NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

0
votes
0answers
10 views

SELinux - Create custom Context [on hold]

I need to create custom selinux rules for some applications that are not already have selinux context, So How can i create custom SE-Linux types, users and roles in SE-Linux.
1
vote
1answer
23 views

Dovecot SELinux MailDir permission denied

I have dovecot installed on CentOS 7.1. In the past, I have often just disabled SELinux, but now I want to have a server with SELinux that works for me. Anyhow, I have mail stored in ...
0
votes
1answer
47 views

Why is this HTTP to HTTPS redirection not working?

I have been reading through all the discussions on the subject and decided to use the Redirect method in the httpd.conf file with no luck... So I came back here to this knowledgable crowd. We have a ...
2
votes
0answers
215 views

selinux “Possible mismatch between this policy…”

How do I go about troubleshooting the following error below: type=AVC msg=audit(1365523330.609:4846): avc: denied { append } for pid=12542 comm="FTPMan.pl" name="user_list" dev=dm-0 ino=2884237 ...
-1
votes
0answers
14 views

Settings not being saved in phpmyadmin [on hold]

On a new install of phpmyadmin on CentOS 7, I managed to get phpmyadmin installed without much issue. However, whenever I make any changes to the settings in phpmyadmin, they revert back to the ...
1
vote
4answers
1k views

Selinux blocks wordpress in CentOS 6.3

I installed wordpress 3.5 to CentOS 6.3 using command: yum install wordpress and started httpd. Now I can see the following error in apache log: PHP Fatal error: require_once(): Failed opening ...
0
votes
1answer
1k views

Mounted NFS directory not writable by Apache / PHP

Need some help here with NFS. Here's what I have (all servers running CentOS 5.6 with SELinux): 172.17.20.1 - Primary server with static IP. Varnish redirects requests to the web servers. 172.17.20.2 ...
2
votes
1answer
76 views

SELinux on CentOS not working

i'm new to CentOS and trying to enable SELinux and it's not working after a restart as described on ...
0
votes
1answer
35 views

What are soundd daemons, and why does nginx need the type under SELinux?

Curious what is soundd daemon. The wiki at http://wiki.centos.org/TipsAndTricks/SelinuxBooleans says it is "soundd daemon" but I'm not finding much additional info on internet. To get nginx ...
1
vote
1answer
43 views

Creating an SELINUX allow rule for sockets error with clamd

I've got a CentOS 7 box configured as a Squid proxy, with clamav and Squidclamav. Normally I would just disable SELINUX, but I am attempting to understand and setup allow rules properly. I've managed ...
1
vote
1answer
89 views

auditd auid changes after su

I try to implement individual accountability for my RHEL systems using selinux and the audit.log. I followed the instructions given here: Log all commands run by admins on production servers If I ...
2
votes
3answers
2k views

(13) Permission denied on Apache CGI attempt

I have recently upgraded my Apache2 server, and am now unable to run a CGI app. My logs are showing (13) Permission denied unable to connect to cgi deamon after multiple tries I understand that the ...
0
votes
2answers
59 views

SSH works but tunneling or SFTP doesn't. Why?

since 2014 I've got a server from SoYouStart, with Centos 7. It worked perfectly, but now I had to install again the OS. Now I'm configuring all the services to work again. I need to connect to the ...
0
votes
2answers
1k views

LDAP user authentication on CentOS 7: Permission denied

I configured LDAP on CentOs 7 and now I'm trying to configure external user authentication. Browsing I found this: https://www.centos.org/docs/5/html/Deployment_Guide-en-US/s1-ldap-pam.html that is ...
2
votes
1answer
17 views

Find modified selinux booleans

I have a CentOS 6.6 server that was setup by someone else. I'll be recreating this server from scratch on a new box and I'm wondering if there is any way I can find out what selinux booleans have been ...
0
votes
2answers
36 views

Add custom 'allow' policy in SELinux

I would like allow httpd to executed files from a user's home directory. From audit2allow I understand that this implies the following policy: allow httpd_t user_home_t:file execute; How do I turn ...
1
vote
3answers
52 views

How to disable SELINUX for systemd script?

I have a systemd script in CentOS 7 which doesn't run properly unless I disable SELINUX. Is it possible to somehow have SELINUX enabled on the system but disable it only for this systemd script? The ...
2
votes
3answers
75 views

SELinux restrict Apache/PHP access

I installed a minimal CentOS system with Apache, PHP and SELinux in a default configuration: SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root ...
1
vote
3answers
2k views

Home directories created with wrong Selinux context

[root@tst-01 home]# ls -Z drwxr-xr-x. ujjain users system_u:object_r:home_root_t:s0 ujjain drwxr-xr-x. johndoe users system_u:object_r:home_root_t:s0 johndoe The selinux ...
1
vote
0answers
33 views

Selinux: Shorewall will not respond to fail2ban

I am using fail2ban with shorewall and my Fedora 21 server & cloud. All flooded with the following error message: SELinux is preventing shorewall from write access on the file ...
2
votes
2answers
2k views

Boot hanging on SELINUX?

SELINUX is disabled on this this machine (which is a CentOS instance under Xen) but the boot process gets to a point that mentions an audit and SELINUX and then hangs. Is it ever going to come back? ...
0
votes
1answer
67 views

CentOS 7 Cannot delete ports defined for MongoDB

I installed and later removed the MongoDB server on a CentOS 7 box. While cleaning up, I noticed that the ports assigned to MongoDB were still open. if I remember correctly, I was able to delete the ...
0
votes
1answer
201 views

Docker 1.6.0 on RHEL 6.5 with SELinux, can't run containers without root

I'm trying to run a container on a RHEL 6.5 but I keep hitting this problem: sudo docker run -u postgres -it registry/postgres /bin/bash /bin/bash: error while loading shared libraries: ...
10
votes
5answers
6k views

Trying to SSH in to remote computer but still asking for password

Trying to SSH in to remote computer but still asking for password. I have a number of computers running SElinux and only one of them is giving me a hard time using ssh without the password. I did ...
15
votes
3answers
8k views

SElinux: allow httpd to connect to a specific port

My system is running CentOS 6.4 with apache2.2.15. SElinux is enforcing and I'm trying to connect to a local instance of redis through my python/wsgi app. I get Error 13, Permission denied. I could ...
2
votes
1answer
87 views

Selinux semanage delete or modify chain

I use on all my server port 24 for SSH. After change port i got error because Selinux block server SSHD restart 4 08:08:02 kvm452 sshd[18297]: error: Bind to port 24 on 0.0.0.0 failed: Permission ...
2
votes
0answers
77 views

Init script has permissions issues, but running with /bin/sh resolves them? [closed]

Can someone tell me what's going on here? As far as I knew, these ways of executing an init script are identical. box:~# whoami root box:~# /etc/init.d/nginx restart nginx: [emerg] open() ...
0
votes
1answer
49 views

SELinux - mysql/ and httpdoc/ in same folder?

Looks like my old faithful LAMP directory structure has come unstuck with SELinux. I prefer everything in the same place. CentOS 6.6 Apache 2.2.15 MySQL 6.5 /DATA/ /DATA/httpdocs/ /DATA/mysql/ ...
0
votes
1answer
264 views

Sharing Collectd data with Apache on CentOS (SELinux)

My CentOS 7 VPS has SELinux enabled and is monitored by Collectd. It uses rrdtool to log the reported data. Pommi released a great solution that made me able to review all data on a webpage called CGP ...
2
votes
1answer
219 views

What I have to modify to have SELinux allow nginx to act as an IMAP/POP3 proxy?

By default nginx under CentOS 7 will fail to start if used as an IMAP/POP proxy. This is because of SELinux. How can SELinux's configuration be altered, without disabling its protections, to allow ...
1
vote
1answer
95 views

Moved /home to new disk, SELinux denying access to /home for sshd

Yesterday I added a drive to a Centos6 VM box, created a /home mount point on the drive and then moved a user (jenkins in this case) to it to free up space from the / mount point. This seemed to work ...
2
votes
2answers
168 views

SELinux - logrotate is not rotating NGINX logs

I am using CentOS, NGINX and Passenger to serve a Rails application. I have SELinux activated, and have had a series of problems with logrotate. I have been able to resolve most of the issues by ...
1
vote
1answer
24 views

SELinux - first attempt to restrict file by type - fails to fail

I have a Centos 6 Linux box. I read tutorials on SELinux and wanted to try it out. Here are steps I followed, set SELINUX=enforcing in /etc/selinux/config turned on SELINUX with setenforce 1 service ...
2
votes
3answers
587 views

SELinux preventing Apache from writing to a file

SELinux is preventing the apache user from writing to a log file which it owns. When I do setenforce 0 it works. Otherwise it shows this error IOError: [Errno 13] Permission denied: ...
0
votes
0answers
146 views

Reading home files permission: Policy constraint violation

I want to confine a certain user to be able to bind a node.js server to a certain port. That bit is working. What isn't working is allowing said user to access his own files. audit2allow is telling ...
1
vote
1answer
44 views

Log/Audit everything allowed by SELinux

I'm profiling some proprietary software to construct a set of permission requirements and SELinux policies to allow it to install and run on Oracle Linux (or any RHEL derivative). I'm running SELinux ...
1
vote
0answers
72 views

SElinux sandbox fails to start from systemd service

I have a server that runs user submitted code, for evaluation. I wrote a systemd service that starts a python application, that application then run the submitted code using SElinux sandbox. The ...
1
vote
1answer
48 views

Trying to track down why httpd would be trying to connect to a tor port

I'm seeing occasional selinux denied messages in my logs that I believe indicate that the httpd process is trying to connect to a tor port: type=AVC msg=audit(1423247604.799:1966): avc: denied { ...
0
votes
0answers
48 views

Setting up muli-project web development server

I'm trying to set up a development server that will be used for several (web) projects by different teams (consisting of different people, some of which may be involved with more than one project). I ...
1
vote
0answers
86 views

How to power down Cloudstack configured with XenServer Hypervisors

I have three XenServers(6.2) configured in a single pool. I also have a Cloudstack (CentOS 6.5) Management interface controlling them all. Everything is up and running but I can not figure out how to ...
0
votes
0answers
49 views

How to work whit socket_file httpd (nginx-uwsgi)

I am trying to run Nginx/uWSGI/Django, the last remaining step is to run the socket_file all I get is a 502 Bad Gateway. Route my django application. #/home/deploy/webapps/myapp Configuration ...
0
votes
1answer
81 views

Selinux “Add context Rule to Semanage” [closed]

As you add or change a new rule to fcontext semanage to any directory and apply, egg: # How to add this rule for apply changes whit restoreconf -Rv /var/www/html(/.*)?/media(/.*)? ...
1
vote
1answer
216 views

SELINUX blocking php-fpm and nginx working together?

I'm having some issues with SELINUX. When trying to visit my website I get 403 forbidden from nginx and the server pops up with an error and says to use grep NGINX /var/log/audit/audit.log | ...
0
votes
1answer
45 views

ports to open to access samba share

When I turn off my iptables service, I can successfully list my samba shares. But when I turn it back on, I cannot access them at all. Also, my SELINUX is set to permissive Here is my current ...
3
votes
2answers
1k views

CentOS - semanage - Adding Custom Port Fails

I recently upgraded one of my application servers to CentOS 6(.2) and was getting it ready for production use when I can across the following issue; Whenever I try to add a custom http port by way of ...
0
votes
0answers
105 views

PHPINFO creates Permission Denied in error log

Running CentOS 7 with apache 2.4, using PHP5.6 from REMI repository. My wordpress and phpmyadmin seem to work, however any page that has phpinfo() causes a permission denied entry into my error log. ...
1
vote
5answers
331 views

How do you secure the “gallery” photo gallery?

Are there any special steps that should be taken to secure Gallery? Specifically, I currently have the Fedora RPM gallery2-2.3-1.fc8 installed. I do have selinux enabled in targeted mode, which is a ...
1
vote
2answers
409 views

Zabbix server SELinux policy

I have a Zabbix server running on a RHEL 7 box and when I use the web front end (on the same box) it says Zabbix server is not running. If I disable SELinux and change nothing else, the web front end ...
-1
votes
1answer
257 views

Configure Nginx as Reverse Proxy with Apache2 on CentOS7 enabled with SELinux

I'm working on a project for academic purposes, the goal is to use Nginx as a Reverse Proxy for Apache, so far i've installed Nginx and everything is ok, it's listening to port 80, but when i was ...
1
vote
1answer
171 views

SELinux Permissive enabled; httpd error reporting

I kept getting the following notice in apache /var/log/messages and many others same messages : kernel: type=1400 audit(1422862414.790:3222): avc: denied { getattr } for pid=2484 comm="deliver" ...