Questions tagged [selinux]

NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

Filter by
Sorted by
Tagged with
0
votes
0answers
19 views

How can i see the targeted processes in the targeted policy SELinux?

i want to query/list or see all the processes that SELinux targets while it's in targeted type/policy and while it's in minimum type/policy, how is it possible? In addition i wanted to ask if there is ...
0
votes
1answer
39 views

Unable to update to Wordpress 5.7.2: Could not copy file

I'm trying to update to the latest (5.7.2) version of Wordpress from a fresh installation on CentOS 7, however I keep getting the error message Could not copy file.: wp-admin/images/about-color-...
0
votes
1answer
57 views

SetroubleshootPrivileged.py using 95% CPU | Centos 8 server

I have been battling with this issue for weeks. I have a Linode with a Centos 8 server. An application called "SetroubleshootPrivileged.py" is eating all the resources. "setroubleshootd&...
0
votes
0answers
47 views

Unable to create selinux policy to allow drbdadm to run

In snmpd.conf I have exec drbd_cstate /sbin/drbdadm cstate all exec drbd_role /sbin/drbdadm role all exec drbd_state /sbin/drbdadm dstate all With selinux set to permissive if I were to run the SNMP ...
2
votes
0answers
70 views

CentOS Linux 8 freezes when changing SELinux Booleans (setsebool)

Problem Various CentOS Linux 8 servers freeze/hang when changing SELinux Booleans. Details and research We manage hundreds of CentOS Linux servers. Lately we see deviant behavior on some (but not all) ...
1
vote
0answers
38 views

What makes a selinux-caused EACCESS to not be logged in audit

I've got a system with samba running with standard targetted policy for Fedora. At some point samba is trying to access a directory tagged unconfined_u:object_r:unlabeled_t:s0 and fails. Through ...
0
votes
1answer
53 views

Unable to open PHP script files, even though I own them and have permissions

I'm using RHEL 8, and I have run into a crazy problem. My user account is unable to open PHP files. If I have a file, owned by my user, and readable by my user, and I add <?php as the first line, ...
1
vote
1answer
55 views

Linux “ls -Z” shows question mark for security context

I've got some files that aren't being served on a site, and assuming it was a permissions issue I ran ls -Z but keep seeing ? in place of the security context: -rw-rw-r-- pete pete ? ...
0
votes
1answer
21 views

How do I install `setroubleshoot-server` (sealert)

I am looking to use sealert on my Debian env. I am unable to find the package to install to have it and the source code.
1
vote
1answer
142 views

SELinux setting httpd_can_network_relay to on throws error, “could not convert system_u:object_r:systemd_sleep_exec_t:s0 to sid”. How is this fixed?

Environment: Digital Ocean Droplet, CentOS 8 The State of httpd_can_network_relay is set to on. However the Default is set to off. $ sudo semanage boolean -l | grep httpd_can_network_relay ...
1
vote
0answers
84 views

Correct SELinux labels for a kvm/qemu user session VM shared folder

I am trying to set up a shared folder using the 9p protocol for a kvm/qemu VM that runs on the user session (so the qemu process runs as me, not as root). Mounting the shared folder in guest works ...
2
votes
1answer
436 views

Create selinux context for systemd script?

I'm trying to create a systemd service that executes a custom script I wrote. It is just a backup script that I am using with a systemd timer. When I try to execute something simple in the systemd ...
0
votes
1answer
104 views

SELinux : Where I find selinux policy for google-chrome on Fedora Linux?

How do I find all the SELinux policies used for Google Chrome on Fedora Linux?
0
votes
1answer
30 views

selinux audit rule not logging anything

I am trying to audit a directory tree for read, write, and permissions change. I created the rule using auditctl -w <path> -k media-watch, but ausearch -k media-watch only shows the creation (or ...
2
votes
1answer
95 views

What is Apache trying to do with port 80 that SELinux is blocking?

I have a small web server (CentOS 8) that runs a small php & mysql app. It also runs runs Nagios, BIND, and Postfix running as a secondary MX. Everything seems to "work", and I've never ...
0
votes
0answers
37 views

Why might SELinux issue a Permission Denied error when accessing an upstream Node.js server's default routes, but not static files like image files? [duplicate]

Environment: Nginx reverse proxy serving static resources and using proxy_pass to serve resources from 2 separate Node.js upstream server instances. Simplified example nginx.conf: server { ...
-1
votes
1answer
24 views

Resetting lost root-pwd on CentOS 8 just don't work

i just don't know. I have reset lost root-pwds on Linux boxes maybe 5 times a year in the 30 years experience as IT-Admin, but this time i#m just confused. I just don't manage to login on my CentOS ...
2
votes
1answer
58 views

svnserve with selinux on nfs mount unable to start (Centos8)

might be a silly question. Struggling with my subversion server on a Centos8 with selinux enforced. We have an NFS mount to store the data (/mnt/data/svn). The problem (when selinux is in enforcement ...
0
votes
1answer
99 views

Centos8: Selinux blocking Samba service from starting

My Samba4 service is being blocked from starting using systemctl. The audit log shows: type=AVC msg=audit(1606428851.446:87): avc: denied { execute } for pid=1748 comm="(samba)" name=&...
0
votes
0answers
47 views

Flask apache logs

I created an app with flask and for the deployment and I used an apache webserver on a CentOS8. When I configure the app.conf file in my /etc/httpd/conf.d/ to work on port 80, the prints of my app are ...
1
vote
1answer
202 views

Ansible module for adding an SELinux context equivalence

Is there an Ansible module that allows an SELinux context equivalence to be added? The command is: semanage fcontext -a -e /home/xxx /srv/xxx This makes SELinux treat /srv/xxx as equivalent to /home/...
0
votes
1answer
470 views

selinux what are the differences between setenforce 0 to permanent selinux

regarding to selinux and according to some Hadoop recommendation selinux must be disabled about selinux - more info in https://www.ibm.com/support/knowledgecenter/STXKQY_BDA_SHR/bl1bda_selinux.htm we ...
0
votes
2answers
137 views

SELinux blocking Samba access to mounted volume despite samba_share_t

I repurposed an old AMD A10 APU-based machine that was collecting dust in my basement to act as a NAS, and eventually some other light-duty tech work. It's running CentOS 8.1, the boot disk is a 340GB ...
0
votes
1answer
296 views

Changing SELinux file contexts over NFS

I would like to change SELinux labels on a NFS-mounted shared directory. Here is my setup (using virtual machines): I have two machines running CentOS 7. One of them (the server) exports a directory ...
2
votes
1answer
254 views

Permission error when Nagios user runs a bash script, also with sudo

I want to poweroff my NAS and ESXI when there is a power failure. Both of the system run on a Eaton UPS. I only run Linux systems and therefore I can not use the Eaton Manager, Windows only. Since I ...
0
votes
1answer
163 views

SELinux Permissions Error on Fedora 32

I am getting this error repeatedly while trying to run Nextcloud on Fedora 32 type=AVC msg=audit(1601229230.944:718): avc: denied { connectto } for pid=584 comm="php-fpm" path="/var/...
0
votes
0answers
174 views

SELinux: How can fix syntax errors for mlsconstrain?

I have the last update and default SELinux install, but I got many syntax errors for mlsconstrain. Any idea? Thank you. [root@desk mythcat]# uname -a Linux desk 5.8.4-200.fc32.x86_64 #1 SMP Wed Aug 26 ...
0
votes
1answer
40 views

How to list the capabilities associated with a process in *nix systems?

From - man capabilities UNIX implementations distinguish two categories of processes: privileged processes (whose effective user ID is 0, referred to as superuser or root), and unprivileged processes ...
1
vote
1answer
28 views

Configure CentOS to allow executables to create and write files in dedicated directory

I have a web app that receives, stores, and processes files using AI algorithms implemented in Python. The web app is developed in server-side scripting language, but when invoking the Python programs ...
1
vote
1answer
354 views

Again enabled SELINUX and now the user logins wont work in enforcing mode

I enabled the SELINUX again on my CentOS 8.2 installation. And now the logins wont work, neither by ssh or direct. To login i have to make the mode to permissive. the secure log shows as below. #login ...
0
votes
0answers
31 views

Centos OS7 not receiving user context from FreeIPA

Hopefully there is something simple I am missing here. I have FreeIPA 4.6.6 (can not update at this time), Centos 7 and Centos 6 systems. SELinux is in permissive mode. Logins on the Centos 6 system ...
1
vote
0answers
408 views

Slab UnReclaimable Using 14GB

I need help to understand what is this slab unreclaimable memory usage, I know that is related to cache. Here is the output of /proc/meminfo cat /proc/meminfo MemTotal: 23373884 kB MemFree: ...
1
vote
1answer
292 views

Allow Samba and Podman to rw on same dir

I'm new to SElinux so I don't know much about how to use it. I want to run my Fedora Server using a samba share (already configured and working) and configured a podman container, mounting the same ...
0
votes
1answer
63 views

How do I find location of file that 'sealert' is referencing in it's output and suggestions?

I've been able to figure this out a little easier in the past just due to the context but this one has me stumped. When I run sealert -a /var/log/audit/audit.log and get the typical output such as... ...
2
votes
1answer
795 views

OpenVPN with PAM with systemd and SELinux

I am trying to set up an OpenVPN (2.4.9) server with PAM login on CentOS 8.2 and I am facing some strange issues. Specifically, i can successfully athenticate if I start the server with the ExecStart ...
0
votes
0answers
29 views

Can you allow `dac_override` only on a specific file context?

I have a service, running as a non-root user, that needs to access some LDAP certificates, stored in /etc/openldap/certs. The key file (client.pem) has permissions -rw-------. root root system_u:...
0
votes
1answer
373 views

How to enable selinux for a custom port

We have a service mapped to the web application. So, we need to allow 80 port and 16700 for its backend service. During login, it will connect to this service for authentication and other parts of ...
0
votes
1answer
169 views

Httpd and selinux - change root dir

I have problem with my centos 7 server and httpd. I have already install http, but i need change home dir from /var/www/html to /home/pawel/domains. I added vhost: <VirtualHost *:80> ...
-2
votes
2answers
723 views

How much does httpd_can_network_connect being set to 1 actually open up on SELinux

I am getting the following SELinux denied lines in my log file when I attempt to redirect a user to Paypal to checkout. Would you please help me understand what it means and what exceptions I should ...
0
votes
0answers
551 views

PiHole container on Podman fails to start with SELinux enabled on Fedora 31

I'm trying to get PiHole up and running using Podman on Fedora 31 Server. When I set SELinux to Permissive mode, and I use the following command, everything works perfectly. sudo podman run -d --...
0
votes
1answer
1k views

SELINUX sysadm_u and SSH - Unable to get valid context for username

Once I set user usernameto sysadm_u they are no longer able to login via SSH and receive the error: Unable to get valid context for username Commands semanage login -m -s sysadm_u username semanage ...
0
votes
1answer
270 views

How to fix SElinux contexts and labels after restoring from backup

I have a server running Centos7/XFS with SElinux that had a problem (unrelated to SElinux) and had to be restored from a snapshot that was several weeks old. This server also makes a nightly rsync ...
0
votes
1answer
673 views

Rsyslog / CentOS 8 / no write logs|no catch?

I use rsyslog (8.37.0-13) on CentOS 8 (CentOS Linux release 8.1.1911) and I've type error with my configuration. My rsyslog.conf is : module(load="imuxsock") module(load="imjournal") module(load="...
0
votes
2answers
187 views

Determine if Linux account locked when SELinux protects shadow

I am trying to run a script which gets the username of every locked account on a Linux system. The server is a Gentoo Hardened Server with SELinux. I tried by writing some Python which looks in /...
1
vote
1answer
971 views

Permission denied: AH02478: failed to create proxy mutex

Running a local centos 7 apache webserver, recently it stopped working. Journalctl don't say anything other then service failed. Only the error_log in /var/log/httpd/ says: [core:notice] [pid 5026:...
1
vote
0answers
50 views

SELinux prevents Apache from scheduling at job

I have an application that submits tasks to cloud services that create certain time-sensitive assets. The services take an unknown amount of time to process, and in addition the assets may be ...
0
votes
0answers
924 views

rsync postgres backup to another directory

I have CentOS 7 (3.10.0-1062.18.1.el7.x86_64) with SELinux enabled. PostgreSQL 12 installed (not sure if it is related). I try to backup database and move backup files to another disk. How I create ...
1
vote
1answer
103 views

How can one identify what changes the SELinux file context of a file?

I'm noticing some files within a web directory with changed file contexts that deviates from system policy. There are developers that run git pull against at a higher part of the web directory and I'm ...
2
votes
1answer
1k views

semodule_package command not found

Hello im trying to install MongoDB on CentOS7. It says there to configure SELInux, which i followed. On the third step, it says to execute the following; checkmodule -M -m -o mongodb_cgroup_memory....
3
votes
2answers
4k views

SELinux blocking execution in systemd unit

I use Fedora 31 and tried to set up a Teamspeak server. When I look in journalctl -u teamspeak I get the following error: mar 09 22:22:46 melchior systemd[1]: Started Teamspeak server. mar 09 22:22:...

1
2 3 4 5
13