NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

1
vote
2answers
541 views

'/var/spool/cron' is not a directory, bailing out. when trying to work with crontab via PHP's shell_exec

I am creating a web application. Part of the functionality is depending on that the user can start/stop a cronjob that imports emails. It doesn't work. Just to make sure I'm on the right track, as ...
1
vote
2answers
415 views

Relabeling of filesystems (SELinux) fails

After compiling the policy modules and re-compiling my core packages (Gentoo 32bit) I wanted to relabel the filesystems (via rlpkg -a -r) and packages but I get these error messages: Relabeling ...
0
votes
2answers
513 views

PHP Fatal error: date(): Timezone database is corrupt

I installed wordpress to CentOS from EPEL: yum install wordpress And it can only work if I manually disable SELinux. Otherwise I see this error: PHP Fatal error: date(): Timezone database is ...
0
votes
2answers
413 views

Can't open/forward port with Fedora15

I've got a server running Fedora 15. My end goal is to be able to forward any protocol over random port numbers (specified via iptables rules.) Let's say, for the time being, I want to forward port ...
3
votes
1answer
161 views

What's the correct SELinux type for a directory?

If I create a new filesystem/directory off of / and I set the Linux permissions to 770 I expect the group to be able to read and write files in that directory. SELinux was preventing me from doing ...
2
votes
1answer
223 views

SELinux - CentOSx86_64: User command limitation

SELinux - CentOSx86_64: User command limitation Is SELinux the right tool for this job? If so, what is the best way to do it? I would like to limit a particular user to only running some list of ...
2
votes
1answer
504 views

How to implement and modify policies for Role-based access control on Ubuntu Linux?

Selinux is currently installed on the machine but there's no simple way to enable and modify RBAC for users. Seedit is available for Fedora and CentOS but it is not working on Ubuntu distros. Are ...
1
vote
1answer
23 views

SELinux - first attempt to restrict file by type - fails to fail

I have a Centos 6 Linux box. I read tutorials on SELinux and wanted to try it out. Here are steps I followed, set SELINUX=enforcing in /etc/selinux/config turned on SELINUX with setenforce 1 service ...
1
vote
1answer
40 views

Trying to track down why httpd would be trying to connect to a tor port

I'm seeing occasional selinux denied messages in my logs that I believe indicate that the httpd process is trying to connect to a tor port: type=AVC msg=audit(1423247604.799:1966): avc: denied { ...
1
vote
1answer
101 views

SELinux Permissive enabled; httpd error reporting

I kept getting the following notice in apache /var/log/messages and many others same messages : kernel: type=1400 audit(1422862414.790:3222): avc: denied { getattr } for pid=2484 comm="deliver" ...
1
vote
1answer
23 views

Disabling network access for a group of users but allowing smtp only

We have an environment where our users ssh into the system and their shell is set to simply launch Mutt on their $HOME/Maildir. We want to restrict our users to only be able to send/receive mail. We ...
1
vote
1answer
535 views

Enable selinux to allow mysql files to be read and written on a nfs share

I have moved my /var/lib/mysql directory to an nfs share, updated all the config files and created symbolic links where appropriate. This works when I have selinux turned off, but mysqld fails to ...
1
vote
1answer
467 views

SElinux process killed while trying to set boolean

I've got a strange problem. I can not allow apache to connect to database at my CentOC 6.4 box: [root@centos6 ~]# setsebool -P httpd_can_network_connect on Killed [root@centos6 ~]# sestatus -b | grep ...
1
vote
1answer
325 views

openssh-lpk - Failed to get default SELinux security context for ldapuser

I'm trying to setup a ssh server with hardened-gentoo sources openssh (with openssh-lpk, which is the ldap flag on gentoo I think) and selinux enabled. On the Ldap-Server I have added an user ...
1
vote
1answer
189 views

PHP won't run on Fedora 15

I have followed this exact tutorial on installing php on a Fedora 15 system. I have all the necessary packages installed with no errors. Yet the simple phpinfo() test page will show - it will show a ...
1
vote
1answer
159 views

How to access virtual guest centos on windowsxp remotely

I have installed CentOS(domain 0) as a Base OS then using XEN tool virt-manager, I have created another CentOS5(domU) as virtual guestOS. I can easily access base CentOS(domain 0) by windows ...
0
votes
1answer
72 views

Docker 1.6.0 on RHEL 6.5 with SELinux, can't run containers without root

I'm trying to run a container on a RHEL 6.5 but I keep hitting this problem: sudo docker run -u postgres -it registry/postgres /bin/bash /bin/bash: error while loading shared libraries: ...
0
votes
1answer
755 views

LDAP user authentication on CentOS 7: Permission denied

I configured LDAP on CentOs 7 and now I'm trying to configure external user authentication. Browsing I found this: https://www.centos.org/docs/5/html/Deployment_Guide-en-US/s1-ldap-pam.html that is ...
0
votes
1answer
65 views

httpd trying to access root-owned session files

While looking into what's been causing a server to lock up/crash, I found many selinux messages in /var/log/messages. For example: setroubleshoot: SELinux is preventing /usr/sbin/httpd from getattr ...
0
votes
1answer
302 views

Centos 7 with SElinux: openvpn and DNS

I'm trying to use openvpn as client on centos 7. It works fine, but i cannot get DNS from server. As you know, there is no resolvconf in new Centos, so, standard update-resolv-conf script doesn't ...
0
votes
1answer
258 views

Varnish 4 service won't start because of selinux

I've installed varnish 4 on my new centos 6.5 box. I've activated EPEL repo to install varnish from http://repo.varnish-cache.org/redhat/varnish-4.0/ After installing and configuring my default.vcl I ...
0
votes
1answer
146 views

Configuration for Ubuntu SELinux with sshd

I am trying to set-up SELinux in an Ubuntu Trusty server, who is an Amazon EC2 instance. I followed the Debian documentation about installing SELinux. The installation work well as seen by : ...
0
votes
1answer
79 views

VSFTPD - 0.00Kbyte/sec - intermittent

I can't get a good connection via FTP to my DigitalOcean server. I set it up following this guide. https://www.digitalocean.com/community/articles/how-to-set-up-vsftpd-on-centos-6--2 Symptoms: ...
0
votes
1answer
41 views

Download file without disabling selinux

I am developing a site in PHP on Linux Server where I need to download a file from Windows Server to Linux Machine. I can do it with Some Changes in SeLinux or setting some properties on it, i.e.: % ...
0
votes
1answer
95 views

After trying to remove SELinux, system doesn't start; shows error of “unable to connect to system bus”

I had SELinux installed on my system which actually was a bit annoying. I tried to remove it. After that my system is unable to start. The error that is showing up is: unable to connect to system ...
0
votes
1answer
329 views

Can sealert display the full command of a denied access request?

I am managing a Red Hat Enterprise 5 system using Chef. Something within sequence of configuration commands is generating selinux alerts such as: SELinux is preventing iptables (iptables_t) "read" to ...
0
votes
1answer
1k views

Mounted NFS directory not writable by Apache / PHP

Need some help here with NFS. Here's what I have (all servers running CentOS 5.6 with SELinux): 172.17.20.1 - Primary server with static IP. Varnish redirects requests to the web servers. 172.17.20.2 ...
0
votes
1answer
398 views

SELinux AVC denies at boot

My Gentoo box is running Gentoo Hardened/SELinux (32bit), I followed the Gentoo Hardened Guide to install it and the machine doesn't boot. Here is an extract from dmesg: Mar 12 19:15:04 ...
0
votes
1answer
273 views

3ware SNMP plugin does not work with selinux

Anyone have experience using 3ware's SNMP library under SELINUX? I get the following error: snmpget -v 2c -c pub hostname TW-RAID-MIB::twRaidUnitStatus.1 Error in packet Reason: noCreation (That ...
3
votes
0answers
166 views

SELinux: cannot confine Firefox process to mozilla_t domain

My goal is to execute Firefox in the mozilla_t domain instead of unconfined_t. The machine runs Fedora 20 with SELinux in enforcing mode. Unfortunately, I can't seem to get this right. No matter ...
2
votes
0answers
230 views

Gitolite3 push and selinux access failure

I try to install gitolite3 with ssh and http. I have followed largely the official guide at gitolite3, but I am stumbling accross three remaining problems. When I $ git clone ...
2
votes
0answers
187 views

selinux “Possible mismatch between this policy…”

How do I go about troubleshooting the following error below: type=AVC msg=audit(1365523330.609:4846): avc: denied { append } for pid=12542 comm="FTPMan.pl" name="user_list" dev=dm-0 ino=2884237 ...
1
vote
0answers
60 views

How to power down Cloudstack configured with XenServer Hypervisors

I have three XenServers(6.2) configured in a single pool. I also have a Cloudstack (CentOS 6.5) Management interface controlling them all. Everything is up and running but I can not figure out how to ...
1
vote
0answers
61 views

SElinux sandbox fails to start from systemd service

I have a server that runs user submitted code, for evaluation. I wrote a systemd service that starts a python application, that application then run the submitted code using SElinux sandbox. The ...
1
vote
0answers
65 views

Possible to prevent access to /tmp for a specific user via SELinux?

I'm sort of learning the edges of SELinux and I'm wondering if it's possible to prevent a specific user from accessing /tmp. Clearly it's a bad idea to dork all permissions, so I'm hoping that ...
1
vote
0answers
15 views

SELinux module for a specific file rather than an entire context

I've created an SELinux module that works great for a specific context. What I would like to know is, is it possible to restrict this module to only function for specific files with that context? For ...
1
vote
0answers
53 views

How to write a file from Apache CGI in a user home directory on CentOS

I made a CGI in Python and it works unless I try to write to a file in a user's home. I activated allow_httpd_anon_write and allow_http_sys_script_anon_write to true with graphical tool for ...
1
vote
0answers
70 views

linux: upload / download difference on network shares

I have a Red Hat Enterprise Linux 6 (with SELinux) which shows significant differences of speed between download and upload (the latter significantly slower) of files shared over the LAN. The ...
1
vote
0answers
66 views

SELinux - Prevent users in the user_t domain from creating sockets

I need untrusted users to execute Ruby and Python scripts via SSH on a Fedora 17 machine with a minimal impact on system integrity and security. A SSH wrapper will ensure only Ruby and Python ...
0
votes
0answers
14 views

CentOS 7 Cannot delete ports defined for MongoDB

I installed and later removed the MongoDB server on a CentOS 7 box. While cleaning up, I noticed that the ports assigned to MongoDB were still open. if I remember correctly, I was able to delete the ...
0
votes
0answers
31 views

How to work whit socket_file httpd (nginx-uwsgi)

I am trying to run Nginx/uWSGI/Django, the last remaining step is to run the socket_file all I get is a 502 Bad Gateway. Route my django application. #/home/deploy/webapps/myapp Configuration ...
0
votes
0answers
80 views

PHPINFO creates Permission Denied in error log

Running CentOS 7 with apache 2.4, using PHP5.6 from REMI repository. My wordpress and phpmyadmin seem to work, however any page that has phpinfo() causes a permission denied entry into my error log. ...
0
votes
0answers
26 views

selinux-policy update prevents ssh into ec2. Now what?

I created a new EC2 instance using the official CentOS 7 (x86_64) HVM image. I ran: yum upgrade At: Running transaction Warning: RPMDB altered outside of yum. Updating : ...
0
votes
0answers
81 views

Postgres on OpenSuse doesn't start after update

I tried to upgrade OpenSuse from 12.1 to 13.1 and after 'zypper update' and reboot Postgresql doesn't start. Here is the output of service postgresgl status: postgresql.service - LSB: Start the ...
0
votes
0answers
36 views

SELinux - centos 6.5 run_init asks for password of non privileged user

I log onto my aws centos instance, as user: [user@aws-sonar-01 ~]$ sudo -i [root@aws-sonar-01 ~]# run_init /bin/bash -x -c 'ulimit -S -c 0 ; auditd'; echo $? Authenticating user. Password: + ulimit ...
0
votes
0answers
129 views

Nconf can't generate & deploy Nagios configuration (SELinux)

this is my 1st post here. I'm having trouble with getting NConf (Nagios configuration tool) work with Nagios under CentOS 6.5 (64bit) with SELinux enabled. NConf wasn't able to generate & deploy ...
0
votes
0answers
61 views

auditd auid changes after su

I try to implement individual accountability for my RHEL systems using selinux and the audit.log. I followed the instructions given here: Log all commands run by admins on production servers If I ...
0
votes
0answers
44 views

Setting up muli-project web development server

I'm trying to set up a development server that will be used for several (web) projects by different teams (consisting of different people, some of which may be involved with more than one project). I ...
0
votes
0answers
126 views

Reading home files permission: Policy constraint violation

I want to confine a certain user to be able to bind a node.js server to a certain port. That bit is working. What isn't working is allowing said user to access his own files. audit2allow is telling ...
0
votes
0answers
263 views

Hidden 'neverallow' in selinux policy?

I intend to use 'enforce' selinux mode. First, i boot in permissive mode ( enforcing=0 in kernel cmdline ). After login in system, i collect all selinux policy violation from auditd logs and try to ...