SElinux sandbox fails to start from systemd service

I have a server that runs user submitted code, for evaluation. I wrote a systemd service that starts a python application, that application then run the submitted code using SElinux sandbox. The ...
2
votes
2answers
4k views

How can I tell SELinux to give vsftpd write access in a specific directory?

I've set up vsftpd on my Fedora 12 server, and I'd like to have the following configuration. Each user should have access to: his home directory (/home/USER); the web directory I created for him ...
2
votes
3answers
123 views

Can't apply SELinux file context to paths with symlinks

I have a solution that is being installed in an enterprise environment. The solution and its deployment guide are designed to installed on a RHEL7/CentOS7 server with SELinux enabled and components ...
5
votes
1answer
531 views

How to enable SELinux inside of a CentOS Docker container?

I am trying to install SELinux inside of a Docker container in order to distribute an application that uses SELinux internally. The default CentOS image does not have SELinux installed: $ docker run ...
4
votes
1answer
4k views

How should I configure SELinux when running nginx inside Docker

There's a good article in Docker's documentation about security with Docker: https://docs.docker.com/articles/security/ However, it's not very clear to me how root-privileged processes in the ...
1
vote
3answers
5k views

CentOS 6: PHP can not load gdchart.so and oci8.so compiled by me

I have been trying to add 2 PHP extensions to a freshly installed CentOS 6.0 Linux server, but get the error messages in /var/log/httpd/error_log: [notice] SELinux policy enabled; httpd running as ...
0
votes
1answer
195 views

Reading home files permission: Policy constraint violation

I want to confine a certain user to be able to bind a node.js server to a certain port. That bit is working. What isn't working is allowing said user to access his own files. audit2allow is telling ...
3
votes
2answers
28k views

How to solve “403 Forbidden” on CentOS6 with SELinux Disabled?

I have a machine on Linode that is driving me crazy. Linode does not have SELinux on CentOS6. I'm trying to configure to put my website in /home/websites/public_html/mysite.com/public. As I don't ...
11
votes
6answers
11k views

Trying to SSH in to remote computer but still asking for password

Trying to SSH in to remote computer but still asking for password. I have a number of computers running SElinux and only one of them is giving me a hard time using ssh without the password. I did ...
4
votes
0answers
40 views

SELinux: manually changing files in /etc/selinux/targeted/contexts/files/

I'm setting up a CentOS 7 server in which the /home directory has to be located on another partition and then mounted with bind-mount. So: /data/homes should be bind-mounted to /home. The problem is ...
0
votes
0answers
108 views

systemd apache service start is denied by selinux on centos 7

I am trying to start a custom httpd service from systemd on centos7. on the command line all works fine but from systemd it fails. the command line to start httpd is /usr/sbin/httpd -f ...
0
votes
0answers
50 views

fcoemon: error response from lldpad: error

I have created and configured the red hat cluster and as I was just going through logs to see if every thing is fine, thats when I saw these errors. Not sure whats with these errors. Please advise. ...
2
votes
2answers
31 views

SELinux create custom role

I have a folder shared out via Samba, and a Docker container which I would like to give access to said folder by adding it as a volume to the Docker container (yes, I know that's not portable). ...
0
votes
0answers
13 views

SELinux: Restrict access to /tmp to subfolder

I'm trying to work out an SELinux policy that would allow httpd to have read-write access to a subfolder in /tmp, but not to the parent. Setting httpd_sys_rw_content_t on the subfolder allows the RW ...
0
votes
0answers
8 views

Http request blocked on port 80 [duplicate]

I currently have Centos 7 installed on EC2 with the following: Apache Php Mysql Iptables Firewalld Apache running Redirecting to /bin/systemctl status httpd.service ● httpd.service - The ...
0
votes
1answer
30 views

can access virtualhost locally on the same server but cannot access on remote machine

A pretty wired problem occured when configure a virtualhost at port 81. When I use command curl 123.123.123.123:81 or curl localhost:81 in the same server, it got response. While when I access it ...
3
votes
0answers
126 views

SSH - 1s hang at “Entering interactive session” (Not DNS; possibly SELinux related)

I'm having an issue on CentOS 6.7 where SSH logins are 1s more than any non-6.7 machines on this network (e.g. 7.2, 5.11). Running debugging on the client side showed the hang at "Entering interactive ...
1
vote
1answer
584 views

SElinux on Debian Jessie missing default policy

I want to enable SElinux on Debian Jessie. In order to do this, I followed the guide on https://wiki.debian.org/SELinux/Setup. However, when I run the apt-get command, the selinux-policy-default ...