New answers tagged

1

You don't say what distro/release you are using which may be relevant. I only have Centos 6 and 7 to hand but the tools to use should be available on other distros. The tools you should familiarise yourself with are audit2why and audit2allow. Running your denial messages through the tools will point you in the right direction. On the CentOS 6 sytem I ...


1

If you want to configure SELINUX for Mongo in simple way - try audit2why on your /var/log/audit/audit.log to see what kinds of violations would have been denied, and build custom policies with audit2allow. It works in 80% of incidents. If you'll still have problems - run audit2why and fix another issues manually. Maybe we can help you on this step.


0

To allow lighttpd to execute files, enable the SELinux bool http_execmem. Then change the file type to allow lighttpd to be executed: chcon system_u:object_r:httpd_exec_t:s0 [file]. Keep that change persistent in the kernel by using semanage fcontext -a -t httpd_exec_t [file].


1

No answer gave proper advice on how to update the SELinux rule as well as making the settings persist upon a server reboot, to do so do the following: # setsebool -P httpd_can_network_connect on # setsebool -P httpd_can_network_connect=true This was done on RHEL7.


0

I managed to solve it finally. I share the solution below as it might be useful to others too. I created a working file named audit.log containing just the lines below: type=AVC msg=audit(1460038526.265:69): avc: denied { read } for pid=4858 comm="check_mysql" name="mysql" dev=dm-0 ino=130900 scontext=system_u:system_r:nagios_services_plugin_t:s0 ...


2

You need to create custom SELinux policy and apply it on your system. Looks like asterisk can't open tcp_socket on 993 port so policy might be: #cat asterpolicy.te module asterpolicy 1.0 require { type asterisk_t type pop_port_t; class tcp_socket name_connect; } #============= asterisk_t ============== allow asterisk_t ...


4

Try this: setsebool -P nagios_run_sudo 1 On host with NRPE. This option is disabled by default in SELinux policy.


0

Your problem is that the socket usually resides inside /var/lib/mysql with the data files. Since you are using a different database dir, SELinux is blocking the request, regardless of the symlink. You can try to access MySQL via the TCP connection (use 127.0.0.1 and not localhost) But this might still cause problems with SELinux with the MySQL daemon ...



Top 50 recent answers are included