Questions tagged [selinux]
NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.
161
questions with no upvoted or accepted answers
6
votes
0
answers
1k
views
SELinux: How to allow apache, samba and tomcat access on the same file
Running RedHat 7.4
Until recently I could use
semanage fcontext -a -t public_content_rw_t '/var/www(/.*)?'
restorecon -R /var/www
from answer https://serverfault.com/a/346779/125461
on How do I ...
- 201
5
votes
0
answers
1k
views
What SELinux type should I apply on my Unix socket?
I have a Gunicorn socket file: /opt/rtd/gunicorn/run.sock. I need nginx to be able to open this socket and write to it.
When I run sesearch --allow -s httpd_t | grep unix_stream_socket I noticed that ...
4
votes
0
answers
597
views
How do I go about creating a systemd selinux policy domain?
How can I create an selinux policy to govern my systemd unit?
I am creating a daemon that will be managed by systemd and I'd like to create an appropriate selinux policy to go with it. I've tried ...
- 311
4
votes
0
answers
631
views
What's the recommended way to restrict Internet access per process using SELinux?
Before I have tried to do this using a phony user and iptables to execute commands that needs to be restricted. However now the commands need to read configuration set by each user's environment vars ...
3
votes
1
answer
987
views
SELinux is preventing in:imjournal from unlink accesses on the file imjournal.state
I have a problem on Fedora 36 with rsyslog, selinux and /var/log/messages components.
As you can see:
AVC avc: denied { unlink } for pid=XXX comm="in:imjournal" name="imjournal.state&...
- 31
3
votes
0
answers
204
views
Why are docker permission errors not logged by selinux?
If you try to bind mount a directory into a container under Red Hat you might have problems with selinux. The directory will be unreadable from inside the container. Unless you add a z/Z volume option....
- 2,298
3
votes
0
answers
434
views
CentOS Linux 8 freezes when changing SELinux Booleans (setsebool)
Problem
Various CentOS Linux 8 servers freeze/hang when changing SELinux Booleans.
Details and research
We manage hundreds of CentOS Linux servers. Lately we see deviant behavior on some (but not all) ...
- 51
3
votes
0
answers
2k
views
SELinux stops pam_oddjob_mkhomedir from re-creating home dirs after deletion
I have a RedHat 7 server which is hooked up to LDAP and is supposed to create home folders automatically. In line with RedHat recommendation I use pam_oddjob_mkhomedir.so. Everything works fine if the ...
- 211
3
votes
0
answers
166
views
Finding local ID for SELinux denial under Fedora 23
Trying to get more fluent with SELinux, it looks like
sealert -l <local-id>
would be a particularly useful way to get help with logged denials.
From what I understand, the local IDs used to ...
- 201
2
votes
0
answers
86
views
SELinux inside of a Docker Container
Here How to enable SELinux inside of a CentOS Docker container? someone explains that SELinux cannot be used in a Docker Container, is this still valid?
- 21
2
votes
1
answer
136
views
SELinux: Why can httpd read files in /var/www/html?
I'm just trying to understand targeted SELinux better. While I understand that users, processes, ports etc. are labled with a quadruple <user>,role>,<type>,<sensitivity> and how ...
- 43
2
votes
2
answers
2k
views
SELinux - blocks postfix emails sending out from the Web Application
My System environment, is Centos-7.9, Apache2.4, Php-fpm, PHP-7.4
I have postfix setup to send emails from the website, which is working in stand-alone test emails and when I turn the SELinux off.
...
- 4,442
2
votes
1
answer
934
views
SELinux setting httpd_can_network_relay to on throws error, "could not convert system_u:object_r:systemd_sleep_exec_t:s0 to sid". How is this fixed?
Environment: Digital Ocean Droplet, CentOS 8
The State of httpd_can_network_relay is set to on. However the Default is set to off.
$ sudo semanage boolean -l | grep httpd_can_network_relay
...
- 579
2
votes
0
answers
2k
views
Slab UnReclaimable Using 14GB
I need help to understand what is this slab unreclaimable memory usage, I know that is related to cache.
Here is the output of /proc/meminfo
cat /proc/meminfo
MemTotal: 23373884 kB
MemFree: ...
2
votes
0
answers
1k
views
ERROR: Couldn't connect to Docker daemon at http+docker://localhost - is it running?
My environment:
# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.6 (Maipo)
# uname -a
Linux X.Y.Z 3.10.0-957.12.1.el7.x86_64 #1 SMP Wed Mar 20 11:34:37 UTC 2019 x86_64 x86_64 ...
- 13.4k
2
votes
1
answer
2k
views
Ansible sefcontext not making fcontext permanent
Trying to use Ansible on a CentOS 7 server to make a directory and sync files into it. That part is working. The problem is I get a 403 Forbidden error when I try to access them from the browser. I ...
- 133
2
votes
1
answer
668
views
Multiple IP addresses with SELinux using the same port
I have a CentOS 7 box with multiple IP address on the same NIC. One IP uses 443 for ssh and I want the other IP to use 443 for the web server. SELinux won't let httpd startup saying:
(13)Permission ...
- 21
2
votes
2
answers
5k
views
SELinux - Zabbix server can't read conf file
I have installed zabbix server on red Hat 7.4 server with SELinux policy in Enforcing mode.
If I launch Zabbix-server (3.4.11), I have theses errors :
/var/log/zabbix/zabbix_server.log
Jul 25 16:51:...
- 157
2
votes
1
answer
463
views
SELinux context documentation
I am trying to get my head around SELinux but one question keeps popping-up in my head: CONTEXT.
When I'm writing custom rules and modules (on CentOS 7), I end up just taking contexts out of the air -...
- 21
2
votes
0
answers
681
views
Creating multiple SFTP users in Centos (installed in AWS EC2) with SELinux
I am having difficulty letting others FTP/SFTP to our site. I have multiple Virtual Name Servers created and each of them running their own website. So , I would like to give FTP/SFTP access to users. ...
- 103
2
votes
0
answers
798
views
sealert takes very long on centos7
I'm trying to human read /var/log/audit/audit.log file on centos7. I came with command
sealert -a /var/log/audit/audit.log
which works fine on one machine, there is initial scan which takes second ...
- 243
2
votes
0
answers
270
views
SELinux - FCGID program being blocked and no log on /var/log/audit/audit.log
I have a setup where a certain link on my Web Server is redirected to a FCGID module.
When I disable SELinux with 'setenforce 0' the site works. When I enable it won't work, it gives me a "Error 500 -...
2
votes
1
answer
88
views
docker made fedora host unbootable in selinux enforcing mode
I've done incautiously
docker run -v /:/mnt:ro someimage
It has resulted with some docker (docker v1.7) daemon error. Since then I can only boot in permissive mode and got lot of selinux errors. ...
- 121
2
votes
0
answers
575
views
Gitolite3 push and selinux access failure
I try to install gitolite3 with ssh and http.
I have followed largely the official guide at gitolite3, but I am stumbling accross three remaining problems.
When I $ git clone http://florian@server/...
- 413
2
votes
1
answer
374
views
SELinux - CentOSx86_64: User command limitation
SELinux - CentOSx86_64: User command limitation
Is SELinux the right tool for this job? If so, what is the best way to do it?
I would like to limit a particular user to only running some list of ...
- 21
2
votes
1
answer
2k
views
How to implement and modify policies for Role-based access control on Ubuntu Linux?
Selinux is currently installed on the machine but there's no simple way to enable and modify RBAC for users. Seedit is available for Fedora and CentOS but it is not working on Ubuntu distros.
Are ...
- 61
2
votes
1
answer
1k
views
SELinux - Allow system_u and new SELinux user to log in via SSH
I am new to SELinux and I am still trying to figure out how everything works but my goal is to create a Linux account associated with either system_u or a new SELinux user and try to ssh to my machine ...
- 21
2
votes
4
answers
969
views
Fedora 12 on Vmware network disabled on restore
I have a fedora 12 guest running on VMWare on windows 7. I use it mainly for the occasional linux dev. Whenever I restart the guest, networking works fine. But if I close the VMware player and save ...
- 121
1
vote
0
answers
290
views
How to inspect the rules in a policy module?
I know I can use semodule -l to see what modules I have. However, I want to see the rules contained in a specific module.
I read almost all document I can find for semodule, seinfo, sesearch. I cannot ...
- 322
1
vote
0
answers
90
views
Incorrect SELinux labeling of mysql unix socket on Centos7
OS:
# rpm -q centos-release
centos-release-7-9.2009.1.el7.centos.x86_64
I'm trying to get zabbix-agent to access mysqld (using mysqladmin ping), but the process fails with the following errors(in ...
- 1,873
1
vote
0
answers
58
views
Cannot create SPEC file with sepolicy-generate
In EL7 I have been creating custom policy with sepolicy-generate and one of the artefacts created is a SPEC file. When I run the same command on EL8 I don't get the SPEC file. According to the manpage ...
- 21
1
vote
0
answers
3k
views
Podman is unable to start container with SELinux (sd-bus call permission error)
Here is the command I am using to start the container:
podman run -d --name busybox-top -v ./src:/dest:Z busybox top
Error:
Error: sd-bus call: Permission denied: OCI permission denied
I do not have ...
- 947
1
vote
0
answers
84
views
SELinux: two servers, identical configurations, but different contexts
I've had my fair share of struggles with SELinux, but this is the first time that it's totally stumped me. I have two production CentOS 8 servers with functionally identical configurations hosting a ...
- 111
1
vote
0
answers
3k
views
Samba/Winbind domain member authentication issue
In setting up a new Linux Samba fileserver as a AD member I keep running into an issue with authentication.
It appears to be triggered by running with selinux in Enforcing mode after joining AD, but ...
- 11
1
vote
0
answers
627
views
How to set SELinux to allow CGI script to create a file
I'm writing a CGI for httpd on CentOS 7, which create and write files on a directory under home.
When I enable SELinux, it causes Internal Server Error. How can I setup SELinux?
The command sudo ...
- 123
1
vote
0
answers
207
views
selinux - why can't stuff_u with sysadm_r run postsuper?
I am trying to understand how selinux confined users really work, but there are a few behaviours that I still can not understand.
According to redhat
SELinux User Capabilities
stuff_u users should be ...
- 21
1
vote
0
answers
214
views
Where is mapping of __default__ user to unconfined_u defined in SELinux policy?
semanage login -l shows following mappings
~]# semanage login -l
Login Name SELinux User MLS/MCS Range
__default__ unconfined_u s0-s0:c0.c1023
...
- 11
1
vote
0
answers
201
views
What makes a selinux-caused EACCESS to not be logged in audit
I've got a system with samba running with standard targetted policy for Fedora.
At some point samba is trying to access a directory tagged unconfined_u:object_r:unlabeled_t:s0 and fails. Through ...
- 1,306
1
vote
0
answers
882
views
Correct SELinux labels for a kvm/qemu user session VM shared folder
I am trying to set up a shared folder using the 9p protocol for a kvm/qemu VM that runs on the user session (so the qemu process runs as me, not as root). Mounting the shared folder in guest works ...
- 255
1
vote
0
answers
80
views
SELinux prevents Apache from scheduling at job
I have an application that submits tasks to cloud services that create certain time-sensitive assets. The services take an unknown amount of time to process, and in addition the assets may be ...
- 235
1
vote
1
answer
801
views
How can one identify what changes the SELinux file context of a file?
I'm noticing some files within a web directory with changed file contexts that deviates from system policy. There are developers that run git pull against at a higher part of the web directory and I'm ...
- 151
1
vote
1
answer
910
views
SELinux, Nginx and fcgiWrap: how to allow access to fcgiWrap socket?
I am under Fedora 31 (linux kernel 5.4.13, Nginx 1.16.1, fcgiwrap 1.1.0) running with SELinux in enforcing mode (policy: targeted 3.14.4-44.fc31).
My box hosts a server driven by Nginx. Part of it ...
- 111
1
vote
0
answers
1k
views
nginx + uwsgi + django 502 bad gateway on aws ec2
I have successfully installed nginx and uwsgi on aws ec2 instance. But on hitting the public IP its showing "502 bad gateway". Though both nginx and uwsgi server status is running and active.
The ...
- 111
1
vote
0
answers
58
views
SELinux policy and changing disk ids on Hardened Gentoo
I run a system with hardened Gentoo under a KVM/QEMU. I am new to SELinux and make heavy use of audit2allow to get things working. When doing this I include and carry along the location of the disk, ...
- 199
1
vote
0
answers
336
views
why selinux is denying file access(ls /usr/bin) to container_file_t type inside my container
I have one RHEL7.4 node, that when enforing selinux, it will fail my container, I checked and found it is denying reading in the container internal directories:
# docker run -it 172.16.1.120:5000/...
- 111
1
vote
0
answers
497
views
SELinux set enforcing issue
I am on CentOS 6.9 with a LAMP stack, trying to set SELinux=enforcing in /etc/selinux/config
However after **reboot ** and checking sestatus I still get SELinux status:disabled
Then I tried running ...
- 273
1
vote
1
answer
2k
views
Why is SELinux blocking systemctl --user / systemd user instance commands?
I have a number of Fedora 27 systems. I am reasonably comfortable with SELinux. I run it on all my systems, with the "unconfined" module disabled.
On this particular system, SELinux is blocking all ...
- 203
1
vote
1
answer
901
views
Docker namespaces and SELinux not working
My system:
Debian 9 Stretch
Docker version 17.06.0-ce, build 02c1d87
SELinux
This is just running fine.
But, if I also activate Namespace Remapping (default, using the dockremap User), I can't run ...
- 11
1
vote
0
answers
838
views
Something on CentOS is blocking remote MySQL connection
I am running MySQL on CentOS 7, and don't seem to be able to connect MySQL remotely. I have:
bind-address=0.0.0.0
and certainly not #skip-networking but it doesn't matter if I bind to the actual ...
- 121
1
vote
1
answer
2k
views
selinux cause 2 error: httpd write access mysql and zabbix search mysql
I have a question similar to this :
Zabbix server SELinux policy
but a little different:
I have a Zabbix server running on a RHEL 6 ,when I enable selinux , I got this error:
Error connecting to ...
- 11