Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [selinux]

NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

1
vote
1answer
22 views

MongoDB won't run if dbPath is symlinked

I have installed MongoDB 4.0.4 from the official repo. I followed these instructions. My OS is CentOS 7 and SELinux is in enforcing mode. If I use a dbPath value which is a symlink to another ...
1
vote
2answers
21 views

Using SQLite through PHP without completely disabling SELinux

I'm trying to access an SQLite file on a CentOS7 box using PHP and the PDO library. I was getting read-only errors just like this question - https://stackoverflow.com/questions/3319112/sqlite-read-...
0
votes
2answers
106 views

Configure SELinux to allow all outbound tcp and udp ports

I have an application that potentially connects to any outbound, remote tcp/udp port. As a result, I want a way to allow all outbound tcp and udp connections. I understand that you can use a ...
1
vote
1answer
31 views

Permission denied when adding audit rule in audisp plugin

I'm trying to write an audisp plugin on a Linux CentOS 7 VM. Instead of statically setting the audit rules via /etc/audit/rules.d/, I wanted to add rules dynamically in the plugin using libaudit ...
-2
votes
1answer
112 views

Nginx cache mkdir failed (2: No such file or directory) while reading upstream

Edit for answer: It's the selinux causes this problem, the temporary solution is to run this command: sudo semanage permissive -a httpd_t But you shouldn't do that, because of security reasons. I ...
0
votes
0answers
21 views

SELinux: How can I use the 8081 port with apache? [duplicate]

I need to use the 8081 port with Apache but Selinux doesn't allow that: semanage port -l | grep http_port_t http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000 semanage ...
1
vote
1answer
41 views

Why SELinux blocks dhcpd from executing a script from writing a log file?

I would like to have dhcpd execute a script, which for now just tries to create a log file in /var/log/dhcpd/, but SELinux denies it to do so. Question Can anyone from the below see what permissions ...
10
votes
1answer
822 views

SELinux reset root password

Disclaimer: This question is not to solve the problem of changing root password while SELinux is active because there are a lot of guides to solve that already. This is more of how SELinux does that ...
-1
votes
2answers
77 views

Need help installing ejabberd on Centos/RHEL7 with SELinux and reverse proxy

I've been trying to get a web client to use EJabberd on the recommended port (5281) through a reverse proxy (HAProxy) on Centos7 with SELinux enabled. I am not familiar with SELinux context rules. ...
2
votes
1answer
73 views

Selinux Policy for CAP_SYS_PTRACE by invoking process name

I have a system in which we have GDB installed and a target binary which needs to be debugged for errors. We do not want the user to be able to debug any other process apart from the target binary. ...
1
vote
0answers
21 views

why selinux is denying file access(ls /usr/bin) to container_file_t type inside my container

I have one RHEL7.4 node, that when enforing selinux, it will fail my container, I checked and found it is denying reading in the container internal directories: # docker run -it 172.16.1.120:5000/...
0
votes
1answer
84 views

selinux in a chroot environment

I need to change selinux policy for /etc/ssh/sshd_config in a chroot environment designed to rescue my system (on a dedibox) : it actually does not have any selinux context defined and then sshd won't ...
0
votes
1answer
22 views

selinux context for multiple databases

I have a directory /media/databases under which I want to hold 3 different databases : mariadb, postgresql and neo4j. My issue is that I already have configured postgresql selinux context and the ...
0
votes
0answers
41 views

is there any way to filter in syslog (not rsyslog) such as programname?

I need to add filter in my syslogs. I know how to do in rsyslogs. But we need to add same logs in syslogs as well in legacy systems.Is there any way to do it? Corresponding rsyslog entries are: :msg,...
1
vote
1answer
76 views

Why is Nginx only serving the Index mark-up when I use it as a reverse proxy for Nexus 3 Repository Manager?

I am trying to serve a Nexus3 Repo Manager through Nginx reverse proxy, but it only serves the Index mark-up. I have set up Sonatype Nexus 3 Repository manager on an Azure RHEL (SELinux) instance. I ...
0
votes
1answer
138 views

vsftpd error 530 Login incorrect error occurs with valid credentials

Though there are a number of similar existing question/answers that reference vsftpd and error code 530, but they do not seem to be helpful in this case: vsftpd login error: 530 VSFTPD 530 Login ...
1
vote
1answer
266 views

SELinux - Zabbix server can't read conf file

I have installed zabbix server on red Hat 7.4 server with SELinux policy in Enforcing mode. If I launch Zabbix-server (3.4.11), I have theses errors : /var/log/zabbix/zabbix_server.log Jul 25 16:51:...
0
votes
1answer
284 views

SELinux blocks tomcat web application to load Java native library (JNI) - how to configure SELinux on Centos 7?

I have a Centos 7 with Tomcat installed and tomcat user ls -l /var/lib/tomcat total 0 drwxrwxrwx. 5 root tomcat 84 Jul 3 13:18 webapps SELinux is enforcing and a Java web application which tries ...
0
votes
0answers
32 views

selinux denial nrpe access to a ldap port

type=AVC msg=audit(1530564199.190:10850): avc: denied { name_connect } for pid=28307 comm="check_syncrepl." dest=389 scontext=system_u:system_r:nrpe_t:s0 tcontext=system_u:object_r:ldap_port_t:s0 ...
0
votes
1answer
135 views

nginx cache dir creation—strange behaviour

I have the following line (plus context) in my nginx.conf: http { proxy_cache_path cache/ keys_zone=auth_cache:10m; ... Since nginx.conf is in /etc/nginx, cache/ corresponds to /etc/nginx/...
1
vote
1answer
124 views

Accidentally removed libselinux and nothing works

I have accidentally removed libselinux on centos 7.4 and am unable to install it again and all commands fail. How do i recover? ls: error while loading shared libraries: libselinux.so.1: cannot open ...
0
votes
3answers
115 views

SeLinux stops starting of nginx

Reboted nginx proxy server (centos7+nginx only, apache on another) I got error: DOMAIN systemd[1]: Starting Session 439 of user root. -- Subject: Unit session-439.scope has begun start-up -- ...
0
votes
0answers
33 views

How to filer Audit.log based on hostname or addr

I have enabled auditd to collect logs based on some rules and everything is working nicely. I wonder to know is there anyway to filer type of audit (ex USER_LOGIN) based on addr or hostname? For ...
1
vote
1answer
76 views

SELinux context documentation

I am trying to get my head around SELinux but one question keeps popping-up in my head: CONTEXT. When I'm writing custom rules and modules (on CentOS 7), I end up just taking contexts out of the air -...
0
votes
0answers
15 views

Changed AWS RDS instance name and now can't connect to the databases

I have a basic Wordpress site setup on AWS in a high-availability setting in two different zones and behind a load balancer, the databases are on AWS RDS with the failover/backup one in the second ...
0
votes
2answers
60 views

Allow SeLinux to specific user can send email

I'm trying to allow user zabbix to send email using ssmtps. I've configured everything except SeLinux. For SeLinux booleans there is no such item available for zabbix like httpd_can_sendmail. PS: I ...
0
votes
0answers
103 views

How to pre-install and pre-configure selinux in a kvm/qemu guest image using docker?

I'm working in a company where we need to distribute our image running SE-Linux inside. The product uses virtualization for additional security, thus we have got a setup with a linux host, running ...
0
votes
0answers
117 views

SELinux allow process to execute binary

I have the Bacula backup system running and SELinux is interfering. The problem arises when Bacula runs a script that invokes /usr/bin/hostname before one of the backups. 12-Apr 00:05 dir_backup ...
0
votes
1answer
164 views

Does enabling SELinux “enforcing” in KVM host causing problems in the guests?

I've KVM hypervisor with (Software Raid1) and I've few created VMs .. Does Enable "SELinux" IN the host affects badly on Raid1 and The guests (VMs) ? or there is no relation? Is it a recommended ...
1
vote
2answers
168 views

Not able to start apache in Wildfly 10 domain mode cluster with Apache mod_cluster, due to SELinux issue

I am trying to setup a Wildfly 10 cluster in domain mode with Apache mod_cluster. In my Centos 7 webserver node I have installed Apache(2.4.6) using: # yum install httpd Then copied the following ....
-1
votes
1answer
166 views

MySqld Service wont start on Redhat7 after a yum update

I'm having a problem with Redhat7 after a yum update. Various services wont start and are giving permissions errors. Similar problem to Can't start any service after installing iRedMail on ...
3
votes
1answer
93 views

CentOS7 SELinux doesn't seem to adhere to MCS categories

Problem A file that is assigned to a certain SELinux MCS (Multi Category Security) category can be read by a user who is not assigned to that category, indicating that MCS somehow does not work on my ...
0
votes
1answer
340 views

SELinux: how to allow httpd to delete temp files from MySQL?

Here's the setup: I let MySQL dump tables to /tmp (they just contain numbers, no real data) for PHP to pick up and process. After this, the temp files are no longer needed, so I delete them with PHP (...
1
vote
1answer
856 views

SELinux will not disable on CentOS7

I want to permanently disable right now for the short term but nothing seems to work for me Steps I have tried [root@db1e secure]# setenforce 0 [root@db1e secure]# sestatus SELinux status: ...
0
votes
1answer
62 views

Removing module fails - cannot find port type, but it's there?

I have a SELinux module that, among other things, allows Apache to connect via TCP to a specific port: cat <<EOF > sgtest.te module sgtest 1.0.0; require { attribute port_type; type ...
0
votes
0answers
169 views

SELinux: why does a new file inherit its context from its parent?

Various sources tell me that a new file gets its SELinux context from its parent (unless a transition policy exists): 1. SELinux - canonical way of automatically applying a context on file creation ...
1
vote
0answers
173 views

SELinux set enforcing issue

I am on CentOS 6.9 with a LAMP stack, trying to set SELinux=enforcing in /etc/selinux/config However after **reboot ** and checking sestatus I still get SELinux status:disabled Then I tried running ...
0
votes
0answers
186 views

allow apache to run php script - audit2allow hasn't worked thus far

At a previous company the fix was to disable SELinux. I'm trying to leave SELinux enabled and tune what I need in order to accomplish my goal. In short, I want apache/httpd to run '/usr/bin/...
1
vote
1answer
227 views

Can't read from /proc/self/attr/current, but permissions are 0666

I'm working with an externally created script that reads from /proc/self/attr/current to get SELinux configuration info. It seems that, even though permissions on the file are 0666, on some systems ...
2
votes
1answer
56 views

Executing semanage returns that Python 'Plural forms expression could be dangerous'

Returning to the same issue. I am receiving some error in python when adding semanage rules: # semanage port -a -t http_port_t -p tcp 29200 Traceback (most recent call last): File "/sbin/semanage", ...
0
votes
1answer
67 views

Set persistent SELinux file types under /run

I set a file to a specific type using semanage fcontext, and using restorecon does properly set the file type. However, upon reboot, the type goes back the default. If I run restorecon again then it ...
1
vote
1answer
395 views

Why is SELinux blocking systemctl --user / systemd user instance commands?

I have a number of Fedora 27 systems. I am reasonably comfortable with SELinux. I run it on all my systems, with the "unconfined" module disabled. On this particular system, SELinux is blocking all ...
0
votes
1answer
210 views

Can not change SELinux security context on Gluster FS folder

I can not change the security context of a folder which is created inside a Gluster-FS volume. Following is the error I keep getting. chcon: failed to change context of ‘test’ to ‘system_u:object_r:...
1
vote
2answers
4k views

SELinux corrupted? Now unable to boot CentOS 7 with SELinux enabled

We recently experienced a power failure and simultaneous backup generator failure, severe enough to require safely shutting down all servers as their UPSs were draining. Upon bringing one CentOS 7.4....
3
votes
1answer
363 views

Have SSHD listen to another port on Centos with SELinux running

I have a Centos VM running with SELinux enabled. I wish to have sshd listen to another port --- says, 993. I've modified the sshd_config file to listen to another port, but SELinux is getting in the ...
2
votes
1answer
560 views

How to restrict root to access a directory used by other user with selinux

I want to restrict the root to access a folder/directory which is created by another user.So that only that user can access that folder not even root. Is there any selinux configuration to do so this ...
1
vote
1answer
280 views

Centos 7 Selinux issue I think? php cannot read or write

I have an uploads folder for my web application: /disk2/app/uploads. ls -Z returns: drw-r--r--. apache apache unconfined_u:object_r:httpd_sys_rw_content_t:s0 uploads ls -Z / returns: drwxrwxrwx. ...
1
vote
1answer
157 views

SELinux denies “systemctl kill” when used in Anacron postrotate script on CentOS 7

I'm using backup software called UrBackup, which I've configured to rotate its logs once a day through cron.daily. After the logs are rotated, the software uses a postrotate script to send the running ...
0
votes
0answers
229 views

httpd service cannot start after SELinux is set to enforcing

There are several other questions like this but none were able to solve my problem. Here are the details: After setting SELinux=enforcing, httpd service fails to start. In error.log I see following ...
-1
votes
1answer
445 views

HAProxy not detecting backend with non-standard http port

I have a HAProxy setup where the backend server is running a webserver non standard port.The config is as follows global log 127.0.0.1 local2 chroot /var/lib/haproxy ...