Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [selinux]

NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

2
votes
0answers
107 views

Multiple IP addresses with SELinux using the same port

I have a CentOS 7 box with multiple IP address on the same NIC. One IP uses 443 for ssh and I want the other IP to use 443 for the web server. SELinux won't let httpd startup saying: (13)Permission ...
3
votes
1answer
92 views

SELinux relabeling on boot is stuck

I have problem restoring SELinux on a server and would like some insight. Context On our server, I recently changed SELinux from enforcing to permissive, and because it did not solve our problem ...
0
votes
0answers
16 views

SELinux httpd With custom app

I'm enabling SELinux on a server, and the httpd server (nginx and phusion passenger) is unable to read the app's dir (/home/app), with the following message: #============= httpd_t ============== #!!...
1
vote
1answer
31 views

how to add a dot recursive in file/folders permissions

example of files with there permissions -rwxr-xr-x. 1 root root 659 Jan 4 2018 zookeeper-server-initialize -rwxr-xr-x. 1 root root 649 Jan 4 2018 zookeeper-server-cleanup -rwxr-xr-x. 1 root ...
0
votes
1answer
150 views

SELinux: pam_systemd(sudo:session): Failed to connect to system bus: Permission denied

On one of CentOS 7 servers I cannot perform sudo from nrpe user (Nagios daemon remote monitoring). Error message: Dec 31 08:28:10 ip-172-31-36-176 sudo: pam_unix(sudo:session): session opened for ...
0
votes
1answer
47 views

SELinux is preventing /usr/sbin/httpd from getattr access after switching to self signed cert

I recently created my own CA and issued my first root cert, then intermediate, then finally a server cert/key/chain for apache. When i switch from the letsencrypt certs added with certbot to the ...
1
vote
0answers
27 views

SELinux policy and changing disk ids on Hardened Gentoo

I run a system with hardened Gentoo under a KVM/QEMU. I am new to SELinux and make heavy use of audit2allow to get things working. When doing this I include and carry along the location of the disk, ...
1
vote
1answer
55 views

MongoDB won't run if dbPath is symlinked

I have installed MongoDB 4.0.4 from the official repo. I followed these instructions. My OS is CentOS 7 and SELinux is in enforcing mode. If I use a dbPath value which is a symlink to another ...
1
vote
2answers
31 views

Using SQLite through PHP without completely disabling SELinux

I'm trying to access an SQLite file on a CentOS7 box using PHP and the PDO library. I was getting read-only errors just like this question - https://stackoverflow.com/questions/3319112/sqlite-read-...
0
votes
2answers
136 views

Configure SELinux to allow all outbound tcp and udp ports

I have an application that potentially connects to any outbound, remote tcp/udp port. As a result, I want a way to allow all outbound tcp and udp connections. I understand that you can use a ...
1
vote
1answer
41 views

Permission denied when adding audit rule in audisp plugin

I'm trying to write an audisp plugin on a Linux CentOS 7 VM. Instead of statically setting the audit rules via /etc/audit/rules.d/, I wanted to add rules dynamically in the plugin using libaudit ...
-2
votes
1answer
303 views

Nginx cache mkdir failed (2: No such file or directory) while reading upstream

Edit for answer: It's the selinux causes this problem, the temporary solution is to run this command: sudo semanage permissive -a httpd_t But you shouldn't do that, because of security reasons. I ...
0
votes
0answers
30 views

SELinux: How can I use the 8081 port with apache? [duplicate]

I need to use the 8081 port with Apache but Selinux doesn't allow that: semanage port -l | grep http_port_t http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000 semanage ...
1
vote
1answer
58 views

Why SELinux blocks dhcpd from executing a script from writing a log file?

I would like to have dhcpd execute a script, which for now just tries to create a log file in /var/log/dhcpd/, but SELinux denies it to do so. Question Can anyone from the below see what permissions ...
11
votes
1answer
1k views

SELinux reset root password

Disclaimer: This question is not to solve the problem of changing root password while SELinux is active because there are a lot of guides to solve that already. This is more of how SELinux does that ...
-1
votes
2answers
94 views

Need help installing ejabberd on Centos/RHEL7 with SELinux and reverse proxy

I've been trying to get a web client to use EJabberd on the recommended port (5281) through a reverse proxy (HAProxy) on Centos7 with SELinux enabled. I am not familiar with SELinux context rules. ...
2
votes
1answer
100 views

Selinux Policy for CAP_SYS_PTRACE by invoking process name

I have a system in which we have GDB installed and a target binary which needs to be debugged for errors. We do not want the user to be able to debug any other process apart from the target binary. ...
1
vote
0answers
32 views

why selinux is denying file access(ls /usr/bin) to container_file_t type inside my container

I have one RHEL7.4 node, that when enforing selinux, it will fail my container, I checked and found it is denying reading in the container internal directories: # docker run -it 172.16.1.120:5000/...
0
votes
1answer
158 views

selinux in a chroot environment

I need to change selinux policy for /etc/ssh/sshd_config in a chroot environment designed to rescue my system (on a dedibox) : it actually does not have any selinux context defined and then sshd won't ...
0
votes
1answer
34 views

selinux context for multiple databases

I have a directory /media/databases under which I want to hold 3 different databases : mariadb, postgresql and neo4j. My issue is that I already have configured postgresql selinux context and the ...
0
votes
0answers
75 views

is there any way to filter in syslog (not rsyslog) such as programname?

I need to add filter in my syslogs. I know how to do in rsyslogs. But we need to add same logs in syslogs as well in legacy systems.Is there any way to do it? Corresponding rsyslog entries are: :msg,...
1
vote
1answer
111 views

Why is Nginx only serving the Index mark-up when I use it as a reverse proxy for Nexus 3 Repository Manager?

I am trying to serve a Nexus3 Repo Manager through Nginx reverse proxy, but it only serves the Index mark-up. I have set up Sonatype Nexus 3 Repository manager on an Azure RHEL (SELinux) instance. I ...
0
votes
1answer
267 views

vsftpd error 530 Login incorrect error occurs with valid credentials

Though there are a number of similar existing question/answers that reference vsftpd and error code 530, but they do not seem to be helpful in this case: vsftpd login error: 530 VSFTPD 530 Login ...
1
vote
1answer
387 views

SELinux - Zabbix server can't read conf file

I have installed zabbix server on red Hat 7.4 server with SELinux policy in Enforcing mode. If I launch Zabbix-server (3.4.11), I have theses errors : /var/log/zabbix/zabbix_server.log Jul 25 16:51:...
0
votes
1answer
429 views

SELinux blocks tomcat web application to load Java native library (JNI) - how to configure SELinux on Centos 7?

I have a Centos 7 with Tomcat installed and tomcat user ls -l /var/lib/tomcat total 0 drwxrwxrwx. 5 root tomcat 84 Jul 3 13:18 webapps SELinux is enforcing and a Java web application which tries ...
0
votes
0answers
33 views

selinux denial nrpe access to a ldap port

type=AVC msg=audit(1530564199.190:10850): avc: denied { name_connect } for pid=28307 comm="check_syncrepl." dest=389 scontext=system_u:system_r:nrpe_t:s0 tcontext=system_u:object_r:ldap_port_t:s0 ...
0
votes
1answer
206 views

nginx cache dir creation—strange behaviour

I have the following line (plus context) in my nginx.conf: http { proxy_cache_path cache/ keys_zone=auth_cache:10m; ... Since nginx.conf is in /etc/nginx, cache/ corresponds to /etc/nginx/...
1
vote
1answer
185 views

Accidentally removed libselinux and nothing works

I have accidentally removed libselinux on centos 7.4 and am unable to install it again and all commands fail. How do i recover? ls: error while loading shared libraries: libselinux.so.1: cannot open ...
0
votes
3answers
156 views

SeLinux stops starting of nginx

Reboted nginx proxy server (centos7+nginx only, apache on another) I got error: DOMAIN systemd[1]: Starting Session 439 of user root. -- Subject: Unit session-439.scope has begun start-up -- ...
0
votes
0answers
45 views

How to filer Audit.log based on hostname or addr

I have enabled auditd to collect logs based on some rules and everything is working nicely. I wonder to know is there anyway to filer type of audit (ex USER_LOGIN) based on addr or hostname? For ...
1
vote
1answer
87 views

SELinux context documentation

I am trying to get my head around SELinux but one question keeps popping-up in my head: CONTEXT. When I'm writing custom rules and modules (on CentOS 7), I end up just taking contexts out of the air -...
0
votes
0answers
15 views

Changed AWS RDS instance name and now can't connect to the databases

I have a basic Wordpress site setup on AWS in a high-availability setting in two different zones and behind a load balancer, the databases are on AWS RDS with the failover/backup one in the second ...
0
votes
2answers
73 views

Allow SeLinux to specific user can send email

I'm trying to allow user zabbix to send email using ssmtps. I've configured everything except SeLinux. For SeLinux booleans there is no such item available for zabbix like httpd_can_sendmail. PS: I ...
0
votes
0answers
123 views

How to pre-install and pre-configure selinux in a kvm/qemu guest image using docker?

I'm working in a company where we need to distribute our image running SE-Linux inside. The product uses virtualization for additional security, thus we have got a setup with a linux host, running ...
0
votes
0answers
166 views

SELinux allow process to execute binary

I have the Bacula backup system running and SELinux is interfering. The problem arises when Bacula runs a script that invokes /usr/bin/hostname before one of the backups. 12-Apr 00:05 dir_backup ...
0
votes
1answer
184 views

Does enabling SELinux “enforcing” in KVM host causing problems in the guests?

I've KVM hypervisor with (Software Raid1) and I've few created VMs .. Does Enable "SELinux" IN the host affects badly on Raid1 and The guests (VMs) ? or there is no relation? Is it a recommended ...
1
vote
2answers
186 views

Not able to start apache in Wildfly 10 domain mode cluster with Apache mod_cluster, due to SELinux issue

I am trying to setup a Wildfly 10 cluster in domain mode with Apache mod_cluster. In my Centos 7 webserver node I have installed Apache(2.4.6) using: # yum install httpd Then copied the following ....
-1
votes
1answer
191 views

MySqld Service wont start on Redhat7 after a yum update

I'm having a problem with Redhat7 after a yum update. Various services wont start and are giving permissions errors. Similar problem to Can't start any service after installing iRedMail on ...
3
votes
1answer
116 views

CentOS7 SELinux doesn't seem to adhere to MCS categories

Problem A file that is assigned to a certain SELinux MCS (Multi Category Security) category can be read by a user who is not assigned to that category, indicating that MCS somehow does not work on my ...
0
votes
1answer
422 views

SELinux: how to allow httpd to delete temp files from MySQL?

Here's the setup: I let MySQL dump tables to /tmp (they just contain numbers, no real data) for PHP to pick up and process. After this, the temp files are no longer needed, so I delete them with PHP (...
1
vote
1answer
969 views

SELinux will not disable on CentOS7

I want to permanently disable right now for the short term but nothing seems to work for me Steps I have tried [root@db1e secure]# setenforce 0 [root@db1e secure]# sestatus SELinux status: ...
0
votes
1answer
65 views

Removing module fails - cannot find port type, but it's there?

I have a SELinux module that, among other things, allows Apache to connect via TCP to a specific port: cat <<EOF > sgtest.te module sgtest 1.0.0; require { attribute port_type; type ...
0
votes
0answers
206 views

SELinux: why does a new file inherit its context from its parent?

Various sources tell me that a new file gets its SELinux context from its parent (unless a transition policy exists): 1. SELinux - canonical way of automatically applying a context on file creation ...
1
vote
0answers
192 views

SELinux set enforcing issue

I am on CentOS 6.9 with a LAMP stack, trying to set SELinux=enforcing in /etc/selinux/config However after **reboot ** and checking sestatus I still get SELinux status:disabled Then I tried running ...
0
votes
0answers
214 views

allow apache to run php script - audit2allow hasn't worked thus far

At a previous company the fix was to disable SELinux. I'm trying to leave SELinux enabled and tune what I need in order to accomplish my goal. In short, I want apache/httpd to run '/usr/bin/...
1
vote
1answer
267 views

Can't read from /proc/self/attr/current, but permissions are 0666

I'm working with an externally created script that reads from /proc/self/attr/current to get SELinux configuration info. It seems that, even though permissions on the file are 0666, on some systems ...
2
votes
1answer
61 views

Executing semanage returns that Python 'Plural forms expression could be dangerous'

Returning to the same issue. I am receiving some error in python when adding semanage rules: # semanage port -a -t http_port_t -p tcp 29200 Traceback (most recent call last): File "/sbin/semanage", ...
0
votes
1answer
79 views

Set persistent SELinux file types under /run

I set a file to a specific type using semanage fcontext, and using restorecon does properly set the file type. However, upon reboot, the type goes back the default. If I run restorecon again then it ...
1
vote
1answer
431 views

Why is SELinux blocking systemctl --user / systemd user instance commands?

I have a number of Fedora 27 systems. I am reasonably comfortable with SELinux. I run it on all my systems, with the "unconfined" module disabled. On this particular system, SELinux is blocking all ...
0
votes
1answer
240 views

Can not change SELinux security context on Gluster FS folder

I can not change the security context of a folder which is created inside a Gluster-FS volume. Following is the error I keep getting. chcon: failed to change context of ‘test’ to ‘system_u:object_r:...