NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

2
votes
4answers
523 views

Fedora 12 on Vmware network disabled on restore

I have a fedora 12 guest running on VMWare on windows 7. I use it mainly for the occasional linux dev. Whenever I restart the guest, networking works fine. But if I close the VMware player and save ...
1
vote
2answers
396 views

'/var/spool/cron' is not a directory, bailing out. when trying to work with crontab via PHP's shell_exec

I am creating a web application. Part of the functionality is depending on that the user can start/stop a cronjob that imports emails. It doesn't work. Just to make sure I'm on the right track, as ...
1
vote
2answers
345 views

Relabeling of filesystems (SELinux) fails

After compiling the policy modules and re-compiling my core packages (Gentoo 32bit) I wanted to relabel the filesystems (via rlpkg -a -r) and packages but I get these error messages: Relabeling ...
0
votes
2answers
305 views

PHP Fatal error: date(): Timezone database is corrupt

I installed wordpress to CentOS from EPEL: yum install wordpress And it can only work if I manually disable SELinux. Otherwise I see this error: PHP Fatal error: date(): Timezone database is ...
0
votes
2answers
394 views

Can't open/forward port with Fedora15

I've got a server running Fedora 15. My end goal is to be able to forward any protocol over random port numbers (specified via iptables rules.) Let's say, for the time being, I want to forward port ...
0
votes
2answers
258 views

CentOS 5.6: Apache access permission after .htaccess upload

I was working on my home server remotely and wanted to make some changes to my .htaccess. I could not see this file using my FTP(filezilla) and thought there was none there. I decided to upload one I ...
3
votes
1answer
179 views

Selinux interfering with vboxwebsrv or phpvirtualbox

I have a brand new installation of Fedora 18, with a brand new installation of Virtualbox 4.2. I have spent a painful few hours trying to get phpVirtualBox working. Apache 2.4 and PHP 5.4 are ...
3
votes
1answer
156 views

What's the correct SELinux type for a directory?

If I create a new filesystem/directory off of / and I set the Linux permissions to 770 I expect the group to be able to read and write files in that directory. SELinux was preventing me from doing ...
2
votes
1answer
180 views

SELinux - CentOSx86_64: User command limitation

SELinux - CentOSx86_64: User command limitation Is SELinux the right tool for this job? If so, what is the best way to do it? I would like to limit a particular user to only running some list of ...
2
votes
1answer
398 views

How to implement and modify policies for Role-based access control on Ubuntu Linux?

Selinux is currently installed on the machine but there's no simple way to enable and modify RBAC for users. Seedit is available for Fedora and CentOS but it is not working on Ubuntu distros. Are ...
1
vote
1answer
19 views

Disabling network access for a group of users but allowing smtp only

We have an environment where our users ssh into the system and their shell is set to simply launch Mutt on their $HOME/Maildir. We want to restrict our users to only be able to send/receive mail. We ...
1
vote
1answer
184 views

Enable selinux to allow mysql files to be read and written on a nfs share

I have moved my /var/lib/mysql directory to an nfs share, updated all the config files and created symbolic links where appropriate. This works when I have selinux turned off, but mysqld fails to ...
1
vote
1answer
334 views

SELinux permissions for LogRotate and Apache

With the directory structure: /www/live/website1/app/ /www/live/website1/files/ /www/live/website1/logs/ Where Apache needs at least the following access: app: read-only access, but read-write is ...
1
vote
1answer
252 views

SElinux process killed while trying to set boolean

I've got a strange problem. I can not allow apache to connect to database at my CentOC 6.4 box: [root@centos6 ~]# setsebool -P httpd_can_network_connect on Killed [root@centos6 ~]# sestatus -b | grep ...
1
vote
1answer
216 views

openssh-lpk - Failed to get default SELinux security context for ldapuser

I'm trying to setup a ssh server with hardened-gentoo sources openssh (with openssh-lpk, which is the ldap flag on gentoo I think) and selinux enabled. On the Ldap-Server I have added an user ...
1
vote
1answer
171 views

PHP won't run on Fedora 15

I have followed this exact tutorial on installing php on a Fedora 15 system. I have all the necessary packages installed with no errors. Yet the simple phpinfo() test page will show - it will show a ...
1
vote
1answer
158 views

How to access virtual guest centos on windowsxp remotely

I have installed CentOS(domain 0) as a Base OS then using XEN tool virt-manager, I have created another CentOS5(domU) as virtual guestOS. I can easily access base CentOS(domain 0) by windows ...
0
votes
1answer
35 views

VSFTPD - 0.00Kbyte/sec - intermittent

I can't get a good connection via FTP to my DigitalOcean server. I set it up following this guide. https://www.digitalocean.com/community/articles/how-to-set-up-vsftpd-on-centos-6--2 Symptoms: ...
0
votes
1answer
39 views

Download file without disabling selinux

I am developing a site in PHP on Linux Server where I need to download a file from Windows Server to Linux Machine. I can do it with Some Changes in SeLinux or setting some properties on it, i.e.: % ...
0
votes
1answer
73 views

After trying to remove SELinux, system doesn't start; shows error of “unable to connect to system bus”

I had SELinux installed on my system which actually was a bit annoying. I tried to remove it. After that my system is unable to start. The error that is showing up is: unable to connect to system ...
0
votes
1answer
245 views

Can sealert display the full command of a denied access request?

I am managing a Red Hat Enterprise 5 system using Chef. Something within sequence of configuration commands is generating selinux alerts such as: SELinux is preventing iptables (iptables_t) "read" to ...
0
votes
1answer
639 views

Mounted NFS directory not writable by Apache / PHP

Need some help here with NFS. Here's what I have (all servers running CentOS 5.6 with SELinux): 172.17.20.1 - Primary server with static IP. Varnish redirects requests to the web servers. 172.17.20.2 ...
0
votes
1answer
291 views

SELinux AVC denies at boot

My Gentoo box is running Gentoo Hardened/SELinux (32bit), I followed the Gentoo Hardened Guide to install it and the machine doesn't boot. Here is an extract from dmesg: Mar 12 19:15:04 ...
0
votes
1answer
256 views

3ware SNMP plugin does not work with selinux

Anyone have experience using 3ware's SNMP library under SELINUX? I get the following error: snmpget -v 2c -c pub hostname TW-RAID-MIB::twRaidUnitStatus.1 Error in packet Reason: noCreation (That ...
2
votes
0answers
188 views

Gitolite3 push and selinux access failure

I try to install gitolite3 with ssh and http. I have followed largely the official guide at gitolite3, but I am stumbling accross three remaining problems. When I $ git clone ...
2
votes
0answers
124 views

selinux “Possible mismatch between this policy…”

How do I go about troubleshooting the following error below: type=AVC msg=audit(1365523330.609:4846): avc: denied { append } for pid=12542 comm="FTPMan.pl" name="user_list" dev=dm-0 ino=2884237 ...
1
vote
0answers
12 views

SELinux module for a specific file rather than an entire context

I've created an SELinux module that works great for a specific context. What I would like to know is, is it possible to restrict this module to only function for specific files with that context? For ...
1
vote
0answers
30 views

How to write a file from Apache CGI in a user home directory on CentOS

I made a CGI in Python and it works unless I try to write to a file in a user's home. I activated allow_httpd_anon_write and allow_http_sys_script_anon_write to true with graphical tool for ...
1
vote
0answers
200 views

Apache passphrase working sometimes

On one of my servers I observe the following problem with SSL passphrase: some certs are passing it without asking for a password, while some others keep asking for it. I have set it up globally: ...
1
vote
0answers
69 views

linux: upload / download difference on network shares

I have a Red Hat Enterprise Linux 6 (with SELinux) which shows significant differences of speed between download and upload (the latter significantly slower) of files shared over the LAN. The ...
1
vote
0answers
59 views

SELinux - Prevent users in the user_t domain from creating sockets

I need untrusted users to execute Ruby and Python scripts via SSH on a Fedora 17 machine with a minimal impact on system integrity and security. A SSH wrapper will ensure only Ruby and Python ...
0
votes
0answers
33 views

Setting up muli-project web development server

I'm trying to set up a development server that will be used for several (web) projects by different teams (consisting of different people, some of which may be involved with more than one project). I ...
0
votes
0answers
25 views

SELinux, complains constantly about rm files in /tmp/

SELinux on my server is constantly flooded by messages like this: Apr 16 00:27:05 mail setroubleshoot: SELinux is preventing the rm from using potentially mislabeled files (/tmp/.font-unix). For ...
0
votes
0answers
55 views

Reading home files permission: Policy constraint violation

I want to confine a certain user to be able to bind a node.js server to a certain port. That bit is working. What isn't working is allowing said user to access his own files. audit2allow is telling ...
0
votes
0answers
89 views

Hidden 'neverallow' in selinux policy?

I intend to use 'enforce' selinux mode. First, i boot in permissive mode ( enforcing=0 in kernel cmdline ). After login in system, i collect all selinux policy violation from auditd logs and try to ...
0
votes
0answers
50 views

How to use run_init with processes in the background

I'm working on a CentOS 5.9 machine. There's a program that runs in the foreground instead of correctly forking a daemon. It's /etc/init.d/myprogram script has something like below: start() { ...
0
votes
0answers
48 views

RHEL6: Selinux execute rule not working

I want to configure a rule to allow a restricted user to execute 1 file (bash script) in /etc/init.d. I tagged this file as follows: -rwxr-xr-x. root root system_u:object_r:myappd_initrc_exec_t:s0 ...
0
votes
0answers
278 views

SELinux denies execute of script resulting in a complex looking custom policy

The heartbeat type polling tool nanny (part of Piranha / Linux Virtual Server / LVS / IPVS) is being denied access to my "sendprogram" scripts by SELinux. Setting the context alone is not sufficient. ...
0
votes
0answers
1k views

Httpd won't start because of permission denied

This happened after the server went down all of sudden, we couldn't access it only a minute later, when we attempted apache restart. the error below occurred: httpd: Syntax error on line 221 of ...