NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

0
votes
3answers
1k views

RHEL6: Selinux not logging AVC denial messages

I'm trying to configure a set of lockdown rules. My approach is to start with a restricted user, and use audit2allow messages to selective add permissions. My problem is that I don't see the expected ...
1
vote
1answer
26 views

SELinux rules in CentOS 7 with Samba and SSSD on Kerberos Ticket generation

I've built a simple File Server with Samba and Netatalk running on CentOS 7.2. Everything is working as expected except for SELinux that's denying Samba to authenticate due to a policy of denying ...
-1
votes
0answers
12 views

running apache on fedora/selinux/no setroubleshoot messages on desktop [migrated]

I have installed fedora 24 installed from scratch via iso image. I have httpd started and can see the default page if I access "localhost". Now I want to add a directory which should contain files ...
0
votes
1answer
8 views

PHP cant connect to postgreSQL in Centos 7 Selinux

After migration to a new VPS and trying website on new server(Centos 7), Selinux somehow prevents http from accessing Postgresql: pg_connect(): Unable to connect to PostgreSQL server: could not ...
0
votes
1answer
20 views

SELinux keeps blocking my Apache instance

I am using CentOS 7 and have set up a duplicate Apache instance using the systemd structure there. I can get both Apaches to run if I use setenforce 0. However, when I setenforce 1, the new Apache ...
2
votes
1answer
102 views

how do i inspect the contents of an selinux module?

I would like to view the [textual] contents of an selinux module, say for instance, /etc/selinux/targeted/modules/active/modules/udev.pp. I tried sedismod, but I get the following error on Fedora 21: ...
0
votes
0answers
6 views

selinux with nfs share how to allow different processes to write

We have a server with an NFS share for all storage stuff. Many processes should have read/write access to this share. For example: squid httpd ejabberd other self written For this question I used ...
1
vote
1answer
2k views

Mounted NFS directory not writable by Apache / PHP

Need some help here with NFS. Here's what I have (all servers running CentOS 5.6 with SELinux): 172.17.20.1 - Primary server with static IP. Varnish redirects requests to the web servers. 172.17.20.2 ...
1
vote
0answers
13 views

xdebug remote centos host from mac

I have a server running CentOS7, PHP7.0.7 with php-fpm, and SELinux. I am trying to debug a PHP script running on that server. And I have a Mac machine that runs PHPstorm where I intend to do the ...
1
vote
1answer
33 views

Allow SELinux, Nginx to read local file and make outbound connection

I am a new admin to a server which uses CentOS 7, nginix and php-fpm. There is a web form that needs to read a local file (prod.pem) and then make an outbound connection to either: gateway.push....
2
votes
1answer
39 views

SELinux on CentOS7-based LXC?

is there any way to enable SELinux on LXC-based container using proxmox 4.2? Thanks in advance!
0
votes
0answers
68 views

Apache configured on Centos 7 to listen for https requests on non-standard port (8443) but from outside the connection is refused

I am working on this for quite some time with researching the Q&A everywhere. Any hints would be most welcome. The setup: small private network at home with router from ISP (Comtrend VR-3026e ...
3
votes
2answers
2k views

How do I allow apache to rotate logs in user home directory with SELinux enabled?

Our development machine has multiple users, and their various sites are stored in /home/username/apache. In these folders are sub-folders like conf containing the virtual host config, logs containing ...
0
votes
4answers
334 views

Disabling SeLinux

I'm not sure if I remember when I installed red hat 5 on my server. So how I can be sure whether selinux is disabled or not?
0
votes
0answers
12 views

CentOS 6 Apache 2.2 SELinux uploaded files 403 forbidden [duplicate]

We are running Magento 1.8.1.0 and for one of the upload folders in *document root*/media, namely the folder wysiwyg SELinux applies rights that makes uploaded content unreachable (403 Forbidden). We ...
1
vote
1answer
33 views

Why won't apache allow symbolic links, with SELinux?

I have a simple scenario: I want to symlink /home/leonard/apache/sandbox/markdown to /home/leonard/github/markdown-editor, so that the markdown-editor can be viewed from my browser. I setup the link ...
0
votes
1answer
11k views

SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0

I kept getting the following notice in apache log when I start apache http server 2.2: SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0 even though I disabled ...
2
votes
0answers
34 views

SELinux preventing access to /var/log due to Docker

I have a Docker container that should read logs, including those from the host itself. So I mount the volume /var/log using the z flag. This changes the SELinux context on the files inside /var/log ...
0
votes
1answer
274 views

SELinux setup for MongoDB

I'm trying to install MongoDB on CentOS 7.2 from the mongodb.org repository. So far so good, but the hoster has created a secondary disk (/mongo) for all the MongoDB data files. This clashes with the ...
2
votes
2answers
229 views

Allowing httpd to run a bash script in /usr/bin/

Migrating a system from CentOS6 to RHEL7 with SELinux running Enforced. A php script makes a call to /usr/bin/processdata.sh to generate some data behind the scenes. This worked fine with the old ...
1
vote
3answers
2k views

Zabbix server SELinux policy

I have a Zabbix server running on a RHEL 7 box and when I use the web front end (on the same box) it says Zabbix server is not running. If I disable SELinux and change nothing else, the web front end ...
0
votes
1answer
67 views

SELinux preventing Asterisk from connecting to IMAP server for voicemail

I am running Asterisk on Fedora 23 and am using the voicemail IMAP module to store voicemails to Gmail. When SELinux is in enforcing mode it prevents Asterisk from connecting to Gmail. Here is the ...
1
vote
3answers
116 views

SELinux blocks nrpe access to MariaDB

I have a few virtual machines in the same LAN monitored by Icinga2 via NRPE. [Machine A] CentOS 6 Icinga2. [Machine B] CentOS 6 MariaDB v10.1.12 properly running Datadir and socket settings ...
2
votes
0answers
22 views

How can I configure SELinux to let rsyslogd run my program?

I'm trying to use SELinux with a system which has rsyslogd call a binary: # rsyslog configuration file module(load="omprog") template( name="snmp_template" type="string" string="%msg%\007" ) ...
7
votes
2answers
11k views

How do I view the contents of a SELinux policy package

As the title says, how do I view the contents of a SELinux policy package? The resulting files end with .pp. I'm running on centos 6, but I guess it's the same way on "all" distros. For example ...
8
votes
1answer
124 views

CentOS 7 - Directories created through VSFTPD not inheriting SELinux contexts

Our company has a webserver with CentOS 7 and our customers manage their websites through FTP (vsftpd). SELinux is in enforcing mode. The issue is that data created/uploadad through VSFTPD is not ...
0
votes
1answer
44 views

libsepol.policydb_read: policydb magic number

I'm trying to create a selinux .te file from a .pp file but the tools on fc22 don't work. Is this a bug or should I be doing something different? Environment: fc22 [root@fc20-64 ~]# rpm -q --...
1
vote
1answer
44 views

centos 7 & SELinux & ldconfig

Have Centos 7 virtual instance running on a shared host. They using VMWare vSphere hypervisor. It is a customized minimal install plus openssh and vmware tools. All updates applied. SELinux is ...
2
votes
0answers
24 views

How do I go about creating a systemd selinux policy domain?

How can I create an selinux policy to govern my systemd unit? I am creating a daemon that will be managed by systemd and I'd like to create an appropriate selinux policy to go with it. I've tried ...
1
vote
3answers
134 views

proftpd is accessing my.cnf

I use proftpd for virtual FTP hosting with MySQL. I've started writing fine-grained SELinux policies and found that it's trying to access my.cnf files. Question is what for and why? type=AVC msg=...
1
vote
1answer
76 views

SELinux context for apache ldap ssl

Question What SELinux context do I need, for what file to get apache ldap (over ssl) auth to work? Or is it a network protocol or system call or something else entirely? Environment Apache 2.4 on ...
1
vote
1answer
59 views

Change selinux context for TLS cacert.pem

I need to make /etc/pki/CA/certs/cacert.pem have the same context as all the other files in /etc/pki: system_u:object_r:cert_t:s0 Tried restorecon -vR /etc/pki and semanage fcontext but the file ...
0
votes
1answer
46 views

Wrong SELinux labels on NFS homes?

I have NFS (v4) home directories. The NFS server is a Synology (DSM 5.2), the client is a FC 23. The client gets autofs settings from a freeIPA server: ipa automountmap-add default auto.home ipa ...
1
vote
2answers
316 views

How can I tell SELinux to permit nginx access to a unix socket without audit2allow?

I have nginx forwarding requests to gunicorn via a unix socket at /run/gunicorn/socket. By default, this behavior is not permitted by SELinux: grep nginx /var/log/audit/audit.log type=SERVICE_START ...
0
votes
1answer
142 views

VSFTPD - 0.00Kbyte/sec - intermittent

I can't get a good connection via FTP to my DigitalOcean server. I set it up following this guide. Symptoms: Sometimes I can upload the file I am working on, sometimes I can not. (same file, same ...
2
votes
2answers
2k views

New Dovecot install not allowing login, giving permissions error despite saying that permissions “appear ok”

I'm installing dovecot onto a Virtualbox VM running Ubuntu Server 64-bit 14.04 guest. Dovecot itself is being installed into a Docker container (I'm not sure that that's relevant here, but am noting ...
1
vote
1answer
45 views

selinux mls ssh getting denied dyntransition - login failure

I am trying to learn SELinux and going though the Red Hat documentation for RHEL 7. I came upon the documentation for Multi Layer Security (MLS) and wanted to try it, so I set SELINUXTYPE=mls and ...
0
votes
1answer
24 views

pam_tty audit logs gives too much of not required information

We are using pam_tty to record all the commands that user types. We are interested in monitoring the user commands. In the audit.log, when we grep for USER_TTY, there is too much of logging that ...
0
votes
1answer
68 views

Can't open port

I can't open port 25 and 587. Background information: I am running CentOS 7 with firewalld and httpd. Now I want to run a mailserver. I started with installing postfix. Then I added firewall rules for ...
1
vote
1answer
666 views

pure-ftpd auth blocked by SELinux

First, my setup. I'm using CentOS 6.4 and I installed pure-ftpd (plus the SELinux module) from the EPEL repositories : > rpm -q pure-ftpd pure-ftpd-selinux pure-ftpd-1.0.30-1.el6.x86_64 pure-ftpd-...
-2
votes
1answer
28 views

How we can see SElinux policies running on a centos system?? [closed]

I am given with an assignment that how we can see what selinux policies are running on a system(centos), as i am a new and dont know about the system
2
votes
1answer
89 views

use Sudo in apache

I am using CentOS 6 and trying to call sudo in Apache using this command: exec("sudo -u kouser whoami 2>&1",$output,$code); However SElinux add a line to output array(2) { [0]=> ...
1
vote
0answers
25 views

snv + http protocols with SElinux

I was asked to run the subversion with http and svn protocols on CentOS 7 os. Installed apache and subversion. The issue arises when apache and subversion are to access the repository. Apache works ...
2
votes
1answer
137 views

SElinux sandbox fails to start from systemd service

I have a server that runs user submitted code, for evaluation. I wrote a systemd service that starts a python application, that application then run the submitted code using SElinux sandbox. The ...
3
votes
2answers
4k views

How can I tell SELinux to give vsftpd write access in a specific directory?

I've set up vsftpd on my Fedora 12 server, and I'd like to have the following configuration. Each user should have access to: his home directory (/home/USER); the web directory I created for him (/...
2
votes
3answers
147 views

Can't apply SELinux file context to paths with symlinks

I have a solution that is being installed in an enterprise environment. The solution and its deployment guide are designed to installed on a RHEL7/CentOS7 server with SELinux enabled and components ...
6
votes
1answer
924 views

How to enable SELinux inside of a CentOS Docker container?

I am trying to install SELinux inside of a Docker container in order to distribute an application that uses SELinux internally. The default CentOS image does not have SELinux installed: $ docker run ...
4
votes
1answer
5k views

How should I configure SELinux when running nginx inside Docker

There's a good article in Docker's documentation about security with Docker: https://docs.docker.com/articles/security/ However, it's not very clear to me how root-privileged processes in the ...
1
vote
3answers
5k views

CentOS 6: PHP can not load gdchart.so and oci8.so compiled by me

I have been trying to add 2 PHP extensions to a freshly installed CentOS 6.0 Linux server, but get the error messages in /var/log/httpd/error_log: [notice] SELinux policy enabled; httpd running as ...
0
votes
1answer
204 views

Reading home files permission: Policy constraint violation

I want to confine a certain user to be able to bind a node.js server to a certain port. That bit is working. What isn't working is allowing said user to access his own files. audit2allow is telling ...