New answers tagged

1

Running your messages through audit2allow we find #============= smbd_t ============== #!!!! This avc can be allowed using the boolean 'samba_export_all_rw' allow smbd_t tmp_t:file { write open }; This tells us that samba isn't allowed to write or open files with a context tmp_t 1. You could put SELinux in Permissive mode and let the system run for a ...


1

I found the solution with help of a Bogdan Kuštan. It because Selinux accepts 5432 as Postgresql port and does not work with other ports. You can check acceptable ports to Selinux labeld port with semanage port -l command. You can add ports to labeled ports with "semanage port -a" command with some other parameters and in my case: semanage port -a -t ...


2

There are multiple httpd contexts and this isn't the right one. The directory in which the pid file goes should have the context httpd_var_run_t . I'd recommend against putting it in /etc and create one in /var/run. To set the correct context permanently for example for /var/run/httpd-bobby: semanage fcontext -a -t httpd_var_run_t "/var/run/httpd-bobby(/....


-1

I think I can answer the question: sedismod needs the bunzipped version of the file, apperently. I ran into the same problem, but after using bunzip2 on the file, sedis


1

This did it for me: setsebool -P httpd_read_user_content 1 setsebool -P httpd_can_network_connect 1 -P makes it persistent across reboots.


2

If by "enabled" you mean to have a full fledged SELinux policy within the container, the answer is no. Of course the host where the containers are deployed can have SELinux enforced, and the processes within the container can be confined as well. This confinement operates from the host server point of view. There is support for sVirt MCS/MLS confinement ...


2

Couldn't add a comment in the excellent answer above so I'll have to add a new "answer": If you can't compile the freshly made module because of a missing /usr/share/selinux/devel/Makefile file, make sure to install the selinux-policy-devel package: yum install selinux-policy-devel Now the file will exist and you can go on with the rest.



Top 50 recent answers are included