Questions tagged [selinux]
NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.
1
vote
1answer
22 views
MongoDB won't run if dbPath is symlinked
I have installed MongoDB 4.0.4 from the official repo. I followed these instructions. My OS is CentOS 7 and SELinux is in enforcing mode. If I use a dbPath value which is a symlink to another ...
1
vote
2answers
21 views
Using SQLite through PHP without completely disabling SELinux
I'm trying to access an SQLite file on a CentOS7 box using PHP and the PDO library. I was getting read-only errors just like this question - https://stackoverflow.com/questions/3319112/sqlite-read-...
0
votes
2answers
106 views
Configure SELinux to allow all outbound tcp and udp ports
I have an application that potentially connects to any outbound, remote tcp/udp port. As a result, I want a way to allow all outbound tcp and udp connections.
I understand that you can use a ...
1
vote
1answer
31 views
Permission denied when adding audit rule in audisp plugin
I'm trying to write an audisp plugin on a Linux CentOS 7 VM. Instead of statically setting the audit rules via /etc/audit/rules.d/, I wanted to add rules dynamically in the plugin using libaudit ...
-2
votes
1answer
112 views
Nginx cache mkdir failed (2: No such file or directory) while reading upstream
Edit for answer:
It's the selinux causes this problem, the temporary solution is to run this command: sudo semanage permissive -a httpd_t
But you shouldn't do that, because of security reasons. I ...
0
votes
0answers
21 views
SELinux: How can I use the 8081 port with apache? [duplicate]
I need to use the 8081 port with Apache but Selinux doesn't allow that:
semanage port -l | grep http_port_t
http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000
semanage ...
1
vote
1answer
41 views
Why SELinux blocks dhcpd from executing a script from writing a log file?
I would like to have dhcpd execute a script, which for now just tries to create a log file in /var/log/dhcpd/, but SELinux denies it to do so.
Question
Can anyone from the below see what permissions ...
10
votes
1answer
822 views
SELinux reset root password
Disclaimer: This question is not to solve the problem of changing root password while SELinux is active because there are a lot of guides to solve that already. This is more of how SELinux does that ...
-1
votes
2answers
77 views
Need help installing ejabberd on Centos/RHEL7 with SELinux and reverse proxy
I've been trying to get a web client to use EJabberd on the recommended port (5281) through a reverse proxy (HAProxy) on Centos7 with SELinux enabled. I am not familiar with SELinux context rules.
...
2
votes
1answer
73 views
Selinux Policy for CAP_SYS_PTRACE by invoking process name
I have a system in which we have GDB installed and a target binary which needs to be debugged for errors. We do not want the user to be able to debug any other process apart from the target binary.
...
1
vote
0answers
21 views
why selinux is denying file access(ls /usr/bin) to container_file_t type inside my container
I have one RHEL7.4 node, that when enforing selinux, it will fail my container, I checked and found it is denying reading in the container internal directories:
# docker run -it 172.16.1.120:5000/...
0
votes
1answer
84 views
selinux in a chroot environment
I need to change selinux policy for /etc/ssh/sshd_config in a chroot environment designed to rescue my system (on a dedibox) : it actually does not have any selinux context defined and then sshd won't ...
0
votes
1answer
22 views
selinux context for multiple databases
I have a directory /media/databases under which I want to hold 3 different databases : mariadb, postgresql and neo4j.
My issue is that I already have configured postgresql selinux context and the ...
0
votes
0answers
41 views
is there any way to filter in syslog (not rsyslog) such as programname?
I need to add filter in my syslogs. I know how to do in rsyslogs. But we need to add same logs in syslogs as well in legacy systems.Is there any way to do it?
Corresponding rsyslog entries are:
:msg,...
1
vote
1answer
76 views
Why is Nginx only serving the Index mark-up when I use it as a reverse proxy for Nexus 3 Repository Manager?
I am trying to serve a Nexus3 Repo Manager through Nginx reverse proxy, but it only serves the Index mark-up.
I have set up Sonatype Nexus 3 Repository manager on an Azure RHEL (SELinux) instance. I ...
0
votes
1answer
138 views
vsftpd error 530 Login incorrect error occurs with valid credentials
Though there are a number of similar existing question/answers that reference vsftpd and error code 530, but they do not seem to be helpful in this case:
vsftpd login error: 530
VSFTPD 530 Login ...
1
vote
1answer
266 views
SELinux - Zabbix server can't read conf file
I have installed zabbix server on red Hat 7.4 server with SELinux policy in Enforcing mode.
If I launch Zabbix-server (3.4.11), I have theses errors :
/var/log/zabbix/zabbix_server.log
Jul 25 16:51:...
0
votes
1answer
284 views
SELinux blocks tomcat web application to load Java native library (JNI) - how to configure SELinux on Centos 7?
I have a Centos 7 with Tomcat installed and tomcat user
ls -l /var/lib/tomcat
total 0
drwxrwxrwx. 5 root tomcat 84 Jul 3 13:18 webapps
SELinux is enforcing and a Java web application which tries ...
0
votes
0answers
32 views
selinux denial nrpe access to a ldap port
type=AVC msg=audit(1530564199.190:10850): avc: denied { name_connect } for pid=28307 comm="check_syncrepl." dest=389 scontext=system_u:system_r:nrpe_t:s0 tcontext=system_u:object_r:ldap_port_t:s0 ...
0
votes
1answer
135 views
nginx cache dir creation—strange behaviour
I have the following line (plus context) in my nginx.conf:
http {
proxy_cache_path cache/ keys_zone=auth_cache:10m;
...
Since nginx.conf is in /etc/nginx, cache/ corresponds to /etc/nginx/...
1
vote
1answer
124 views
Accidentally removed libselinux and nothing works
I have accidentally removed libselinux on centos 7.4 and am unable to install it again and all commands fail. How do i recover?
ls: error while loading shared libraries: libselinux.so.1: cannot open ...
0
votes
3answers
115 views
SeLinux stops starting of nginx
Reboted nginx proxy server (centos7+nginx only, apache on another) I got error:
DOMAIN systemd[1]: Starting Session 439 of user root.
-- Subject: Unit session-439.scope has begun start-up
-- ...
0
votes
0answers
33 views
How to filer Audit.log based on hostname or addr
I have enabled auditd to collect logs based on some rules and everything is working nicely. I wonder to know is there anyway to filer type of audit (ex USER_LOGIN) based on addr or hostname?
For ...
1
vote
1answer
76 views
SELinux context documentation
I am trying to get my head around SELinux but one question keeps popping-up in my head: CONTEXT.
When I'm writing custom rules and modules (on CentOS 7), I end up just taking contexts out of the air -...
0
votes
0answers
15 views
Changed AWS RDS instance name and now can't connect to the databases
I have a basic Wordpress site setup on AWS in a high-availability setting in two different zones and behind a load balancer, the databases are on AWS RDS with the failover/backup one in the second ...
0
votes
2answers
60 views
Allow SeLinux to specific user can send email
I'm trying to allow user zabbix to send email using ssmtps.
I've configured everything except SeLinux.
For SeLinux booleans there is no such item available for zabbix like httpd_can_sendmail.
PS: I ...
0
votes
0answers
103 views
How to pre-install and pre-configure selinux in a kvm/qemu guest image using docker?
I'm working in a company where we need to distribute our image running SE-Linux inside.
The product uses virtualization for additional security, thus we have got a setup with a linux host, running ...
0
votes
0answers
117 views
SELinux allow process to execute binary
I have the Bacula backup system running and SELinux is interfering.
The problem arises when Bacula runs a script that invokes /usr/bin/hostname before one of the backups.
12-Apr 00:05 dir_backup ...
0
votes
1answer
164 views
Does enabling SELinux “enforcing” in KVM host causing problems in the guests?
I've KVM hypervisor with (Software Raid1) and I've few created VMs .. Does Enable "SELinux" IN the host affects badly on Raid1 and The guests (VMs) ? or there is no relation?
Is it a recommended ...
1
vote
2answers
168 views
Not able to start apache in Wildfly 10 domain mode cluster with Apache mod_cluster, due to SELinux issue
I am trying to setup a Wildfly 10 cluster in domain mode with Apache mod_cluster.
In my Centos 7 webserver node I have installed Apache(2.4.6) using:
# yum install httpd
Then copied the following ....
-1
votes
1answer
166 views
MySqld Service wont start on Redhat7 after a yum update
I'm having a problem with Redhat7 after a yum update. Various services wont start and are giving permissions errors.
Similar problem to
Can't start any service after installing iRedMail on ...
3
votes
1answer
93 views
CentOS7 SELinux doesn't seem to adhere to MCS categories
Problem
A file that is assigned to a certain SELinux MCS (Multi Category Security) category can be read by a user who is not assigned to that category, indicating that MCS somehow does not work on my ...
0
votes
1answer
340 views
SELinux: how to allow httpd to delete temp files from MySQL?
Here's the setup: I let MySQL dump tables to /tmp (they just contain numbers, no real data) for PHP to pick up and process. After this, the temp files are no longer needed, so I delete them with PHP (...
1
vote
1answer
856 views
SELinux will not disable on CentOS7
I want to permanently disable right now for the short term but nothing seems to work for me
Steps I have tried
[root@db1e secure]# setenforce 0
[root@db1e secure]# sestatus
SELinux status: ...
0
votes
1answer
62 views
Removing module fails - cannot find port type, but it's there?
I have a SELinux module that, among other things, allows Apache to connect via TCP to a specific port:
cat <<EOF > sgtest.te
module sgtest 1.0.0;
require {
attribute port_type;
type ...
0
votes
0answers
169 views
SELinux: why does a new file inherit its context from its parent?
Various sources tell me that a new file gets its SELinux context from its parent (unless a transition policy exists):
1. SELinux - canonical way of automatically applying a context on file creation
...
1
vote
0answers
173 views
SELinux set enforcing issue
I am on CentOS 6.9 with a LAMP stack, trying to set SELinux=enforcing in /etc/selinux/config
However after **reboot ** and checking sestatus I still get SELinux status:disabled
Then I tried running ...
0
votes
0answers
186 views
allow apache to run php script - audit2allow hasn't worked thus far
At a previous company the fix was to disable SELinux. I'm trying to leave SELinux enabled and tune what I need in order to accomplish my goal.
In short, I want apache/httpd to run '/usr/bin/...
1
vote
1answer
227 views
Can't read from /proc/self/attr/current, but permissions are 0666
I'm working with an externally created script that reads from /proc/self/attr/current to get SELinux configuration info. It seems that, even though permissions on the file are 0666, on some systems ...
2
votes
1answer
56 views
Executing semanage returns that Python 'Plural forms expression could be dangerous'
Returning to the same issue.
I am receiving some error in python when adding semanage rules:
# semanage port -a -t http_port_t -p tcp 29200
Traceback (most recent call last):
File "/sbin/semanage", ...
0
votes
1answer
67 views
Set persistent SELinux file types under /run
I set a file to a specific type using semanage fcontext, and using restorecon does properly set the file type. However, upon reboot, the type goes back the default. If I run restorecon again then it ...
1
vote
1answer
395 views
Why is SELinux blocking systemctl --user / systemd user instance commands?
I have a number of Fedora 27 systems. I am reasonably comfortable with SELinux. I run it on all my systems, with the "unconfined" module disabled.
On this particular system, SELinux is blocking all ...
0
votes
1answer
210 views
Can not change SELinux security context on Gluster FS folder
I can not change the security context of a folder which is created inside a Gluster-FS volume. Following is the error I keep getting.
chcon: failed to change context of ‘test’ to ‘system_u:object_r:...
1
vote
2answers
4k views
SELinux corrupted? Now unable to boot CentOS 7 with SELinux enabled
We recently experienced a power failure and simultaneous backup generator failure, severe enough to require safely shutting down all servers as their UPSs were draining.
Upon bringing one CentOS 7.4....
3
votes
1answer
363 views
Have SSHD listen to another port on Centos with SELinux running
I have a Centos VM running with SELinux enabled. I wish to have sshd listen to another port --- says, 993. I've modified the sshd_config file to listen to another port, but SELinux is getting in the ...
2
votes
1answer
560 views
How to restrict root to access a directory used by other user with selinux
I want to restrict the root to access a folder/directory which is created by another user.So that only that user can access that folder not even root. Is there any selinux configuration to do so this ...
1
vote
1answer
280 views
Centos 7 Selinux issue I think? php cannot read or write
I have an uploads folder for my web application: /disk2/app/uploads.
ls -Z returns:
drw-r--r--. apache apache unconfined_u:object_r:httpd_sys_rw_content_t:s0 uploads
ls -Z / returns:
drwxrwxrwx. ...
1
vote
1answer
157 views
SELinux denies “systemctl kill” when used in Anacron postrotate script on CentOS 7
I'm using backup software called UrBackup, which I've configured to rotate its logs once a day through cron.daily. After the logs are rotated, the software uses a postrotate script to send the running ...
0
votes
0answers
229 views
httpd service cannot start after SELinux is set to enforcing
There are several other questions like this but none were able to solve my problem. Here are the details:
After setting SELinux=enforcing, httpd service fails to start.
In error.log I see following ...
-1
votes
1answer
445 views
HAProxy not detecting backend with non-standard http port
I have a HAProxy setup where the backend server is running a webserver non standard port.The config is as follows
global
log 127.0.0.1 local2
chroot /var/lib/haproxy
...
