Questions tagged [selinux]

NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

Filter by
Sorted by
Tagged with
0 votes
0 answers
33 views

SELinux is preventing /usr/local/bin/python3.10 from append access on the file /data/logs/v100t1-grab.log

I am running RHEL 8. I am using podman to run containers with python apps. The apps need to rotate the logs. I am seeing this error on journalctl -xe: SELinux is preventing /usr/local/bin/python3.10 ...
user avatar
1 vote
1 answer
34 views

How to adjust SELinux to allow not so large file downloads in Apache?

I have a centos 7 server running Apache 2.4 that will happily allow users to download files until they get to a certain size. I've noticed the problem with mp4 video files; I host both low and full ...
user avatar
  • 11
0 votes
0 answers
30 views

SELinux denied issue - iptables_t plymouthd_t:unix_stream_socket connectto

We have Amazon Linux 2 with Selinux enabled on it from audit.log file, we have the following denied: type=AVC msg=audit(1645462240.556:179): avc: denied { connectto } for pid=7329 comm="...
user avatar
0 votes
1 answer
64 views

How to set SELINUX HTTPD User Content RW?

I'm quite new to SELINUX, I've simple question, I know there are httpd_sys_rw_content_t for /var/www/html, and read only httpd_user_content_t, but if I want to allow some folder to be RW for that ...
user avatar
0 votes
1 answer
138 views

Ubuntu 20.04 doesn't boot after setting SELinux enforcing

I'm trying to set SELinux to enforcing on Ubuntu 20.04, and the steps I did are as follow: Install SELinux = sudo apt-get install policycoreutils selinux-utils selinux-basics -y Activate SELinux = ...
user avatar
1 vote
2 answers
92 views

How to allow user to run only specific binaries

I'm adding user logviewer with /sbin/nologin/ and to my system. My custom service is running eg. sudo -u logviewer less --follow-name /var/log/messages. But still there are ways to run other command ...
user avatar
  • 121
0 votes
1 answer
294 views

Unable to change SSH port on Almalinux/CentOS 8 with selinux present

I am trying to change the SSH port on a VPS using Almalinux. I followed this guide but have not been able to. These are the output I receive when try to SSH using both 22 and the new port respectively....
user avatar
  • 5
0 votes
1 answer
38 views

Centos7 Httpd cannot access mounted cifs directory

In a Centos 7 server I have a directory mounted with autofs in /mnt/cifs-shares/cone_files. I can read those files without issues. The directory /mnt/cifs-shares/cone_files is owned by apache:apache ...
user avatar
0 votes
1 answer
215 views

SELinux preventing mongod search access

I noticed I am getting some SELinux errors when running mongod for the UniFi controller program. Namely, I am getting: SELinux is preventing /usr/bin/mongod from search access on the directory /. ...
user avatar
1 vote
0 answers
25 views

SELinux: two servers, identical configurations, but different contexts

I've had my fair share of struggles with SELinux, but this is the first time that it's totally stumped me. I have two production CentOS 8 servers with functionally identical configurations hosting a ...
user avatar
  • 111
0 votes
0 answers
26 views

SELinux on RHEL 7.5: sshd service process running in the kernel_t domain instead of sshd_t

I'd like the sshd service process to be running in the sshd_t domain so that ssh login will be allowd by SELinux. How can I find out why it's running in the kernel_t domain and change it to sshd_t? # ...
user avatar
0 votes
0 answers
30 views

block internet access to all applications except whitelisted

If blacklisting I'd use firejail, but since I want to whitelist and include preinstalled binaries, seems like SEL is the only potential choice. Essentially, could SEL be used to add a new type context ...
user avatar
  • 1
0 votes
1 answer
60 views

How to set SELinux boolean using custom policy?

I know that SElinux booleans can be set via setsebool like this: setsebool -P virt_qemu_ga_read_nonsecurity_files 1 But I want to set this boolean virt_qemu_ga_read_nonsecurity_files using custom ...
user avatar
0 votes
1 answer
69 views

Allow samba share to access mounted remote file store

I have two servers on the same network. One running Windows Server 2016 and another running CentOS 8. The Windows server is my main file store, it's where all my data is. The CentOS server has the ...
user avatar
  • 201
1 vote
0 answers
433 views

Samba/Winbind domain member authentication issue

In setting up a new Linux Samba fileserver as a AD member I keep running into an issue with authentication. It appears to be triggered by running with selinux in Enforcing mode after joining AD, but ...
user avatar
1 vote
1 answer
137 views

On Fedora, how do I configure selinux to allow a port for a new undefined service type?

I have several things that I'd like to be able to stand up as servers on Fedora. I know I can run at least some of these in podman or docker but I already know how to do that. I also already know how ...
user avatar
  • 113
0 votes
0 answers
38 views

What is the SELinux type cloud_what_var_cache_t?

My server is running a clean installed CentOS 8.5 minimal. Installed PHP, MySQL and httpd from the official repositories, SELinux is enforcing (default). The following error happens and I have no clue ...
user avatar
0 votes
1 answer
43 views

Which protections can I use on the server

I have read about server protection and I know how to work with fewalld protection because it is not demanding. My question is: Which of the following protections is best for the server and which of ...
user avatar
  • 17
0 votes
1 answer
91 views

Why there are SELinux errors in permissive mode?

I have set CentOS 8 Stream with SELinux set to permissive but I still have bunch of red lines in the log e.g.: SELinux is preventing /usr/lib/systemd/systemd from name_connect access on the tcp_socket ...
user avatar
0 votes
1 answer
136 views

VNC server won't start on AlmaLinux/CentOS 8

I could not get tigervnc to start on my AlmaLinux 8 machine. We have SELinux enabled and our home directories are automounted NFS shares (configured by IPA). I see errors in my /var/log/audit/audit....
user avatar
  • 41
1 vote
1 answer
85 views

Where do I get full list of SELinux access control types?

I cant find any explanation how do I list all access control types in SELinux. E.g. httpd_log_t httpd_sys_content_t.. I would like to see them all
user avatar
0 votes
2 answers
49 views

CentOS8 Stream - what is security context in files permissions and how it can affect access?

I did install some of my aspnet core apps on Linux before using CentOS8. This time I used CentOS8-Stream. I dont know if that contributes to the issue. The facts: I could not make apache use ...
user avatar
0 votes
0 answers
55 views

failing to switch selinux to permissive mode with ansible TASK

I fail with an Ansible playbook installing postgresql on a centos7 target due to some permission problem which seems to be rooted in selinunx in some way. As I have no experience with selinx ...
user avatar
  • 217
0 votes
1 answer
28 views

SELINUX : How to make child folder rule precedence higher than parent rule

SELINUX : How to make child folder rule precedence higher than parent rule eg : /home/kevinw/www/kp/storage(/.*)? all files system_u:object_r:httpd_sys_rw_content_t:s0 lost ...
user avatar
1 vote
0 answers
151 views

How to set SELinux to allow CGI script to create a file

I'm writing a CGI for httpd on CentOS 7, which create and write files on a directory under home. When I enable SELinux, it causes Internal Server Error. How can I setup SELinux? The command sudo ...
user avatar
  • 123
0 votes
1 answer
60 views

SELinux prevent connection clamd_port_t:tcp_socket

We have API Server (tomcat) which has clamAV configuration to scan any uploaded file to the system. clamAV configuration will require the API server to connect to clamAV server. SELinux is enabled on ...
user avatar
0 votes
0 answers
87 views

Tenable su+sudo and selinux

My Not-A-Sysadmin-Boss wants me to explain this but I can't really find an answer? When using TENABLE SC to scan a RHEL7 system the account used to do the scan connects via ssh then uses sudo to ...
user avatar
0 votes
0 answers
20 views

Apache, Multiple IPs and Selinux does not work in enforcing mode

I am trying to set up an Apache proxy to load balance and offload SSL. To this end I have multiple IPs on the same interface. Unfortunately it seems selinux prevents httpd from binding to the ...
user avatar
0 votes
1 answer
218 views

SELinux Issue - git status fatal: Out of memory? mmap failed: Permission denied

I have Centos 7.9 server running with Apache and Git, however if I do a [root@a]# git status fatal: Out of memory? mmap failed: Permission denied But if Disable or Permissive the SE-Linux via below ...
user avatar
  • 3,875
0 votes
1 answer
83 views

CGroup not mounted on Fedora 34

I have freshly provisioned Linode instance with Fedora 34. The only thing I have installed on it is libcgroup. cgconfig service is starting properly and there are no errors but the subsystem is not ...
user avatar
2 votes
2 answers
267 views

SELinux - blocks postfix emails sending out from the Web Application

My System environment, is Centos-7.9, Apache2.4, Php-fpm, PHP-7.4 I have postfix setup to send emails from the website, which is working in stand-alone test emails and when I turn the SELinux off. ...
user avatar
  • 3,875
1 vote
1 answer
140 views

Permission denied for gitweb.cgi on CentOS

I've set up gitweb on my web server. I have created projects on the server. I can add commits to them and also clone them remotely. The gitweb "homepage" does display and the static files ...
user avatar
1 vote
0 answers
102 views

selinux - why can't stuff_u with sysadm_r run postsuper?

I am trying to understand how selinux confined users really work, but there are a few behaviours that I still can not understand. According to redhat SELinux User Capabilities stuff_u users should be ...
user avatar
  • 11
0 votes
1 answer
145 views

Allow Wordpress upgrades with SELinux in EL8 with nginx/php-fpm

I'm trying to allow the use of Wordpress upgrades (not plugin updates) directly on the web interface. I already have SELinux working for everything except this feature. When trying to nail down what ...
user avatar
1 vote
0 answers
113 views

Where is mapping of __default__ user to unconfined_u defined in SELinux policy?

semanage login -l shows following mappings ~]# semanage login -l Login Name SELinux User MLS/MCS Range __default__ unconfined_u s0-s0:c0.c1023 ...
user avatar
  • 11
2 votes
0 answers
49 views

Why are docker permission errors not logged by selinux?

If you try to bind mount a directory into a container under Red Hat you might have problems with selinux. The directory will be unreadable from inside the container. Unless you add a z/Z volume option....
user avatar
  • 1,755
0 votes
1 answer
106 views

Unable to update to Wordpress 5.7.2: Could not copy file

I'm trying to update to the latest (5.7.2) version of Wordpress from a fresh installation on CentOS 7, however I keep getting the error message Could not copy file.: wp-admin/images/about-color-...
user avatar
  • 147
1 vote
1 answer
284 views

SetroubleshootPrivileged.py using 95% CPU | Centos 8 server

I have been battling with this issue for weeks. I have a Linode with a Centos 8 server. An application called "SetroubleshootPrivileged.py" is eating all the resources. "setroubleshootd&...
user avatar
  • 21
0 votes
1 answer
171 views

Unable to create selinux policy to allow drbdadm to run

In snmpd.conf I have exec drbd_cstate /sbin/drbdadm cstate all exec drbd_role /sbin/drbdadm role all exec drbd_state /sbin/drbdadm dstate all With selinux set to permissive if I were to run the SNMP ...
user avatar
3 votes
0 answers
212 views

CentOS Linux 8 freezes when changing SELinux Booleans (setsebool)

Problem Various CentOS Linux 8 servers freeze/hang when changing SELinux Booleans. Details and research We manage hundreds of CentOS Linux servers. Lately we see deviant behavior on some (but not all) ...
user avatar
  • 51
1 vote
0 answers
63 views

What makes a selinux-caused EACCESS to not be logged in audit

I've got a system with samba running with standard targetted policy for Fedora. At some point samba is trying to access a directory tagged unconfined_u:object_r:unlabeled_t:s0 and fails. Through ...
user avatar
  • 1,254
0 votes
1 answer
86 views

Unable to open PHP script files, even though I own them and have permissions

I'm using RHEL 8, and I have run into a crazy problem. My user account is unable to open PHP files. If I have a file, owned by my user, and readable by my user, and I add <?php as the first line, ...
user avatar
  • 111
1 vote
1 answer
600 views

Linux "ls -Z" shows question mark for security context

I've got some files that aren't being served on a site, and assuming it was a permissions issue I ran ls -Z but keep seeing ? in place of the security context: -rw-rw-r-- pete pete ? ...
user avatar
  • 283
0 votes
1 answer
289 views

How do I install `setroubleshoot-server` (sealert)

I am looking to use sealert on my Debian env. I am unable to find the package to install to have it and the source code.
user avatar
  • 877
2 votes
1 answer
471 views

SELinux setting httpd_can_network_relay to on throws error, "could not convert system_u:object_r:systemd_sleep_exec_t:s0 to sid". How is this fixed?

Environment: Digital Ocean Droplet, CentOS 8 The State of httpd_can_network_relay is set to on. However the Default is set to off. $ sudo semanage boolean -l | grep httpd_can_network_relay ...
user avatar
1 vote
0 answers
241 views

Correct SELinux labels for a kvm/qemu user session VM shared folder

I am trying to set up a shared folder using the 9p protocol for a kvm/qemu VM that runs on the user session (so the qemu process runs as me, not as root). Mounting the shared folder in guest works ...
user avatar
  • 225
2 votes
1 answer
1k views

Create selinux context for systemd script?

I'm trying to create a systemd service that executes a custom script I wrote. It is just a backup script that I am using with a systemd timer. When I try to execute something simple in the systemd ...
user avatar
0 votes
1 answer
204 views

SELinux : Where I find selinux policy for google-chrome on Fedora Linux?

How do I find all the SELinux policies used for Google Chrome on Fedora Linux?
user avatar
0 votes
1 answer
77 views

selinux audit rule not logging anything

I am trying to audit a directory tree for read, write, and permissions change. I created the rule using auditctl -w <path> -k media-watch, but ausearch -k media-watch only shows the creation (or ...
user avatar
2 votes
1 answer
360 views

What is Apache trying to do with port 80 that SELinux is blocking?

I have a small web server (CentOS 8) that runs a small php & mysql app. It also runs runs Nagios, BIND, and Postfix running as a secondary MX. Everything seems to "work", and I've never ...
user avatar
  • 3,395

1
2 3 4 5
14