New answers tagged

1

With SELinux the filesystem has extra "permissions" above and beyond the regular UNIX ones. If you were to run ls -Z ... (-Z is an SELinux extension to ls(1)) on files under /var/www/html across both machines I suspect you will see the following: On server A: drwxr-xr-x root root system_u:object_r:httpd_sys_content_t /var/www/html/ On server B: drwxr-xr-...


0

So I found that another service had a defined status for TCP port 5000. But by replacing the -a option with -m for modify, added tcp port 5000 to http_port_t So the command that worked was: # semanage port -m -t http_port_t -p tcp 5000


2

On the systems I have to hand (C6, C7 and F24), tcp port 5000 has an SELinux context of commplex_port_t. This will be why, when you try to add it you get the error message /usr/sbin/semanage: Port tcp/5000 already defined To change the context of tcp port 5000 from commplex_port_t to http_port_t you will need to use the -m | --modify switch -m, --modify ...


0

Solved my own problem... @Iain and @kamihack from the comments were right, it is not SELinux problem. As I have mentioned in my own comments before, my servers are running in a virtual environment. After I finished setting up my first server, the server is then cloned to multiple servers. I realized the provider actually typed the server name as the name ...


0

Edge case - if you rm /var/log/audit/audit.log, auditd is not smart enough to create a new file. If you touch /var/log/audit/audit.log, auditd is not smart enough to write to the new file you just created. You have to restart the auditd service to get your logging working again.


1

It's an SELinux issue. But to make sure of that disable enforcing just for testing. Testing Execute this in your server (root only) to temporarily disable SELinux # setenforce 0 Now you can start the server # systemctl start mariadb Connect using mysql client but first modify the configuration on file /etc/my.cnf.d/client.cnf to use the new socket ...


2

Running your messages through audit2allow we find #============= smbd_t ============== #!!!! This avc can be allowed using the boolean 'samba_export_all_rw' allow smbd_t tmp_t:file { write open }; This tells us that samba isn't allowed to write or open files with a context tmp_t 1. You could put SELinux in Permissive mode and let the system run for a ...


1

I found the solution with help of a Bogdan Kuštan. It because Selinux accepts 5432 as Postgresql port and does not work with other ports. You can check acceptable ports to Selinux labeld port with semanage port -l command. You can add ports to labeled ports with "semanage port -a" command with some other parameters and in my case: semanage port -a -t ...


2

There are multiple httpd contexts and this isn't the right one. The directory in which the pid file goes should have the context httpd_var_run_t . I'd recommend against putting it in /etc and create one in /var/run. To set the correct context permanently for example for /var/run/httpd-bobby: semanage fcontext -a -t httpd_var_run_t "/var/run/httpd-bobby(/....



Top 50 recent answers are included