Skip to main content

Questions tagged [selinux]

NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

Filter by
Sorted by
Tagged with
0 votes
0 answers
24 views

NAT gateway forwarding over the same network interface

I am running a server in AWS with two ENI (NIC) attached to an instance I wish to use as a NAT server. Each ENI has its own public and private IP address (ens5 and ens6). I'd like to make it so that ...
Ra'Jiska's user avatar
  • 101
2 votes
1 answer
90 views

Is setting setenforce 0 equivalent to setting permissive mode in the configuration and rebooting?

Setting setenforce 0 to disable SELinux temporarily should be effective and equivalent to setting permissive mode in the configuration and rebooting. If setenforce 0 doesn't work, it suggests that ...
Max Haase's user avatar
  • 797
3 votes
2 answers
288 views

Perl CGI Fails with Permission Denied - AH01241: Error spawning CGI child

I have a Perl CGI script Test.cgi at /var/www/cgi-bin/Test.cgi. The content is simply: #!/bin/perl -T print "Content-type: text/html\n\n"; print "Hello, World."; The issue is that ...
Aerozeek's user avatar
  • 143
0 votes
1 answer
45 views

PHP Unable to Read /home Folder

I am having an issue with a PHP script not being able to read a user's /home folder. This is an issue on a server running AlmaLinux 9.4, my other server running CentOS can read the folder. The error ...
Rick Boklage's user avatar
0 votes
0 answers
38 views

SELunix Unable to open logfile- permission denied

My conntrackd service is failing to start with the error (message logs): Jun 25 15:01:19 ip-10-0-10-231 conntrackd[30874]: ERROR: can't open logfile `/var/log/binu/conntrackd-stats.log'.Reason: ...
vikramaditya234's user avatar
0 votes
0 answers
51 views

Postfix Blocked by SELinux

Struggling getting Postfix to run properly on CentOS9, I have it working sending a mail when I call webpage that has the code for a hardcoded email test. The issue is on a contact form on the website, ...
llanato's user avatar
  • 211
1 vote
0 answers
33 views

AH01797, access_compat:error cannot find root cause

No matter where I set my "Require all granted" block in my httpd conf, I keep running into these errors: [Thu May 30 10:55:16.510272 2024] [access_compat:error] [pid 1076428] [client 10.192....
itinneed2022_1's user avatar
1 vote
2 answers
162 views

SELinux denies samba share

Trying to configure samba to share my drives (locally to virtual machines). Using Fedora. The shares work with sudo setenforce 0, so it's a SELinux issue Here are my SELinux rules. sudo semanage ...
Etienne Charland's user avatar
1 vote
1 answer
155 views

Fedora 40: Apache Httpd refuses to write to "/home" filesystem, but I checked SELinux settings

I'm installing FosWiki on a Fedora 40 Machine. The FosWiki top directory shall be /home/wikis/foswiki_company. Underneath that there are various directories for content, as well as the log directory. /...
David Tonhofer's user avatar
0 votes
0 answers
41 views

Qualys Agent whitelist in SE-Linux

Can anyone pls suggest how to whitelist qualys agent in SE-Linux i have tried in google am not getting proper command if anyone can help me to whitelist qualys agent would be great
suresh suresh's user avatar
2 votes
0 answers
179 views

SELinux inside of a Docker Container

Here How to enable SELinux inside of a CentOS Docker container? someone explains that SELinux cannot be used in a Docker Container, is this still valid?
linux's user avatar
  • 21
0 votes
1 answer
119 views

How do you allow user_t SELinux users the ability to use sudo

I've got three classes of user that I have assigned to staff_t, user_t and guest_t. However the default permissions of these user types don't exactly correspond to what I need. It seemed easier to use ...
okapi's user avatar
  • 152
0 votes
0 answers
65 views

Create custom SELinux policy with full access

I have a process my_process which should have access to all processes, files, ports, network traffic, etc. This process needs to work with SELinux. How can I configure the appropriate policy? I tried ...
Mark Tah's user avatar
0 votes
2 answers
285 views

Grant sudo based on SELinux

I've recently come across SELinux and sudo. Is it possible to allow users sudo when SELinux is permissive, and block these while allowing others when SELinux is enforced? I've looked at section 3.9. ...
user1098490's user avatar
0 votes
2 answers
479 views

How do I configure SE Linux so PHP can connect to Postgres by socket

I have a PHP application that connects to a Postgresql Database. This works when I connect via network but I get an SELinux violation when trying to connect using the socket. I believe the contexts ...
Chronocide's user avatar
2 votes
1 answer
329 views

SELinux: Why can httpd read files in /var/www/html?

I'm just trying to understand targeted SELinux better. While I understand that users, processes, ports etc. are labled with a quadruple <user>,role>,<type>,<sensitivity> and how ...
hhue13's user avatar
  • 43
0 votes
1 answer
211 views

Should SELinux be enabled and the filesystem relabelled before or after other software has been installed?

I have an AlmaLinux 9 server with SELinux installed but currently disabled as the server isn't in production use yet. I am ready to start installing other applications (e.g. Apache, PHP, Postfix, ...
Noel Whitemore's user avatar
2 votes
1 answer
589 views

FAPolicyD overhead slowing down a server

We have a server with the Alma Linux 9.3 OS. By default (as well as all current RHEL-like OSs) it has fapolicyd enabled. There is also an application server (WildFly/JBoss/Java) running on that server....
McLayn's user avatar
  • 193
1 vote
2 answers
1k views

Problems deploying Ansible playbook to Linux server using python3.8 - selinux python module does not assign correct contexts

I run an Alma 8/9 estate and use Ansible to deploy various config changes, and I've run into an unusual problem on one of my client boxes. Alma 8 by standard comes with python 3.6, which works quite ...
motorleague's user avatar
0 votes
0 answers
139 views

configure selinux to prevent non-root users from accessing particular port

Can selinux be locked down to prevent non-root users to being able to access a particular port on linux? e.g if I have a local web server, I would like to prevent non-root users from being able to ...
Conor Lennon's user avatar
1 vote
4 answers
754 views

Ngnix can't write socket file due to SELinux

When setting up nginx with a socket on my newer environment that runs SELinux I am getting the following error: AVC avc: denied { write } for pid=23704 comm="nginx" name="xxx.sock&...
Wealot's user avatar
  • 111
1 vote
0 answers
576 views

How to inspect the rules in a policy module?

I know I can use semodule -l to see what modules I have. However, I want to see the rules contained in a specific module. I read almost all document I can find for semodule, seinfo, sesearch. I cannot ...
Wang's user avatar
  • 322
0 votes
0 answers
293 views

SELinux silently blocking PHP process listing

I have a system where we use PHP to run some rudimentary health checks on the server. When hitting a status page, it verifies that certain processes are running, and returns an error message if ...
Jared's user avatar
  • 383
1 vote
2 answers
2k views

SELinux blocking nginx -t

I'm setting up Rocky Linux and I've run into this error: sudo nginx -t nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: [emerg] bind() to 0.0.0.0:80 failed (13: Permission ...
Blue Nomad's user avatar
0 votes
1 answer
281 views

Does SELinux allow the apache user to read /etc/passwd file?

I was experimenting and learning SELinux on Alma Linux 9.2. The intention was to build a flask application that has a file inclusion vulnerability and show how SELinux can prevent the vulnerability to ...
user1720897's user avatar
0 votes
0 answers
325 views

SELinux on RHEL8 with Gunicorn and nginx has problems with saving file into diretory

I have Django application running on RHEL8 via Gunicorn and nginx. All works fine in case of testing with SELinux disabled. When I enable SELinux, there is a problem with saving the picture from ...
Marek's user avatar
  • 1
1 vote
0 answers
103 views

Incorrect SELinux labeling of mysql unix socket on Centos7

OS: # rpm -q centos-release centos-release-7-9.2009.1.el7.centos.x86_64 I'm trying to get zabbix-agent to access mysqld (using mysqladmin ping), but the process fails with the following errors(in ...
Samveen's user avatar
  • 1,873
7 votes
2 answers
1k views

How to log executions of specific commands on Linux no matter where it came from?

Dangerous commands like rm , kill and systemctl stop can be hidden outside bash inputs - i.e. - a malicious user can easily hide them inside a python script using os module and just run the python ...
George Y's user avatar
  • 578
0 votes
0 answers
131 views

Protecting a Linux against root users

I'm searching for a way to "protect" a Linux operating system against (root) users that can potentially misbehave. My threat model is the one of university students, having access to root ...
user19917937's user avatar
0 votes
2 answers
408 views

Can mount on /mnt but not on other mount point, why?

this is an RHEL8 VM. I'm trying to mount a logical volume on /var (because I need more space). For now I have created a directory /xvar to mount on, but it doesn't work and doesn't show an error. ...
musbur's user avatar
  • 213
0 votes
1 answer
166 views

Remote call of NRPE comman fails in one case, while succeeding locally in all

I have amazingly strange issue with monitoring a CIFS (SMB) shared folder mounted to Linux machines by Nagios + NRPE. NRPE process runs on the Linux machines under dedicated user nrpe: # systemctl ...
Cat Mucius's user avatar
1 vote
0 answers
72 views

Cannot create SPEC file with sepolicy-generate

In EL7 I have been creating custom policy with sepolicy-generate and one of the artefacts created is a SPEC file. When I run the same command on EL8 I don't get the SPEC file. According to the manpage ...
AlanG's user avatar
  • 21
0 votes
1 answer
707 views

SELinux policys keeping Tomcat from starting

On a newly built Oracle Linux 8 server i added a drive and file system, then put put Apache Tomcat on that file system via the tarball. Now when starting Tomcat via a services file, I get an error ...
Eric W's user avatar
  • 109
1 vote
1 answer
286 views

Error while customizing selinux policy for domain

I am following the steps outlined under this link to customize selinux policy for specific domains (types). For the domain systemd_tmpfiles_t, I get the following suggestion from audit2allow for a ...
Vinod's user avatar
  • 113
0 votes
1 answer
729 views

SELinux is preventing /usr/bin/mongod from search access

My question is similar to others, such as SELinux preventing mongod search access. In this case, I installed snapd for a reason entirely unrelated to Mongodb. That was about a week ago (2/5/2023). ...
Scott Anderson's user avatar
3 votes
2 answers
387 views

Dedicated user vs selinux

What are the advantages and disadvantages of running a process with a dedicated (non root) user versus with SELinux (where a SE user may be bound to a Linux user) ?
Taknok's user avatar
  • 133
0 votes
1 answer
192 views

How to set Apache-accessible SELinux policy for EFS mounted user directories?

When I mount my EFS to a user directory, the directory policy becomes system_u:object_r:nfs_t:s0, which is too restrictive - I need it to behave more like a typical user directory, which is ...
HWD's user avatar
  • 111
3 votes
1 answer
1k views

SELinux is preventing in:imjournal from unlink accesses on the file imjournal.state

I have a problem on Fedora 36 with rsyslog, selinux and /var/log/messages components. As you can see: AVC avc: denied { unlink } for pid=XXX comm="in:imjournal" name="imjournal.state&...
bugmeu's user avatar
  • 31
0 votes
0 answers
2k views

Jboss as a service failing on OS Reboot RHEL8

0 I am facing some issues while running Jboss as a service on RHEL8 servers. The setup of service is done in a standard way as per the RHEL guidelines https://access.redhat.com/documentation/en-us/...
Amiy's user avatar
  • 1
1 vote
0 answers
3k views

Podman is unable to start container with SELinux (sd-bus call permission error)

Here is the command I am using to start the container: podman run -d --name busybox-top -v ./src:/dest:Z busybox top Error: Error: sd-bus call: Permission denied: OCI permission denied I do not have ...
jnbdz's user avatar
  • 957
0 votes
1 answer
248 views

DB2 systemd startup

I have a DB2 systemd startup unit that is being denied by SELinux. Here is the unit: [Unit] Description=IBM DB2 After=network.service [Service] Type=forking EnvironmentFile=/user/home/dvdxadm1/sqllib/...
Kevin Huntly's user avatar
2 votes
1 answer
1k views

Timedatectl "Failed to parse bus message: Connection timed out" with systemd ExecPreStart while SELinux is enforcing

Using Oracle Linux 8.6 we're having an issue with timedatectl but only when it's run by systemd(239-58.0.1.el8_6.3) during ExecStartPre in a .service definition file and SELinux is set to Enforcing. ...
mitchellJ's user avatar
  • 143
2 votes
3 answers
4k views

Postfix master.pid ExecStartPre with exit status 255

When I restart the Postfix daemon on my Rockylinux server, It happen an restorecon error who don't avoid the starting of the service but still an error : ● postfix.service - Postfix Mail Transport ...
Carsene's user avatar
  • 21
1 vote
1 answer
88 views

Is there such a tool on CentOS/SELinux to monitor incoming HTTP/HTTPS traffic the way Ngrok displays it?

I really love how ngrok displays the incoming connections to a server with the response. Is there such a tool (either to install or native) on CentOS/SELinux that would display some info? I found a ...
Nicolas Zein's user avatar
0 votes
1 answer
770 views

cannot boot unless Selinux is disabled

The system fails to boot due to mount failure. I've traced it back to selinux since I can hold shift and edit the grub cmd to read selinux=0, but interestingly enough if I try permissive mode, ...
zestytestful's user avatar
1 vote
1 answer
317 views

How to adjust SELinux to allow not so large file downloads in Apache?

I have a centos 7 server running Apache 2.4 that will happily allow users to download files until they get to a certain size. I've noticed the problem with mp4 video files; I host both low and full ...
Damian's user avatar
  • 11
0 votes
1 answer
2k views

How to set SELINUX HTTPD User Content RW?

I'm quite new to SELINUX, I've simple question, I know there are httpd_sys_rw_content_t for /var/www/html, and read only httpd_user_content_t, but if I want to allow some folder to be RW for that ...
Benyamin Limanto's user avatar
0 votes
1 answer
2k views

Ubuntu 20.04 doesn't boot after setting SELinux enforcing

I'm trying to set SELinux to enforcing on Ubuntu 20.04, and the steps I did are as follow: Install SELinux = sudo apt-get install policycoreutils selinux-utils selinux-basics -y Activate SELinux = ...
kayanon's user avatar
1 vote
2 answers
2k views

How to allow user to run only specific binaries

I'm adding user logviewer with /sbin/nologin/ and to my system. My custom service is running eg. sudo -u logviewer less --follow-name /var/log/messages. But still there are ways to run other command ...
Iluvatar's user avatar
  • 121
1 vote
1 answer
2k views

Unable to change SSH port on Almalinux/CentOS 8 with selinux present

I am trying to change the SSH port on a VPS using Almalinux. I followed this guide but have not been able to. These are the output I receive when try to SSH using both 22 and the new port respectively....
Rashiq's user avatar
  • 115

1
2 3 4 5
15