NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

2
votes
1answer
30 views

docker made fedora host unbootable in selinux enforcing mode

I've done incautiously docker run -v /:/mnt:ro someimage It has resulted with some docker (docker v1.7) daemon error. Since then I can only boot in permissive mode and got lot of selinux errors. ...
2
votes
1answer
286 views

SELinux - CentOSx86_64: User command limitation

SELinux - CentOSx86_64: User command limitation Is SELinux the right tool for this job? If so, what is the best way to do it? I would like to limit a particular user to only running some list of ...
2
votes
1answer
646 views

How to implement and modify policies for Role-based access control on Ubuntu Linux?

Selinux is currently installed on the machine but there's no simple way to enable and modify RBAC for users. Seedit is available for Fedora and CentOS but it is not working on Ubuntu distros. Are ...
1
vote
1answer
76 views

selinux: rwx permissions for a folder

I am facing problems with PHP interface that calls perl and shell scripts. These enable uploading of a file to a folder and execute them with some input while storing output into some other files. Now ...
1
vote
1answer
26 views

SELinux - first attempt to restrict file by type - fails to fail

I have a Centos 6 Linux box. I read tutorials on SELinux and wanted to try it out. Here are steps I followed, set SELINUX=enforcing in /etc/selinux/config turned on SELINUX with setenforce 1 service ...
1
vote
1answer
69 views

Trying to track down why httpd would be trying to connect to a tor port

I'm seeing occasional selinux denied messages in my logs that I believe indicate that the httpd process is trying to connect to a tor port: type=AVC msg=audit(1423247604.799:1966): avc: denied { ...
1
vote
1answer
170 views

auditd auid changes after su

I try to implement individual accountability for my RHEL systems using selinux and the audit.log. I followed the instructions given here: Log all commands run by admins on production servers If I ...
1
vote
1answer
25 views

Disabling network access for a group of users but allowing smtp only

We have an environment where our users ssh into the system and their shell is set to simply launch Mutt on their $HOME/Maildir. We want to restrict our users to only be able to send/receive mail. We ...
1
vote
1answer
864 views

Enable selinux to allow mysql files to be read and written on a nfs share

I have moved my /var/lib/mysql directory to an nfs share, updated all the config files and created symbolic links where appropriate. This works when I have selinux turned off, but mysqld fails to ...
1
vote
1answer
466 views

openssh-lpk - Failed to get default SELinux security context for ldapuser

I'm trying to setup a ssh server with hardened-gentoo sources openssh (with openssh-lpk, which is the ldap flag on gentoo I think) and selinux enabled. On the Ldap-Server I have added an user ...
1
vote
1answer
209 views

PHP won't run on Fedora 15

I have followed this exact tutorial on installing php on a Fedora 15 system. I have all the necessary packages installed with no errors. Yet the simple phpinfo() test page will show - it will show a ...
1
vote
1answer
1k views

Mounted NFS directory not writable by Apache / PHP

Need some help here with NFS. Here's what I have (all servers running CentOS 5.6 with SELinux): 172.17.20.1 - Primary server with static IP. Varnish redirects requests to the web servers. 172.17.20.2 ...
1
vote
1answer
159 views

How to access virtual guest centos on windowsxp remotely

I have installed CentOS(domain 0) as a Base OS then using XEN tool virt-manager, I have created another CentOS5(domU) as virtual guestOS. I can easily access base CentOS(domain 0) by windows ...
0
votes
1answer
65 views

Can't open port

I can't open port 25 and 587. Background information: I am running CentOS 7 with firewalld and httpd. Now I want to run a mailserver. I started with installing postfix. Then I added firewall rules for ...
0
votes
1answer
23 views

pam_tty audit logs gives too much of not required information

We are using pam_tty to record all the commands that user types. We are interested in monitoring the user commands. In the audit.log, when we grep for USER_TTY, there is too much of logging that ...
0
votes
1answer
39 views

libsepol.policydb_read: policydb magic number

I'm trying to create a selinux .te file from a .pp file but the tools on fc22 don't work. Is this a bug or should I be doing something different? Environment: fc22 [root@fc20-64 ~]# rpm -q ...
0
votes
1answer
76 views

Nagios Selinux contexts on RHEL7 equivelant

I installed nagios core and plugins for the first time, and can't get it to work with SElinux. The error in the audit log is, type=AVC msg=audit(1441480084.865:710): avc: denied { execute } for ...
0
votes
1answer
119 views

Why is this HTTP to HTTPS redirection not working?

I have been reading through all the discussions on the subject and decided to use the Redirect method in the httpd.conf file with no luck... So I came back here to this knowledgable crowd. We have a ...
4
votes
0answers
44 views

SELinux: manually changing files in /etc/selinux/targeted/contexts/files/

I'm setting up a CentOS 7 server in which the /home directory has to be located on another partition and then mounted with bind-mount. So: /data/homes should be bind-mounted to /home. The problem is ...
3
votes
0answers
143 views

SSH - 1s hang at “Entering interactive session” (Not DNS; possibly SELinux related)

I'm having an issue on CentOS 6.7 where SSH logins are 1s more than any non-6.7 machines on this network (e.g. 7.2, 5.11). Running debugging on the client side showed the hang at "Entering interactive ...
3
votes
0answers
36 views

View custom selinux policies

Is there a way to view all custom policies applied to SELinux, preferably rolling them all up into one policy "package"? I've just spent the last week or so working through a series of SELinux errors ...
3
votes
0answers
47 views

What's the recommended way to restrict Internet access per process using SELinux?

Before I have tried to do this using a phony user and iptables to execute commands that needs to be restricted. However now the commands need to read configuration set by each user's environment vars ...
2
votes
0answers
32 views

SELinux preventing access to /var/log due to Docker

I have a Docker container that should read logs, including those from the host itself. So I mount the volume /var/log using the z flag. This changes the SELinux context on the files inside /var/log ...
2
votes
0answers
16 views

How can I configure SELinux to let rsyslogd run my program?

I'm trying to use SELinux with a system which has rsyslogd call a binary: # rsyslog configuration file module(load="omprog") template( name="snmp_template" type="string" string="%msg%\007" ) ...
2
votes
0answers
20 views

How do I go about creating a systemd selinux policy domain?

How can I create an selinux policy to govern my systemd unit? I am creating a daemon that will be managed by systemd and I'd like to create an appropriate selinux policy to go with it. I've tried ...
2
votes
0answers
47 views

Finding local ID for SELinux denial under Fedora 23

Trying to get more fluent with SELinux, it looks like sealert -l <local-id> would be a particularly useful way to get help with logged denials. From what I understand, the local IDs used to ...
2
votes
0answers
92 views

how do i inspect the contents of an selinux module?

I would like to view the [textual] contents of an selinux module, say for instance, /etc/selinux/targeted/modules/active/modules/udev.pp. I tried sedismod, but I get the following error on Fedora 21: ...
2
votes
0answers
308 views

Gitolite3 push and selinux access failure

I try to install gitolite3 with ssh and http. I have followed largely the official guide at gitolite3, but I am stumbling accross three remaining problems. When I $ git clone ...
1
vote
0answers
29 views

How do i configure NIS on Fedora 22?

I am trying to configure NIS client on Fedora 22. Following the tutorial http://www.server-world.info/en/note?os=Fedora_22&p=nis&f=2. I have to set SELinux=disable so that folders can be ...
1
vote
0answers
26 views

SELinux for in-house applications

I have a ruby application running on Puma, behind nginx. I want to use SELinux to mitigate the risk of it being used as an entry point to the rest of our system. I couldn't find any reference of ...
1
vote
0answers
86 views

Selinux: Shorewall will not respond to fail2ban

I am using fail2ban with shorewall and my Fedora 21 server & cloud. All flooded with the following error message: SELinux is preventing shorewall from write access on the file ...
1
vote
0answers
133 views

How to power down Cloudstack configured with XenServer Hypervisors

I have three XenServers(6.2) configured in a single pool. I also have a Cloudstack (CentOS 6.5) Management interface controlling them all. Everything is up and running but I can not figure out how to ...
1
vote
0answers
126 views

Possible to prevent access to /tmp for a specific user via SELinux?

I'm sort of learning the edges of SELinux and I'm wondering if it's possible to prevent a specific user from accessing /tmp. Clearly it's a bad idea to dork all permissions, so I'm hoping that ...
1
vote
0answers
20 views

SELinux module for a specific file rather than an entire context

I've created an SELinux module that works great for a specific context. What I would like to know is, is it possible to restrict this module to only function for specific files with that context? For ...
1
vote
0answers
104 views

How to write a file from Apache CGI in a user home directory on CentOS

I made a CGI in Python and it works unless I try to write to a file in a user's home. I activated allow_httpd_anon_write and allow_http_sys_script_anon_write to true with graphical tool for ...
1
vote
0answers
74 views

linux: upload / download difference on network shares

I have a Red Hat Enterprise Linux 6 (with SELinux) which shows significant differences of speed between download and upload (the latter significantly slower) of files shared over the LAN. The ...
1
vote
0answers
74 views

SELinux - Prevent users in the user_t domain from creating sockets

I need untrusted users to execute Ruby and Python scripts via SSH on a Fedora 17 machine with a minimal impact on system integrity and security. A SSH wrapper will ensure only Ruby and Python ...
0
votes
0answers
25 views

snv + http protocols with SElinux

I was asked to run the subversion with http and svn protocols on CentOS 7 os. Installed apache and subversion. The issue arises when apache and subversion are to access the repository. Apache works ...
0
votes
0answers
132 views

systemd apache service start is denied by selinux on centos 7

I am trying to start a custom httpd service from systemd on centos7. on the command line all works fine but from systemd it fails. the command line to start httpd is /usr/sbin/httpd -f ...
0
votes
0answers
57 views

fcoemon: error response from lldpad: error

I have created and configured the red hat cluster and as I was just going through logs to see if every thing is fine, thats when I saw these errors. Not sure whats with these errors. Please advise. ...
0
votes
0answers
15 views

SELinux: Restrict access to /tmp to subfolder

I'm trying to work out an SELinux policy that would allow httpd to have read-write access to a subfolder in /tmp, but not to the parent. Setting httpd_sys_rw_content_t on the subfolder allows the RW ...
0
votes
0answers
82 views

Error 13 when executing mysqldump to export a database into a cvs file

I would like to export my database into a .csv file but I got a problem when I execute the command to do that: mysqldump -u root -p -t -T~/tesht/ database orders --fields-terminated-by=',' ...
0
votes
0answers
18 views

xguest with Biometric validation

I am looking for a solution to the following problem: A server is connected to 'dummy' terminals (all-in-one computers) in an isolated network. These terminals have xguest account that are directly ...
0
votes
0answers
170 views

Fail2Ban Cannot Read NginX Log Files - SELinux - ERROR No file(s) found for glob

I've been having issues with this on and off and I've exhausted my abilities on this. It's a CentOS7 system with SElinux enabled. Fail2Ban works for most jails just fine, very happy with it. My ...
0
votes
0answers
232 views

Suspicious SELinux Audit Log Entries PHP-FPM Write Denied - How to investigate?

I found a few /var/log/audit/audit.log entries which have me a little bit concerned. SEAlert explains them as such: SELinux is preventing /usr/sbin/php-fpm from write access on the directory ...
0
votes
0answers
79 views

semodule -i takes 100% cpu and does not end

I am setting up selinux and ran grep ${1} /var/log/audit/audit.log | audit2allow -r -M local_${1} within an compilation script (oneliner). I'd like to run it like "compile_selinux collectd_t" so ...
0
votes
0answers
246 views

PHPINFO creates Permission Denied in error log

Running CentOS 7 with apache 2.4, using PHP5.6 from REMI repository. My wordpress and phpmyadmin seem to work, however any page that has phpinfo() causes a permission denied entry into my error log. ...
0
votes
0answers
50 views

selinux-policy update prevents ssh into ec2. Now what?

I created a new EC2 instance using the official CentOS 7 (x86_64) HVM image. I ran: yum upgrade At: Running transaction Warning: RPMDB altered outside of yum. Updating : ...
0
votes
0answers
53 views

Setting up muli-project web development server

I'm trying to set up a development server that will be used for several (web) projects by different teams (consisting of different people, some of which may be involved with more than one project). I ...
0
votes
0answers
400 views

Hidden 'neverallow' in selinux policy?

I intend to use 'enforce' selinux mode. First, i boot in permissive mode ( enforcing=0 in kernel cmdline ). After login in system, i collect all selinux policy violation from auditd logs and try to ...