Questions tagged [selinux]
NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.
2
votes
0answers
107 views
Multiple IP addresses with SELinux using the same port
I have a CentOS 7 box with multiple IP address on the same NIC. One IP uses 443 for ssh and I want the other IP to use 443 for the web server. SELinux won't let httpd startup saying:
(13)Permission ...
3
votes
1answer
92 views
SELinux relabeling on boot is stuck
I have problem restoring SELinux on a server and would like some insight.
Context
On our server, I recently changed SELinux from enforcing to permissive, and because it did not solve our problem ...
0
votes
0answers
16 views
SELinux httpd With custom app
I'm enabling SELinux on a server, and the httpd server (nginx and phusion passenger) is unable to read the app's dir (/home/app), with the following message:
#============= httpd_t ==============
#!!...
1
vote
1answer
31 views
how to add a dot recursive in file/folders permissions
example of files with there permissions
-rwxr-xr-x. 1 root root 659 Jan 4 2018 zookeeper-server-initialize
-rwxr-xr-x. 1 root root 649 Jan 4 2018 zookeeper-server-cleanup
-rwxr-xr-x. 1 root ...
0
votes
1answer
150 views
SELinux: pam_systemd(sudo:session): Failed to connect to system bus: Permission denied
On one of CentOS 7 servers I cannot perform sudo from nrpe user (Nagios daemon remote monitoring).
Error message:
Dec 31 08:28:10 ip-172-31-36-176 sudo: pam_unix(sudo:session): session opened for ...
0
votes
1answer
47 views
SELinux is preventing /usr/sbin/httpd from getattr access after switching to self signed cert
I recently created my own CA and issued my first root cert, then intermediate, then finally a server cert/key/chain for apache.
When i switch from the letsencrypt certs added with certbot to the ...
1
vote
0answers
27 views
SELinux policy and changing disk ids on Hardened Gentoo
I run a system with hardened Gentoo under a KVM/QEMU. I am new to SELinux and make heavy use of audit2allow to get things working. When doing this I include and carry along the location of the disk, ...
1
vote
1answer
55 views
MongoDB won't run if dbPath is symlinked
I have installed MongoDB 4.0.4 from the official repo. I followed these instructions. My OS is CentOS 7 and SELinux is in enforcing mode. If I use a dbPath value which is a symlink to another ...
1
vote
2answers
31 views
Using SQLite through PHP without completely disabling SELinux
I'm trying to access an SQLite file on a CentOS7 box using PHP and the PDO library. I was getting read-only errors just like this question - https://stackoverflow.com/questions/3319112/sqlite-read-...
0
votes
2answers
136 views
Configure SELinux to allow all outbound tcp and udp ports
I have an application that potentially connects to any outbound, remote tcp/udp port. As a result, I want a way to allow all outbound tcp and udp connections.
I understand that you can use a ...
1
vote
1answer
41 views
Permission denied when adding audit rule in audisp plugin
I'm trying to write an audisp plugin on a Linux CentOS 7 VM. Instead of statically setting the audit rules via /etc/audit/rules.d/, I wanted to add rules dynamically in the plugin using libaudit ...
-2
votes
1answer
303 views
Nginx cache mkdir failed (2: No such file or directory) while reading upstream
Edit for answer:
It's the selinux causes this problem, the temporary solution is to run this command: sudo semanage permissive -a httpd_t
But you shouldn't do that, because of security reasons. I ...
0
votes
0answers
30 views
SELinux: How can I use the 8081 port with apache? [duplicate]
I need to use the 8081 port with Apache but Selinux doesn't allow that:
semanage port -l | grep http_port_t
http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000
semanage ...
1
vote
1answer
58 views
Why SELinux blocks dhcpd from executing a script from writing a log file?
I would like to have dhcpd execute a script, which for now just tries to create a log file in /var/log/dhcpd/, but SELinux denies it to do so.
Question
Can anyone from the below see what permissions ...
11
votes
1answer
1k views
SELinux reset root password
Disclaimer: This question is not to solve the problem of changing root password while SELinux is active because there are a lot of guides to solve that already. This is more of how SELinux does that ...
-1
votes
2answers
94 views
Need help installing ejabberd on Centos/RHEL7 with SELinux and reverse proxy
I've been trying to get a web client to use EJabberd on the recommended port (5281) through a reverse proxy (HAProxy) on Centos7 with SELinux enabled. I am not familiar with SELinux context rules.
...
2
votes
1answer
100 views
Selinux Policy for CAP_SYS_PTRACE by invoking process name
I have a system in which we have GDB installed and a target binary which needs to be debugged for errors. We do not want the user to be able to debug any other process apart from the target binary.
...
1
vote
0answers
32 views
why selinux is denying file access(ls /usr/bin) to container_file_t type inside my container
I have one RHEL7.4 node, that when enforing selinux, it will fail my container, I checked and found it is denying reading in the container internal directories:
# docker run -it 172.16.1.120:5000/...
0
votes
1answer
158 views
selinux in a chroot environment
I need to change selinux policy for /etc/ssh/sshd_config in a chroot environment designed to rescue my system (on a dedibox) : it actually does not have any selinux context defined and then sshd won't ...
0
votes
1answer
34 views
selinux context for multiple databases
I have a directory /media/databases under which I want to hold 3 different databases : mariadb, postgresql and neo4j.
My issue is that I already have configured postgresql selinux context and the ...
0
votes
0answers
75 views
is there any way to filter in syslog (not rsyslog) such as programname?
I need to add filter in my syslogs. I know how to do in rsyslogs. But we need to add same logs in syslogs as well in legacy systems.Is there any way to do it?
Corresponding rsyslog entries are:
:msg,...
1
vote
1answer
111 views
Why is Nginx only serving the Index mark-up when I use it as a reverse proxy for Nexus 3 Repository Manager?
I am trying to serve a Nexus3 Repo Manager through Nginx reverse proxy, but it only serves the Index mark-up.
I have set up Sonatype Nexus 3 Repository manager on an Azure RHEL (SELinux) instance. I ...
0
votes
1answer
267 views
vsftpd error 530 Login incorrect error occurs with valid credentials
Though there are a number of similar existing question/answers that reference vsftpd and error code 530, but they do not seem to be helpful in this case:
vsftpd login error: 530
VSFTPD 530 Login ...
1
vote
1answer
387 views
SELinux - Zabbix server can't read conf file
I have installed zabbix server on red Hat 7.4 server with SELinux policy in Enforcing mode.
If I launch Zabbix-server (3.4.11), I have theses errors :
/var/log/zabbix/zabbix_server.log
Jul 25 16:51:...
0
votes
1answer
429 views
SELinux blocks tomcat web application to load Java native library (JNI) - how to configure SELinux on Centos 7?
I have a Centos 7 with Tomcat installed and tomcat user
ls -l /var/lib/tomcat
total 0
drwxrwxrwx. 5 root tomcat 84 Jul 3 13:18 webapps
SELinux is enforcing and a Java web application which tries ...
0
votes
0answers
33 views
selinux denial nrpe access to a ldap port
type=AVC msg=audit(1530564199.190:10850): avc: denied { name_connect } for pid=28307 comm="check_syncrepl." dest=389 scontext=system_u:system_r:nrpe_t:s0 tcontext=system_u:object_r:ldap_port_t:s0 ...
0
votes
1answer
206 views
nginx cache dir creation—strange behaviour
I have the following line (plus context) in my nginx.conf:
http {
proxy_cache_path cache/ keys_zone=auth_cache:10m;
...
Since nginx.conf is in /etc/nginx, cache/ corresponds to /etc/nginx/...
1
vote
1answer
185 views
Accidentally removed libselinux and nothing works
I have accidentally removed libselinux on centos 7.4 and am unable to install it again and all commands fail. How do i recover?
ls: error while loading shared libraries: libselinux.so.1: cannot open ...
0
votes
3answers
156 views
SeLinux stops starting of nginx
Reboted nginx proxy server (centos7+nginx only, apache on another) I got error:
DOMAIN systemd[1]: Starting Session 439 of user root.
-- Subject: Unit session-439.scope has begun start-up
-- ...
0
votes
0answers
45 views
How to filer Audit.log based on hostname or addr
I have enabled auditd to collect logs based on some rules and everything is working nicely. I wonder to know is there anyway to filer type of audit (ex USER_LOGIN) based on addr or hostname?
For ...
1
vote
1answer
87 views
SELinux context documentation
I am trying to get my head around SELinux but one question keeps popping-up in my head: CONTEXT.
When I'm writing custom rules and modules (on CentOS 7), I end up just taking contexts out of the air -...
0
votes
0answers
15 views
Changed AWS RDS instance name and now can't connect to the databases
I have a basic Wordpress site setup on AWS in a high-availability setting in two different zones and behind a load balancer, the databases are on AWS RDS with the failover/backup one in the second ...
0
votes
2answers
73 views
Allow SeLinux to specific user can send email
I'm trying to allow user zabbix to send email using ssmtps.
I've configured everything except SeLinux.
For SeLinux booleans there is no such item available for zabbix like httpd_can_sendmail.
PS: I ...
0
votes
0answers
123 views
How to pre-install and pre-configure selinux in a kvm/qemu guest image using docker?
I'm working in a company where we need to distribute our image running SE-Linux inside.
The product uses virtualization for additional security, thus we have got a setup with a linux host, running ...
0
votes
0answers
166 views
SELinux allow process to execute binary
I have the Bacula backup system running and SELinux is interfering.
The problem arises when Bacula runs a script that invokes /usr/bin/hostname before one of the backups.
12-Apr 00:05 dir_backup ...
0
votes
1answer
184 views
Does enabling SELinux “enforcing” in KVM host causing problems in the guests?
I've KVM hypervisor with (Software Raid1) and I've few created VMs .. Does Enable "SELinux" IN the host affects badly on Raid1 and The guests (VMs) ? or there is no relation?
Is it a recommended ...
1
vote
2answers
186 views
Not able to start apache in Wildfly 10 domain mode cluster with Apache mod_cluster, due to SELinux issue
I am trying to setup a Wildfly 10 cluster in domain mode with Apache mod_cluster.
In my Centos 7 webserver node I have installed Apache(2.4.6) using:
# yum install httpd
Then copied the following ....
-1
votes
1answer
191 views
MySqld Service wont start on Redhat7 after a yum update
I'm having a problem with Redhat7 after a yum update. Various services wont start and are giving permissions errors.
Similar problem to
Can't start any service after installing iRedMail on ...
3
votes
1answer
116 views
CentOS7 SELinux doesn't seem to adhere to MCS categories
Problem
A file that is assigned to a certain SELinux MCS (Multi Category Security) category can be read by a user who is not assigned to that category, indicating that MCS somehow does not work on my ...
0
votes
1answer
422 views
SELinux: how to allow httpd to delete temp files from MySQL?
Here's the setup: I let MySQL dump tables to /tmp (they just contain numbers, no real data) for PHP to pick up and process. After this, the temp files are no longer needed, so I delete them with PHP (...
1
vote
1answer
969 views
SELinux will not disable on CentOS7
I want to permanently disable right now for the short term but nothing seems to work for me
Steps I have tried
[root@db1e secure]# setenforce 0
[root@db1e secure]# sestatus
SELinux status: ...
0
votes
1answer
65 views
Removing module fails - cannot find port type, but it's there?
I have a SELinux module that, among other things, allows Apache to connect via TCP to a specific port:
cat <<EOF > sgtest.te
module sgtest 1.0.0;
require {
attribute port_type;
type ...
0
votes
0answers
206 views
SELinux: why does a new file inherit its context from its parent?
Various sources tell me that a new file gets its SELinux context from its parent (unless a transition policy exists):
1. SELinux - canonical way of automatically applying a context on file creation
...
1
vote
0answers
192 views
SELinux set enforcing issue
I am on CentOS 6.9 with a LAMP stack, trying to set SELinux=enforcing in /etc/selinux/config
However after **reboot ** and checking sestatus I still get SELinux status:disabled
Then I tried running ...
0
votes
0answers
214 views
allow apache to run php script - audit2allow hasn't worked thus far
At a previous company the fix was to disable SELinux. I'm trying to leave SELinux enabled and tune what I need in order to accomplish my goal.
In short, I want apache/httpd to run '/usr/bin/...
1
vote
1answer
267 views
Can't read from /proc/self/attr/current, but permissions are 0666
I'm working with an externally created script that reads from /proc/self/attr/current to get SELinux configuration info. It seems that, even though permissions on the file are 0666, on some systems ...
2
votes
1answer
61 views
Executing semanage returns that Python 'Plural forms expression could be dangerous'
Returning to the same issue.
I am receiving some error in python when adding semanage rules:
# semanage port -a -t http_port_t -p tcp 29200
Traceback (most recent call last):
File "/sbin/semanage", ...
0
votes
1answer
79 views
Set persistent SELinux file types under /run
I set a file to a specific type using semanage fcontext, and using restorecon does properly set the file type. However, upon reboot, the type goes back the default. If I run restorecon again then it ...
1
vote
1answer
431 views
Why is SELinux blocking systemctl --user / systemd user instance commands?
I have a number of Fedora 27 systems. I am reasonably comfortable with SELinux. I run it on all my systems, with the "unconfined" module disabled.
On this particular system, SELinux is blocking all ...
0
votes
1answer
240 views
Can not change SELinux security context on Gluster FS folder
I can not change the security context of a folder which is created inside a Gluster-FS volume. Following is the error I keep getting.
chcon: failed to change context of ‘test’ to ‘system_u:object_r:...
