Questions tagged [selinux]
NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.
692
questions
51
votes
3
answers
130k
views
SElinux: allow httpd to connect to a specific port
My system is running CentOS 6.4 with apache2.2.15. SElinux is enforcing and I'm trying to connect to a local instance of redis through my python/wsgi app. I get Error 13, Permission denied. I could ...
- 511
41
votes
7
answers
25k
views
Reasons to disable / enable SELinux
In the line of this question on StackOverflow and the completely different crowd we have here, I wonder: what are your reasons to disable SELinux (assuming most people still do)? Would you like to ...
- 10.5k
41
votes
6
answers
148k
views
Where is the sshd log file on Red Hat Linux stored?
Can someone please tell me where to find the SSHD log on RedHat and SELinux.... I would like to view the log to see who is logging into my account..
- 437
31
votes
6
answers
60k
views
How do I allow MySQL connections through SELinux?
I'd like to for once leave SELinux running on a server for the alleged increased security.
I usually disable SELinux to get anything to work.
How do I tell SELinux to allow MySQL connections?
The most ...
- 563
31
votes
3
answers
51k
views
How do I get SELinux to allow Apache and Samba on the same folder?
In the configuration I have setup I wish to allow samba and apache to access /var/www
I am able to set a context to allow samba access, but then httpd doesn't have access.
Using setenforce to 0 ...
- 3,494
23
votes
2
answers
45k
views
How do I view the contents of a SELinux policy package
As the title says, how do I view the contents of a SELinux policy package? The resulting files end with .pp. I'm running on centos 6, but I guess it's the same way on "all" distros.
For example
...
- 1,233
22
votes
9
answers
80k
views
Trying to SSH in to remote computer but still asking for password
Trying to SSH in to remote computer but still asking for password.
I have a number of computers running SElinux and only one of them is giving me a hard time using ssh without the password.
I did ...
- 221
22
votes
2
answers
38k
views
What does the .autorelabel file do in Linux?
What does the .autorelabel file located at the file root / do in Linux?
I know its something to do with SELinux but I can't find any information as to what it actually does. I am running CentOS 6.
...
19
votes
2
answers
28k
views
SElinux error :ValueError: Port tcp/5000 already defined
I have been trying to add an exception to SELinux for apache on port 5000.So I used the command:
# semanage port -a -t http_port_t -p tcp 5000
But returns the error,
ValueError: Port tcp/5000 ...
18
votes
5
answers
58k
views
Why is selinux blocking remote ssh access without a password?
I've got a CentOS 7 server. I've set up /root/.ssh/authorized_keys on the host I'm trying to login to without a password. (Yes, allowing remote root access is a bad idea but this is an internal server....
- 377
18
votes
5
answers
12k
views
Why do we need SELinux?
I could not get much idea where the SELinux has been used and what it saves from attacker.
I have gone through SELinux web site and read the basic but still not getting clue about SELinux. For the ...
- 331
17
votes
3
answers
32k
views
How can I tell SELinux to permit nginx access to a unix socket without audit2allow?
I have nginx forwarding requests to gunicorn via a unix socket at /run/gunicorn/socket. By default, this behavior is not permitted by SELinux:
grep nginx /var/log/audit/audit.log
type=SERVICE_START ...
- 375
16
votes
4
answers
24k
views
SELinux preventing Apache from writing to a file
SELinux is preventing the apache user from writing to a log file which it owns. When I do setenforce 0 it works. Otherwise it shows this error
IOError: [Errno 13] Permission denied: '/var/www/webapp/...
- 433
16
votes
1
answer
21k
views
How to enable SELinux inside of a CentOS Docker container?
I am trying to install SELinux inside of a Docker container in order to distribute an application that uses SELinux internally.
The default CentOS image does not have SELinux installed:
$ docker run ...
- 382
16
votes
1
answer
17k
views
How do I assign an SELinux label to a symlink with semanage so it persists after a relabel?
My apache DocumentRoot /var/www is a symbolic link to another path. The target has the appropriate file context label (httpd_sys_content_t) so that apache can read it with SELinux enabled. However, ...
- 1,143
13
votes
1
answer
8k
views
SELinux reset root password
Disclaimer: This question is not to solve the problem of changing root password while SELinux is active because there are a lot of guides to solve that already. This is more of how SELinux does that ...
- 230
13
votes
3
answers
4k
views
Real life SELinux security example?
Can anyone give a real life example of where SELinux saved their security bacon? (or AppArmour if you wish). If not your own, a pointer to someone with a credible experience?
Not a lab test, not a ...
- 3,123
13
votes
1
answer
58k
views
How can I query for all selinux rules/default file contexts/etc affecting a type
I need to know everything related to a selinux type on a running system's current rules:
allow, allowaudit, dontaudit rules.
files labeled with a context using the type.
transitions.
...and any ...
11
votes
4
answers
3k
views
Does SELinux make Redhat more secure?
Does SELinux make Redhat more secure?
I can't remember the number of times when I have disabled SELinux because it kept frustrating my ability to get stuff running. Lots of times to there was no ...
- 1,652
11
votes
3
answers
7k
views
SELinux: How to create a new file type
On RHEL/CentOS 7 I'm trying to create a new SELinux security context for files to support a new service that I'm writing.
I've created a Type Enforcement file for my new service, but I can't manage ...
- 2,830
10
votes
4
answers
14k
views
Write once, read many (WORM) using Linux file system
I have a requirement to write files to a Linux file system that can not be subsequently overwritten, appended to, updated in any way, or deleted. Not by a sudo-er, root, or anybody. I am attempting to ...
- 201
9
votes
3
answers
9k
views
SELinux - canonical way of automatically applying a context on file creation
My current understanding is that you have to manually use restorecon to apply the desired context to a newly created file or directory unless you are happy with the context that it inherits from its ...
- 376
9
votes
2
answers
10k
views
What is the difference between httpd_read_user_content and httpd_enable_homedirs?
The apache module of SELinux has two similar boolean parameters: httpd_read_user_content and httpd_enable_homedirs.
Man page says the former allows httpd to read user content and the latter allow ...
- 288
9
votes
1
answer
3k
views
CentOS is ignoring my public key
I am trying to connect to my own CentOS server using SSH; I am able to connect fine with a password; I am trying to connect with my public key, but the server does not attempt public key ...
- 399
9
votes
1
answer
7k
views
How to disallow the Docker Daemon to mount host's root file system into the container
I have the following Container Setup.
On a bare metal server two Docker Daemons are installed and running.
Main Docker Daemon Runs my application containers exposing 80/443 to the outside world.
...
- 268
9
votes
2
answers
2k
views
How can I use SELinux to confine PHP scripts?
I want to compartmentalize different PHP applications on my SL6.4 (RHEL 6.4 rebuild) web server so that they cannot access each others' data. It seems that SELinux might be able to do this, but I am ...
- 203
9
votes
1
answer
9k
views
Linux - CentOS6 - semanage - command not found
I am trying to solve an issue where my HTTPD is denied access to binding custom ports and I believe it has to do with SELinux. Whilst doing some googling I came across some posts where users were ...
- 1,738
9
votes
1
answer
1k
views
CentOS 7 - Directories created through VSFTPD not inheriting SELinux contexts
Our company has a webserver with CentOS 7 and our customers manage their websites through FTP (vsftpd). SELinux is in enforcing mode.
The issue is that data created/uploadad through VSFTPD is not ...
9
votes
2
answers
5k
views
How to run PhantomJS on CentOS with SELinux?
I'm trying to make a screenshot using PhantomJS on my CentOS 5 machine, but I can't get it to work together with SELinux. It works on an identical machine with SELinux disabled, so I really suspect ...
- 256
9
votes
1
answer
2k
views
SSH - 1s hang at "Entering interactive session" (Not DNS; possibly SELinux related)
I'm having an issue on CentOS 6.7 where SSH logins are 1s more than any non-6.7 machines on this network (e.g. 7.2, 5.11). Running debugging on the client side showed the hang at "Entering interactive ...
- 203
8
votes
2
answers
14k
views
Fedora 16: "Permission denied: file permissions deny server access"
I'm working with a fresh Fedora 16 install and I'm trying to get Apache up and running. I'm very familiar with Linux and somewhat with CentOS, but I have very little experience with Fedora and SELinux ...
- 247
8
votes
2
answers
25k
views
SELinux blocking execution in systemd unit
I use Fedora 31 and tried to set up a Teamspeak server. When I look in journalctl -u teamspeak I get the following error:
mar 09 22:22:46 melchior systemd[1]: Started Teamspeak server.
mar 09 22:22:...
- 271
8
votes
1
answer
15k
views
How do I remove a SELinux module in CentOS?
I tried but it gave an error.
# ls -l opendkim.pp
-rw-r--r--. 1 root root 1569 Jan 8 01:20 opendkim.pp
# ls -l /etc/selinux/targeted/modules/active/modules/opendkim.pp
-rw-r--r--. 1 root root 344 ...
- 1,174
8
votes
3
answers
21k
views
SElinux: How to change to permissive mode without a reboot?
I need to change selinux to "permissive mode" on a production server without a reboot, but setenforce wont let me do it(as a root), it always prints "setenforce: SELinux is disabled"
What i'm doing ...
- 227
8
votes
1
answer
20k
views
CentOS - semanage - Delete range of ports
Surprisingly, could not find any clear information on how to delete a range of ports by way of semanage port. Here is a list of permutations I tried:
semanage port -d -t http_port_t -p tcp 0-60000
...
- 1,738
8
votes
2
answers
9k
views
CentOS 6 kickstart ignoring 'selinux --disabled'
I've been fighting with this one for a bit and it seems that there has been a regression in CentOS 6 as far as anaconda ignoring the selinux --disabled directive. This appears to have first appeared ...
- 37.6k
8
votes
2
answers
10k
views
View custom selinux policies
Is there a way to view all custom policies applied to SELinux, preferably rolling them all up into one policy "package"?
I've just spent the last week or so working through a series of SELinux errors ...
- 397
8
votes
1
answer
8k
views
Best way to manage custom ports in SELinux
On RHEL 6.2, we're using httpd on a host as a front-end proxy for Tomcat on another host, and we also have mod_status configured to listen on a non-standard port to provide status info to a monitoring ...
- 493
8
votes
1
answer
10k
views
SELinux port "defined in policy, cannot be deleted"
I am not satisfied with the answer to this question:
$> sudo semanage port -d -p tcp -t foo...
ValueError: Port foo is defined in policy, cannot be deleted
The accepted answer is
The SELinux ...
- 549
7
votes
2
answers
11k
views
Vsftpd passive reply with 0,0,0,0 address even with correct pasv_address
I have the following config in vsftpd
listen_ipv6=YES
allow_writeable_chroot=YES
seccomp_sandbox=NO
pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES
pasv_enable=YES
pasv_min_port=1024
...
- 103
7
votes
1
answer
6k
views
SELinux prevents Nginx from reading file [duplicate]
I have nginx running on my CentOS 7 machine. Every day I run a cron job that generates new Diffie-Hellman parameters. They are saved in /etc/ssl/dh/dhparam.pem. But SELinux is preventing nginx from ...
- 257
7
votes
3
answers
24k
views
TFTP uploads failing
I am running TFTPD via xinetd on a Centos 5.4 server. I am able to access files via tftp fine, so I know the service is running ok. However, whenever I try and upload a file I get a 0 Permission ...
- 9,714
7
votes
1
answer
5k
views
SELinux: How to undo/revert semanage permissive -a httpd_t?
I temporarily ran this:
semanage permissive -a httpd_t
To debug a domain process type issue I was having but now I can't seem to undo it.
I attempt to swap "permissive" with "enforcing" but the ...
- 459
7
votes
2
answers
1k
views
How to log executions of specific commands on Linux no matter where it came from?
Dangerous commands like rm , kill and systemctl stop can be hidden outside bash inputs - i.e. - a malicious user can easily hide them inside a python script using os module and just run the python ...
- 560
7
votes
3
answers
3k
views
SELinux in the Real World
Through my (short) job experience to date, I have gained quite a bit of knowledge of how SELinux works, from an implementation point of view and how to administer it.
I personally have several ...
7
votes
1
answer
16k
views
Issues with ProxyPass and ProxyPassReverse when proxying to localhost and a different TCP port
I am attempting to use ProxyPass and ProxyPassReverse to proxy requests through Apache to another server instance that is bound to the localhost on a different TCP port that the Vhost exists (VHost is ...
- 1,860
7
votes
1
answer
2k
views
SELinux: cannot confine Firefox process to mozilla_t domain
My goal is to execute Firefox in the mozilla_t domain instead of unconfined_t. The machine runs Fedora 20 with SELinux in enforcing mode.
Unfortunately, I can't seem to get this right. No matter ...
user85561
7
votes
2
answers
8k
views
SElinux label for php-fpm sockets
I'm attempting to set up multiple instances of php-fpm to run multiple versions of php through apache 2.2 running on centos 6.5.
At some point in the future this will end up in a shared hosting ...
- 183
6
votes
4
answers
12k
views
Why won't MariaDB start after upgrade (NO_NEW_PRIVILEGES)
After upgrade of my debian(testing, jessie to stretch) server on DigitalOcean, MariaDB won't start with service mariadb start.
I tried to purge all mariadb-* and mysql-* packages, delete configs and ...
- 245
6
votes
2
answers
23k
views
SELinux contexts with NFS shares
I'm trying to set up an NFS share between 2 CentOS servers (filesrv & websrv) for a folder that needs to be readable & writeable by the Apache process. I'm having trouble with the writeable ...
- 201