Questions tagged [selinux]

NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

120 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
762 views

SELinux: How to allow apache, samba and tomcat access on the same file

Running RedHat 7.4 Until recently I could use semanage fcontext -a -t public_content_rw_t '/var/www(/.*)?' restorecon -R /var/www from answer https://serverfault.com/a/346779/125461 on How do I ...
4
votes
0answers
203 views

What's the recommended way to restrict Internet access per process using SELinux?

Before I have tried to do this using a phony user and iptables to execute commands that needs to be restricted. However now the commands need to read configuration set by each user's environment vars ...
3
votes
0answers
803 views

How can I configure SELinux to let rsyslogd run my program?

I'm trying to use SELinux with a system which has rsyslogd call a binary: # rsyslog configuration file module(load="omprog") template( name="snmp_template" type="string" string="%msg%\007" ) ...
3
votes
0answers
277 views

How do I go about creating a systemd selinux policy domain?

How can I create an selinux policy to govern my systemd unit? I am creating a daemon that will be managed by systemd and I'd like to create an appropriate selinux policy to go with it. I've tried ...
2
votes
0answers
245 views

ERROR: Couldn't connect to Docker daemon at http+docker://localhost - is it running?

My environment: # cat /etc/redhat-release Red Hat Enterprise Linux Server release 7.6 (Maipo) # uname -a Linux X.Y.Z 3.10.0-957.12.1.el7.x86_64 #1 SMP Wed Mar 20 11:34:37 UTC 2019 x86_64 x86_64 ...
2
votes
0answers
167 views

Multiple IP addresses with SELinux using the same port

I have a CentOS 7 box with multiple IP address on the same NIC. One IP uses 443 for ssh and I want the other IP to use 443 for the web server. SELinux won't let httpd startup saying: (13)Permission ...
2
votes
0answers
578 views

SELinux stops pam_oddjob_mkhomedir from re-creating home dirs after deletion

I have a RedHat 7 server which is hooked up to LDAP and is supposed to create home folders automatically. In line with RedHat recommendation I use pam_oddjob_mkhomedir.so. Everything works fine if the ...
2
votes
0answers
409 views

Creating multiple SFTP users in Centos (installed in AWS EC2) with SELinux

I am having difficulty letting others FTP/SFTP to our site. I have multiple Virtual Name Servers created and each of them running their own website. So , I would like to give FTP/SFTP access to users. ...
2
votes
0answers
411 views

Isolating Apache virtualhosts using linux container

I have a web server host (Apache on Linux) that runs many virtual hosts which offer CGIs and FastCGIs using 'chroot' to seperate the processes from each other. For serveral reasons I am thinking of ...
2
votes
0answers
128 views

SELinux - FCGID program being blocked and no log on /var/log/audit/audit.log

I have a setup where a certain link on my Web Server is redirected to a FCGID module. When I disable SELinux with 'setenforce 0' the site works. When I enable it won't work, it gives me a "Error 500 -...
2
votes
0answers
108 views

Finding local ID for SELinux denial under Fedora 23

Trying to get more fluent with SELinux, it looks like sealert -l <local-id> would be a particularly useful way to get help with logged denials. From what I understand, the local IDs used to ...
2
votes
1answer
59 views

docker made fedora host unbootable in selinux enforcing mode

I've done incautiously docker run -v /:/mnt:ro someimage It has resulted with some docker (docker v1.7) daemon error. Since then I can only boot in permissive mode and got lot of selinux errors. ...
2
votes
1answer
664 views

how do i inspect the contents of an selinux module?

I would like to view the [textual] contents of an selinux module, say for instance, /etc/selinux/targeted/modules/active/modules/udev.pp. I tried sedismod, but I get the following error on Fedora 21: ...
2
votes
0answers
475 views

Gitolite3 push and selinux access failure

I try to install gitolite3 with ssh and http. I have followed largely the official guide at gitolite3, but I am stumbling accross three remaining problems. When I $ git clone http://florian@server/...
2
votes
1answer
350 views

SELinux - CentOSx86_64: User command limitation

SELinux - CentOSx86_64: User command limitation Is SELinux the right tool for this job? If so, what is the best way to do it? I would like to limit a particular user to only running some list of ...
2
votes
1answer
1k views

How to implement and modify policies for Role-based access control on Ubuntu Linux?

Selinux is currently installed on the machine but there's no simple way to enable and modify RBAC for users. Seedit is available for Fedora and CentOS but it is not working on Ubuntu distros. Are ...
2
votes
4answers
856 views

Fedora 12 on Vmware network disabled on restore

I have a fedora 12 guest running on VMWare on windows 7. I use it mainly for the occasional linux dev. Whenever I restart the guest, networking works fine. But if I close the VMware player and save ...
1
vote
0answers
202 views

nginx + uwsgi + django 502 bad gateway on aws ec2

I have successfully installed nginx and uwsgi on aws ec2 instance. But on hitting the public IP its showing "502 bad gateway". Though both nginx and uwsgi server status is running and active. The ...
1
vote
0answers
100 views

Ansible sefcontext not making fcontext permanent

Trying to use Ansible on a CentOS 7 server to make a directory and sync files into it. That part is working. The problem is I get a 403 Forbidden error when I try to access them from the browser. I ...
1
vote
1answer
399 views

SElinux: allow httpd to connect to redis

I'm running on RedHat7, with apache 2.4 and redis installed. Apache won't connect to redis unless selinux issues are resolved. I know that one option to fix that is to allow all connections with: ...
1
vote
0answers
33 views

SELinux policy and changing disk ids on Hardened Gentoo

I run a system with hardened Gentoo under a KVM/QEMU. I am new to SELinux and make heavy use of audit2allow to get things working. When doing this I include and carry along the location of the disk, ...
1
vote
0answers
101 views

why selinux is denying file access(ls /usr/bin) to container_file_t type inside my container

I have one RHEL7.4 node, that when enforing selinux, it will fail my container, I checked and found it is denying reading in the container internal directories: # docker run -it 172.16.1.120:5000/...
1
vote
2answers
926 views

SELinux - Zabbix server can't read conf file

I have installed zabbix server on red Hat 7.4 server with SELinux policy in Enforcing mode. If I launch Zabbix-server (3.4.11), I have theses errors : /var/log/zabbix/zabbix_server.log Jul 25 16:51:...
1
vote
1answer
142 views

SELinux context documentation

I am trying to get my head around SELinux but one question keeps popping-up in my head: CONTEXT. When I'm writing custom rules and modules (on CentOS 7), I end up just taking contexts out of the air -...
1
vote
0answers
251 views

SELinux set enforcing issue

I am on CentOS 6.9 with a LAMP stack, trying to set SELinux=enforcing in /etc/selinux/config However after **reboot ** and checking sestatus I still get SELinux status:disabled Then I tried running ...
1
vote
1answer
595 views

Why is SELinux blocking systemctl --user / systemd user instance commands?

I have a number of Fedora 27 systems. I am reasonably comfortable with SELinux. I run it on all my systems, with the "unconfined" module disabled. On this particular system, SELinux is blocking all ...
1
vote
1answer
439 views

SELinux: Getting a custom binary to switch to another context

I am working on a new project that must be secured with SELinux. We have a custom binary written in C (for the sake of this question it will be called "testprog") that needs to switch to it's own ...
1
vote
1answer
484 views

Docker namespaces and SELinux not working

My system: Debian 9 Stretch Docker version 17.06.0-ce, build 02c1d87 SELinux This is just running fine. But, if I also activate Namespace Remapping (default, using the dockremap User), I can't run ...
1
vote
0answers
81 views

Setting a port number inside my selinux module file

I'm trying to put together a small selinux module to further my understanding of selinux. I've defined a small daemon-like application type with its own port_type. The following code is a condensed ...
1
vote
0answers
307 views

Something on CentOS is blocking remote MySQL connection

I am running MySQL on CentOS 7, and don't seem to be able to connect MySQL remotely. I have: bind-address=0.0.0.0 and certainly not #skip-networking but it doesn't matter if I bind to the actual ...
1
vote
0answers
454 views

selinux cause 2 error: httpd write access mysql and zabbix search mysql

I have a question similar to this : Zabbix server SELinux policy but a little different: I have a Zabbix server running on a RHEL 6 ,when I enable selinux , I got this error: Error connecting to ...
1
vote
2answers
1k views

selinux http_port_t vs http_cache_port_t

I need Wildfly listens to another port. I know I need to change selinux in order to allow it. Nevertheless, I've found exists two possible rules to change: http_port_t, and http_cache_port_t. ...
1
vote
0answers
495 views

Cannot rm/unlink files at first but can after vim and writing the file

NOTE: It looks like setting selinux to Permissive mode does not prevent this file permission issue. We have a development VM running CentOs 7.2.1511. Files are shared with our host machines (Macs) ...
1
vote
0answers
1k views

Chroot local VSFTPD users into their own respective directories

So I have been really struggling the past few days trying to get an FTPES chrooted instance of vsftpd set up on Red Hat 7.3. The objective is to have external users login only to their respective ...
1
vote
1answer
132 views

vServer with Centos 7.3 SELinux 2.5 don't get active

I get a new vServer with Centos 7.3. and SELinux 2.5.* . I would like to get SELinux to be active to get greater access control over my server, but nothing works. If I check SELinux Mode and enter ...
1
vote
0answers
264 views

CoreOS logs flooded with “Unknown permission status for class system”

I am trying to debug an issue, and I was wondering if this rings a bell to anyone: My logs get flooded with audit: type=1107 audit(1479418315.344:1053): pid=1 uid=0 auid=4294967295 ses=4294967295 ...
1
vote
0answers
353 views

sealert takes very long on centos7

I'm trying to human read /var/log/audit/audit.log file on centos7. I came with command sealert -a /var/log/audit/audit.log which works fine on one machine, there is initial scan which takes second ...
1
vote
2answers
783 views

Overlayroot: How to fully protect a Linux system against changes?

I would like to protect a system with overlayroot, so everything that is done - even by a user with root permission - will not survive a reboot. I found several guides how to do that, but none of them ...
1
vote
1answer
501 views

SELinux context for a file both Apache and Tomcat can read/write to?

What would be the correct context to use if we have Apache and Tomcat both installed on the system and need access to a particular file for read/write. Tomcat was installed using a source package and ...
1
vote
1answer
540 views

Mono crashes while SELinux enforced, How to get mono server worked while SELinux is enforced?

This is what happens when SELinux is enforced: [root@shadmin ~]# elinks --dump 127.0.0.1/ASP-Portal/index.aspx Service Temporarily Unavailable The server is temporarily ...
1
vote
0answers
496 views

What SELinux type should I apply on my Unix socket?

I have a Gunicorn socket file: /opt/rtd/gunicorn/run.sock. I need nginx to be able to open this socket and write to it. When I run sesearch --allow -s httpd_t | grep unix_stream_socket I noticed that ...
1
vote
0answers
240 views

Overwrite default selinux fcontext rules

I'm trying to overwrite default rule for public_html directory: /home/[^/]*/((www)|(web)|(public_html))(/.+)? unconfined_u:object_r:httpd_user_content_t:s0 Assigning the httpd_user_rw_content_t ...
1
vote
0answers
213 views

snv + http protocols with SElinux

I was asked to run the subversion with http and svn protocols on CentOS 7 os. Installed apache and subversion. The issue arises when apache and subversion are to access the repository. Apache works ...
1
vote
0answers
83 views

How do i configure NIS on Fedora 22?

I am trying to configure NIS client on Fedora 22. Following the tutorial http://www.server-world.info/en/note?os=Fedora_22&p=nis&f=2. I have to set SELinux=disable so that folders can be ...
1
vote
0answers
47 views

SELinux for in-house applications

I have a ruby application running on Puma, behind nginx. I want to use SELinux to mitigate the risk of it being used as an entry point to the rest of our system. I couldn't find any reference of ...
1
vote
1answer
855 views

selinux: rwx permissions for a folder

I am facing problems with PHP interface that calls perl and shell scripts. These enable uploading of a file to a folder and execute them with some input while storing output into some other files. Now ...
1
vote
0answers
761 views

semodule -i takes 100% cpu and does not end

I am setting up selinux and ran grep ${1} /var/log/audit/audit.log | audit2allow -r -M local_${1} within an compilation script (oneliner). I'd like to run it like "compile_selinux collectd_t" so it ...
1
vote
0answers
163 views

Selinux: Shorewall will not respond to fail2ban

I am using fail2ban with shorewall and my Fedora 21 server & cloud. All flooded with the following error message: SELinux is preventing shorewall from write access on the file /tmp/fai2ban*.[...
1
vote
1answer
32 views

SELinux - first attempt to restrict file by type - fails to fail

I have a Centos 6 Linux box. I read tutorials on SELinux and wanted to try it out. Here are steps I followed, set SELINUX=enforcing in /etc/selinux/config turned on SELINUX with setenforce 1 service ...
1
vote
0answers
200 views

How to power down Cloudstack configured with XenServer Hypervisors

I have three XenServers(6.2) configured in a single pool. I also have a Cloudstack (CentOS 6.5) Management interface controlling them all. Everything is up and running but I can not figure out how to ...