Questions tagged [selinux]
NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.
602
questions
0
votes
0answers
21 views
PiHole container on Podman fails to start with SELinux enabled on Fedora 31
I'm trying to get PiHole up and running using Podman on Fedora 31 Server.
When I set SELinux to Permissive mode, and I use the following command, everything works perfectly.
sudo podman run -d --...
0
votes
1answer
12 views
SELINUX sysadm_u and SSH - Unable to get valid context for username
Once I set user usernameto sysadm_u they are no longer able to login via SSH and receive the error: Unable to get valid context for username
Commands
semanage login -m -s sysadm_u username
semanage ...
0
votes
1answer
43 views
How to fix SElinux contexts and labels after restoring from backup
I have a server running Centos7/XFS with SElinux that had a problem (unrelated to SElinux) and had to be restored from a snapshot that was several weeks old. This server also makes a nightly rsync ...
0
votes
0answers
14 views
How should the initial files in a custom SElinux policy be created and labeled?
Summary
Given a custom policy allowing the file type blue.files to /blue how should one initially create /blue with the type label blue.files?
Background
Note: this question resulted from trying ...
0
votes
1answer
49 views
Rsyslog / CentOS 8 / no write logs|no catch?
I use rsyslog (8.37.0-13) on CentOS 8 (CentOS Linux release 8.1.1911) and I've type error with my configuration.
My rsyslog.conf is :
module(load="imuxsock")
module(load="imjournal")
module(load="...
0
votes
2answers
53 views
Determine if Linux account locked when SELinux protects shadow
I am trying to run a script which gets the username of every locked account on a Linux system. The server is a Gentoo Hardened Server with SELinux. I tried by writing some Python which looks in /...
1
vote
0answers
39 views
SELinux prevents Apache from scheduling at job
I have an application that submits tasks to cloud services that create certain time-sensitive assets. The services take an unknown amount of time to process, and in addition the assets may be ...
0
votes
0answers
21 views
PHP-FPM pool user not able to send mail, permission denied
One of my website maintenance scripts is having trouble sending mail...
I'm running a few web applications on a CentOS8 server, with Apache 2.4, PHP 7.3, PHP-FPM, etc., and SELinux IS enforcing. To ...
0
votes
0answers
28 views
rsync postgres backup to another directory
I have CentOS 7 (3.10.0-1062.18.1.el7.x86_64) with SELinux enabled.
PostgreSQL 12 installed (not sure if it is related).
I try to backup database and move backup files to another disk. How I create ...
1
vote
1answer
25 views
How can one identify what changes the SELinux file context of a file?
I'm noticing some files within a web directory with changed file contexts that deviates from system policy. There are developers that run git pull against at a higher part of the web directory and I'm ...
0
votes
0answers
23 views
SELinux and semanage for customizing Apache SSL certificate and key path
I want to create custom path for SSL certificate and key in apache for each user, for example:
user1 will have the SSL path like this:
/home/user1/ssl/certificate.cer
/home/user1/ssl/ca_certificate....
0
votes
1answer
57 views
semodule_package command not found
Hello im trying to install MongoDB on CentOS7. It says there to configure SELInux, which i followed.
On the third step, it says to execute the following;
checkmodule -M -m -o mongodb_cgroup_memory....
1
vote
0answers
369 views
SELinux blocking execution in systemd unit
I use Fedora 31 and tried to set up a Teamspeak server. When I look in journalctl -u teamspeak I get the following error:
mar 09 22:22:46 melchior systemd[1]: Started Teamspeak server.
mar 09 22:22:...
1
vote
1answer
150 views
SELinux with docker and traefik
I have a SELinux security problem on /run/docker.sock using traefik in docker.
docker ps works correctly, it's only a problem with traefik needing to map volume /var/run/docker.sock
Here is what I ...
0
votes
2answers
133 views
Apache Webserver - Selinux, directory permission
I trying to set up apache on centos 8. The service is running. When i test with wget, I get 403
$ wget 127.0.0.1:9000 ...
0
votes
1answer
50 views
Allow apache service to execute command on another user with sudo. Set correctly SELinux
I want allow PHP script to execute external command with another user with exec.
For this, I call my command like :
exec('sudo -u username /usr/bin/command -a arg1 --arg2 arg2');
In sudoers rules, I ...
1
vote
1answer
34 views
Allow rsync to write to httpd_user_content_t
We have rsyncd running as a daemon on our frontend web servers. We push web app updates out via rsync.
We're looking at cutting down the noise in auditd and fixing up some of the issues from SELinux (...
0
votes
1answer
103 views
SELinux logrotate issue
It seems the topic is quite popular... So I figured I have issues with my logrotate not being able to rotate tomcat logs. Logrotate configuration is set in /etc/logrotate.d/tomcat as
/opt/tomcat/...
2
votes
2answers
451 views
Why is SELinux blocking my Zabbix agent's sudo calls?
I have some Zabbix checks that require sudo. These are the contents of /etc/sudoers.d/zabbix
zabbix ALL=(ALL) NOPASSWD: /bin/yum history
zabbix ALL=(ALL) NOPASSWD: /bin/needs-restarting
zabbix ...
1
vote
1answer
97 views
SELinux, Nginx and fcgiWrap: how to allow access to fcgiWrap socket?
I am under Fedora 31 (linux kernel 5.4.13, Nginx 1.16.1, fcgiwrap 1.1.0) running with SELinux in enforcing mode (policy: targeted 3.14.4-44.fc31).
My box hosts a server driven by Nginx. Part of it ...
0
votes
1answer
89 views
Apache vhost privilege separation using mod_selinux
I have 2 sites/apps on a server; a proprietary app, and Nextcloud. Nextcloud will be using the files_external storage plugin which allows for local mounts, but I do NOT want it to be able to browse ...
0
votes
1answer
109 views
RHEL SELinux: /etc/sysconfig/selinux or /etc/selinux/config?
I am running CentOS Linux release 7.5.1804 (Core), and bumped into the usual set SELinux to Permissive task. But then my two sources gave me two different locations where the config should be set:
/...
0
votes
0answers
31 views
How to give the correct priviliges to firefox in SELinux
I am using selenium with firefox and geckodriver on a CentOS(7.6) server. The python script works fine if I execute it directly, either as root or an ordinary user. When the same script is called from ...
1
vote
1answer
67 views
Apache vhost privilege separation using SELinux contexts on CentOS8
I've got a server that will have several applications on it, one of which is proprietary code, and another with the ability to examine files on the server due to the nature of our needs. This will ...
0
votes
0answers
32 views
Allowing fail2ban to read logs on a NFS on a SELinux enabled CentOS 7 server
The title says it all, I need fail2ban to monitor logs on my NFS but it's getting blocked by SELinux. Here is an example from selinux logs:
time->Thu Jan 9 03:56:45 2020
type=PROCTITLE msg=audit(...
0
votes
2answers
72 views
SELinux port type to reserve port for user PHP in-built webserver
I am trying to get an application running which uses the PHP inbuilt webserver. It gives permission denied because of SELinux running on the system. There is no policy for the PHP inbuilt webserver as ...
0
votes
1answer
706 views
Selinux is preventing to start Tomcat
I have a problem when I launch tomcat on RHEL 8:
[root@TEST ~]# systemctl restart tomcat.service
Job for tomcat.service failed because the control process exited with error code.
See "systemctl ...
0
votes
0answers
27 views
Gentoo SELinux, web directories no longer inherit correct context
Due to a recent Gentoo hardened SELinux update my policy is now broken. I have users in the user_u:user_t_:user_o context and they can create files in /var/www/user/username and always have been ...
0
votes
2answers
111 views
Linux blocking port-forwarded connection to SSH service
I'm trying to connect to my computer's SSH service from outside my network (Internet). The router is a Sagemcom 5655. In the router I configured port-forwarding as I did many times before in my life, ...
0
votes
1answer
78 views
Unable to start docker container with systemd when SELinux is in enforcing state
When I start the Docker container which has systemd in it, with SELinux in enforcing state, I get an error message "No such file or directory" and the container does not start.
Audit logs give the ...
0
votes
1answer
175 views
Opening ports in SELinux: How to give a daemon permission to listen on predefined port type?
This is a fairly generic SELinux question, but with a specific example. I'm still fairly new to SELinux, so am regularly fighting with it!
I'd like to know if I can set up a daemon (in this case ...
0
votes
0answers
29 views
Replicate SELinux issue on CentOS VM
I have a CentOS 7.6 virtual machine on my workplace's network that I have access to via SSH, and only SSH. I recently tried to install OKD on it and ran into a problem through which, after setting ...
0
votes
0answers
23 views
Selinux not logging denials on CentOS7 Apache
We just wasted a good chunk of time to file permission errors for GitList. We were misled because the denials are not in any of the expected logs, nor are they reported by ausearch or setroubleshoot. ...
0
votes
1answer
52 views
Access through SSH to a SELinux enabled machine
first question here!
I have a CentOS 7 virtual machine using SELinux in my job's local network in which I want to install OKD.
The issue is that OKD requires SELinux to be enabled, and enabling it ...
0
votes
0answers
105 views
Why does Nginx not have permissions to open this file?
I started using Nginx today for the first time, and I'm also new to command line so please be gentle.
I have a CentOS 7 server that hosts an index.html file that I would like to access from the ...
0
votes
1answer
58 views
selinux and ntp , dose selinux heve negative impact on ntp
we have redhat linux servers
in spite chrony.conf is set correctly with the right ntp servers
we see very strange behavior that time is still sync to ntp server but change from some reason
we ...
0
votes
0answers
46 views
Change IP-package content using iptables
I want to modify on-the-fly contents of the IP-package header (field "Classification level" addressed by rfc 1108: https://tools.ietf.org/html/rfc1108).
Is there a way to do it with the help of ...
0
votes
2answers
106 views
Setting SElinux Labels for a magento site on Centos 7
I was hoping someone could kindly help myself. I have a Magento site running on a Centos 7.6 server.
Now, the site is not correctly loading and looking in the messages.log I see numerous entries ...
2
votes
2answers
138 views
SELinux won't let me run sshd under port 443
I'm running Redhat 7.7. I am trying to let the ssh-service accept connections on both Port 22 and Port 443. I have allready opened the firewalld with
sudo firewall-cmd --add-port=443/tcp --permanent
...
1
vote
1answer
191 views
selinux blocks unconfined service from loading kernel module
I have a daemon running as unconfined_service_t SELinux type, on Redhat Enterprise Linux 8:
# ps -eZ | grep savd
system_u:system_r:unconfined_service_t:s0 693 ? 00:00:00 savd
It is trying to load a ...
3
votes
1answer
144 views
Are custom SELinux policy modules portable?
If I take a policy created, say, using audit2allow -M and install it on multiple servers, will it work as expected or is there something special happening when the policies are created? Ideally I'd ...
0
votes
2answers
37 views
CSRF warning on centOS where there shouldn't be [closed]
i am working on my own ERP in laravel with a seperate Vue.js Front. I was for a while working on a windows server with apache and it was working fine. The setup was a bit tricky in the beginning as i ...
2
votes
2answers
110 views
Does SElinux in enforcing mode cause delays in file access?
I have enabled SElinux in enforcing mode on Amazon Linux and see that the time taken for file access (read/write/update) has increased by an average of 2-4 seconds. The source process is Salt and the ...
0
votes
1answer
56 views
semanage fcontext is not overwriting default policies
I'm trying to make some custom policy on selinux file context, but the default is not changing. Here is my commands:
semanage fcontext -a -t httpd_sys_content_t "/home/(.*)?"
semanage fcontext -a -t ...
0
votes
1answer
93 views
How do I need to configure selinux in order to have 'setenforce 1' and still be able to run my webservices?
my problem is as follows:
I installed gitlab on a cloudserver of mine running CentOS7, and I configured it to use apache2/httpd instead of nginx as webserver.
For doing so I followed this answer on ...
0
votes
1answer
862 views
Destination unreachable (Host administratively prohibited) when allowed through FirewallD and SELinux
I am trying to connect to my VM which is running Oracle Database XE 18c on Oracle Linux 7.6 and using bridged networking through Oracle SQL developer, however I have found no luck.
I have permanently ...
0
votes
1answer
127 views
SELinux is set to permissive but it's disabled, how to enable it?
I want to enable SELinux on my VPS but I can't do it.
/etc/selinux/config :
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - ...
0
votes
1answer
56 views
Apache2 cannot open socket as a service
Platform: CentOS Linux release 7.5.1804
I have a freshly installed apache2 and I need to have it listening on a non-default port to fit the host's firewall policy.
I change the httpd.conf to have
...
0
votes
0answers
29 views
Dhcpd won't start due to selinux
have searched tirelessly and can't find an answer to this thats not confusing. I have a clean install of centos 6.2 32bit on a machine I use as a router. with selinux enabled dhcpd refuses to start ...
1
vote
1answer
61 views
SELinux: AIDE Trying to Access SSSD Socket
I'm getting SELinux denials indicating that /usr/sbin/aide is trying to access a socket used by SSSD: the socket path is /var/lib/sss/pipes/nss. Here is the relevant text from sealert:
Additional ...
