Tag Info

New answers tagged

0

The issue was caused by upgrading CentOS from 6.5 to 6.6 and how SElinux allows content type through. With this upgrade SElinux by default only allows httpd_t content through (similar to how they treat apache), and because I store all my webcontent in /srv/www/ these user created folders did not have content label set automatically by the system. To check ...


0

chmod ogw file sets permission on file for owner, group and world, each being the sum of read(4), write(2), execute(1), if wanted no proper access to read write drwxr-x--x brian nobody website1 nginx is reading only, so you have to let him into! cd /srv/ find . -type d -exec chmod 755 {} \;


0

Some advices for you: - Disable selinux and reboot # vi /etc/selinux/config selinux=disabled - Stop iptables # systemctl stop iptables.service - Have you created one ldap user? (try with following guide http://www.server-world.info/en/note?os=CentOS_7&p=openldap&f=2 ) - Edit /etc/ssh/sshd_conf PermitRootLogin yes UsePAM yes - Check ...


0

For future readers, for me, just setting the bool to allow httpd to make DB connections was sufficient; i.e.: setsebool -P httpd_can_network_connect_db 1 You can check/verify that the setting is set by: getsebool httpd_can_network_connect_db which should return '... => on' After that, if you tail -f /var/log/audit/audit.log and re-attempt your ...


1

Because you created the file while logged in as an unconfined user. Since in the targeted policy the user is almost always ignored, this really isn't an issue. If you really want to change it, you can use chcon to do that. For instance: # ls -Z /etc/nsswitch.conf.ipabkp -rw-r--r--. root root unconfined_u:object_r:etc_t:s0 /etc/nsswitch.conf.ipabkp # ...


3

Running the AVC through audit2allow gives the following notice: #!!!! This avc can be allowed using one of the these booleans: # httpd_read_user_content, httpd_enable_homedirs In this case, httpd_read_user_content will be the appropriate one to use. Note that it's a good idea to set SELinux to permissive so that you can collect all of the AVCs at ...


2

I found the solution -> i learned that i need to disable "dontaudit" to see all audit.log entries... semodule --disable_dontaudit --build So with that i was able to create a SELinux module that worked!


1

Already An error occurs when different security context is given to the port you want to add. If you are using Tomcat The fundamental HTTP port 8080, the port is http_cache_port_t type. If you are using nginx was built 8081 and it transproxy_port_t or both context apache web server generates an error because it can not connect. If you need to change the ...



Top 50 recent answers are included