NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

learn more… | top users | synonyms

27
votes
7answers
5k views

Reasons to disable / enable SELinux

In the line of this question on StackOverflow and the completely different crowd we have here, I wonder: what are your reasons to disable SELinux (assuming most people still do)? Would you like to ...
15
votes
3answers
8k views

SElinux: allow httpd to connect to a specific port

My system is running CentOS 6.4 with apache2.2.15. SElinux is enforcing and I'm trying to connect to a local instance of redis through my python/wsgi app. I get Error 13, Permission denied. I could ...
11
votes
2answers
19k views

How do I get SELinux to allow Apache and Samba on the same folder?

In the configuration I have setup I wish to allow samba and apache to access /var/www I am able to set a context to allow samba access, but then httpd doesn't have access. Using setenforce to 0 ...
10
votes
5answers
3k views

Why we need SELinux?

I could not get much idea where the SELinux has been used and what it saves from attacker. I have gone through SELinux web site and read the basic but still not getting clue about SELinux. For the ...
10
votes
5answers
6k views

Trying to SSH in to remote computer but still asking for password

Trying to SSH in to remote computer but still asking for password. I have a number of computers running SElinux and only one of them is giving me a hard time using ssh without the password. I did ...
9
votes
3answers
1k views

Real life SELinux security example?

Can anyone give a real life example of where SELinux saved their security bacon? (or AppArmour if you wish). If not your own, a pointer to someone with a credible experience? Not a lab test, not a ...
8
votes
3answers
5k views

CentOS 6 kickstart ignoring 'selinux --disabled'

I've been fighting with this one for a bit and it seems that there has been a regression in CentOS 6 as far as anaconda ignoring the selinux --disabled directive. This appears to have first appeared ...
7
votes
1answer
7k views

How do I view the contents of a SELinux policy package

As the title says, how do I view the contents of a SELinux policy package? The resulting files end with .pp. I'm running on centos 6, but I guess it's the same way on "all" distros. For example ...
7
votes
1answer
772 views

How can I use SELinux to confine PHP scripts?

I want to compartmentalize different PHP applications on my SL6.4 (RHEL 6.4 rebuild) web server so that they cannot access each others' data. It seems that SELinux might be able to do this, but I am ...
7
votes
1answer
2k views

How to run PhantomJS on CentOS with SELinux?

I'm trying to make a screenshot using PhantomJS on my CentOS 5 machine, but I can't get it to work together with SELinux. It works on an identical machine with SELinux disabled, so I really suspect ...
6
votes
4answers
1k views

Does SELinux make Redhat more secure?

Does SELinux make Redhat more secure? I can't remember the number of times when I have disabled SELinux because it kept frustrating my ability to get stuff running. Lots of times to there was no ...
6
votes
3answers
26k views

Where is the sshd log file on Red Hat Linux stored?

Can someone please tell me where to find the SSHD log on RedHat and SELinux.... I would like to view the log to see who is logging into my account..
6
votes
3answers
794 views

SELinux - Getting Started on really understanding it?

I often have problems with SELinux, most of which I have resolved eventually. There are still some situations where doing custom policy would be very elegant and more proper. I'd like to get the ...
6
votes
3answers
1k views

SELinux in the Real World

Through my (short) job experience to date, I have gained quite a bit of knowledge of how SELinux works, from an implementation point of view and how to administer it. I personally have several ...
6
votes
1answer
5k views

Linux - CentOS6 - semanage - command not found

I am trying to solve an issue where my HTTPD is denied access to binding custom ports and I believe it has to do with SELinux. Whilst doing some googling I came across some posts where users were ...
5
votes
1answer
1k views

CentOS is ignoring my public key

I am trying to connect to my own CentOS server using SSH; I am able to connect fine with a password; I am trying to connect with my public key, but the server does not attempt public key ...
5
votes
6answers
7k views

how do I allow mysql connections through selinux

I'd like to for once leave selinux running on a server for the alleged increased security. I usually disable selinux to get anything to work. How do I tell selinux to allow mysql connections? The most ...
5
votes
2answers
274 views

How to handle large number of users in SELinux?

A while back we started authenticating users on our Linux servers against Active Directory. As far as the actual authentication part goes, things are working great. However, one of the side effects ...
5
votes
1answer
5k views

How do I assign an SELinux label to a symlink with semanage so it persists after a relabel?

My apache DocumentRoot /var/www is a symbolic link to another path. The target has the appropriate file context label (httpd_sys_content_t) so that apache can read it with SELinux enabled. However, ...
5
votes
1answer
1k views

SElinux label for php-fpm sockets

I'm attempting to set up multiple instances of php-fpm to run multiple versions of php through apache 2.2 running on centos 6.5. At some point in the future this will end up in a shared hosting ...
4
votes
3answers
1k views

SELinux - canonical way of automatically applying a context on file creation

My current understanding is that you have to manually use restorecon to apply the desired context to a newly created file or directory unless you are happy with the context that it inherits from its ...
4
votes
2answers
3k views

Fedora 16: “Permission denied: file permissions deny server access”

I'm working with a fresh Fedora 16 install and I'm trying to get Apache up and running. I'm very familiar with Linux and somewhat with CentOS, but I have very little experience with Fedora and SELinux ...
4
votes
3answers
10k views

TFTP uploads failing

I am running TFTPD via xinetd on a Centos 5.4 server. I am able to access files via tftp fine, so I know the service is running ok. However, whenever I try and upload a file I get a 0 Permission ...
4
votes
1answer
875 views

Unable to re-enable SELinux

Up until now we have disabled SELinux as our Standard Operating Procedure -- before you tell me off, I know. That's why we're enabling it now we've got time to. Our normal procedure was to: Set ...
4
votes
2answers
3k views

What does the .autorelabel file do in Linux?

What does the .autorelabel file located at the file root / do in Linux? I know its something to do with SELinux but I can't find any information as to what it actually does. I am running CentOS 6. ...
4
votes
6answers
1k views

Linux distributions without selinux

Are there linux distros without selinux portion in kernel? Sorry if that's dumb question ;), but my distro (debian) has it and i see that it's in kernel on kernel.org so i was wondering if it's so ...
4
votes
2answers
1k views

Unable to start Mysql with SELinux

I am attempting to start MySQL with SELinux on CentOS 6 however I am getting the following error. 131212 09:08:08 mysqld_safe mysqld from pid file /var/run/mysqld/mysqld.pid ended 131212 09:08:58 ...
4
votes
1answer
209 views

SELinux: How to show all allowed rules for a type?

For an arbitrary object type, e.g. user_tmp_t, I want to know which processes are allowed to access this tag. How do I find all allow rules that reference user_tmp_t?
4
votes
2answers
864 views

SELinux & ncsa_auth in Squid

I'm trying to enable SELinux on a CentOS 5.5 server with Squid 3.1.12 that handles authentication via ncsa_auth. When I turn off SElinux everything works fine, but when I enable it, Squid crashes on ...
4
votes
1answer
1k views

Granting sudo access to a SELinux confined user in freeIPA

I'm using freeIPA to define RBAC, HBAC and sudo rules, as well as SELinux user mappings for a domain of a couple hundred virtual machines, where I need to grant different levels of access to several ...
4
votes
3answers
6k views

SELinux prevents Nagios plugins from running on RHEL6

After installing Nagios NRPE & Nagios Plugins, I'm getting the following entry in my rsyslog: May 13 14:01:30 wcmisdlin02 kernel: type=1400 audit(1305309690.482:2334): avc: denied { getattr } ...
4
votes
2answers
3k views

SELinux blocking Samba directory listing

I am running Samba on a CentOS server, and I am experiencing a problem where it allows me to connect to the server and see a share, but shows the share as an empty directory. I find this behavior ...
4
votes
1answer
1k views

RHEL6: Tomcat runs as unconfined Java user

I'm starting to configure RHEL6 to be a hardened Tomcat server and applying SELinux policies for access control. After installing RHEL6 and Tomcat6 (standalone, no httpd), I noticed that the Tomcat ...
4
votes
1answer
2k views

how can I modify a SELinux access restriction

I want SELinux to allow the LogRotate daemon to rotate and compress the audit logs under /var/log/audit/audit.log, but it's being blocked with this error message showing up: Oct 27 04:06:03 ...
4
votes
2answers
2k views

Write once, read many (WORM) using Linux file system

I have a requirement to write files to a Linux file system that can not be subsequently overwritten, appended to, updated in any way, or deleted. Not by a sudo-er, root, or anybody. I am attempting to ...
4
votes
1answer
248 views

AD GIT SELinux RHEL 6 : Can not get SELinux to allow connetion to git

I have a problem with SELinux! I have installed git on Red Hat Enterprise 6 with AD group control and SSL Cert . Everything works fine if I do setenforce 0 ( set SELinux in detection only mode ) or ...
4
votes
0answers
231 views

SELinux: cannot confine Firefox process to mozilla_t domain

My goal is to execute Firefox in the mozilla_t domain instead of unconfined_t. The machine runs Fedora 20 with SELinux in enforcing mode. Unfortunately, I can't seem to get this right. No matter ...
3
votes
2answers
2k views

What is the difference between httpd_read_user_content and httpd_enable_homedirs?

The apache module of SELinux has two similar boolean parameters: httpd_read_user_content and httpd_enable_homedirs. Man page says the former allows httpd to read user content and the latter allow ...
3
votes
2answers
94 views

Relocated /var - now selinux is unhappy

I needed more space in the /var tree on a VM so I allocated some, booted in to runlevel 1 and copied over the folder to the new space. After changing the fstab entry for /var to reflect the new ...
3
votes
2answers
8k views

mod_unique_id: unable to find IPv4 address of FQDN despite setting etc/hosts and Apache ServerName

I'm trying to get mod_security and hit the very common hostname error of [alert] (EAI 2)Name or service not known: mod_unique_id: unable to find IPv4 address of "computername.domain.com" This ...
3
votes
6answers
14k views

How to disable SELinux for Apache httpd only on my Fedora 14?

By following this link I am able to just turn SELinux off completely from my Fedora 14. But I wonder how could I disable SELinux only for the httpd daemon? I don't have system-config-selinux installed ...
3
votes
2answers
1k views

CentOS - semanage - Adding Custom Port Fails

I recently upgraded one of my application servers to CentOS 6(.2) and was getting it ready for production use when I can across the following issue; Whenever I try to add a custom http port by way of ...
3
votes
2answers
3k views

SELinux: how to enable write access to Joomla cache directory?

I have set up SELinux on a Debian squeeze system, which runs a Joomla website. The Joomla PHP code wants to have write access to certain cache directories. The /var/log/messages file contains ...
3
votes
2answers
4k views

Unable to start auditd

I am on CentOS 5.8 final I recently installed auditd via yum install audit however I am unable to start it. I edited the configuration file to give a verbose output of the error it is recieving in ...
3
votes
1answer
348 views

SELinux remove or leave the old SSH port label?

I am following this (basic) security guide to change my Server's SSH port to something else. It says: $ semanage port -a -t ssh_port_t -p tcp 2345 #Change me ...which would add a new label on top ...
3
votes
1answer
3k views

SELinux: Letting Apache talk to MySQL on CentOS

So I have chrooted MySQL into /opt/chroot/mysql, and everything runs fine. Apache is configured normally, and also runs fine. I created a small PHP script which connects to the MySQL Daemon, and ...
3
votes
2answers
143 views

Can you give one directory two SELinux Policies?

Out of laziness I want to be able FTP into my WWW directory. However, the SELinux permissions for apache(user_u:object_r:httpd_sys_content_t) to be able to use the WWW directory and for the ...
3
votes
2answers
1k views

RHEL SELinux blocking Apache access to PostgreSQL

I'm running a Django app that uses PostgreSQL. The server is running RHEL 6.5 with SELinux. I'm having an issue where the Django app can't connect to the DB, and I think it's because SELinux is ...
3
votes
2answers
79 views

Lost password on EC2 SELinux instance

As the title says, I have an SELinux instance on EC2 that I haven't used for a while. I have been unable to access it via ssh since firing it back up. I have accessed it from this machine in the ...
3
votes
1answer
2k views

How can I query for all selinux rules/default file contexts/etc affecting a type

I need to know everything related to a selinux type on a running system's current rules: allow, allowaudit, dontaudit rules. files labeled with a context using the type. transitions. ...and any ...