Questions tagged [selinux]

NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

Filter by
Sorted by
Tagged with
0 votes
2 answers
330 views

CentOS8 Stream - what is security context in files permissions and how it can affect access?

I did install some of my aspnet core apps on Linux before using CentOS8. This time I used CentOS8-Stream. I dont know if that contributes to the issue. The facts: I could not make apache use ...
Boppity Bop's user avatar
0 votes
1 answer
108 views

SELINUX : How to make child folder rule precedence higher than parent rule

SELINUX : How to make child folder rule precedence higher than parent rule eg : /home/kevinw/www/kp/storage(/.*)? all files system_u:object_r:httpd_sys_rw_content_t:s0 lost ...
Benyamin Limanto's user avatar
1 vote
0 answers
614 views

How to set SELinux to allow CGI script to create a file

I'm writing a CGI for httpd on CentOS 7, which create and write files on a directory under home. When I enable SELinux, it causes Internal Server Error. How can I setup SELinux? The command sudo ...
kamae's user avatar
  • 123
0 votes
1 answer
273 views

SELinux prevent connection clamd_port_t:tcp_socket

We have API Server (tomcat) which has clamAV configuration to scan any uploaded file to the system. clamAV configuration will require the API server to connect to clamAV server. SELinux is enabled on ...
MAAN SHARBAJI's user avatar
0 votes
0 answers
529 views

Tenable su+sudo and selinux

My Not-A-Sysadmin-Boss wants me to explain this but I can't really find an answer? When using TENABLE SC to scan a RHEL7 system the account used to do the scan connects via ssh then uses sudo to ...
user1548815's user avatar
0 votes
1 answer
616 views

SELinux Issue - git status fatal: Out of memory? mmap failed: Permission denied

I have Centos 7.9 server running with Apache and Git, however if I do a [root@a]# git status fatal: Out of memory? mmap failed: Permission denied But if Disable or Permissive the SE-Linux via below ...
mahen3d's user avatar
  • 4,422
0 votes
1 answer
818 views

CGroup not mounted on Fedora 34

I have freshly provisioned Linode instance with Fedora 34. The only thing I have installed on it is libcgroup. cgconfig service is starting properly and there are no errors but the subsystem is not ...
Albert Lilly's user avatar
2 votes
2 answers
2k views

SELinux - blocks postfix emails sending out from the Web Application

My System environment, is Centos-7.9, Apache2.4, Php-fpm, PHP-7.4 I have postfix setup to send emails from the website, which is working in stand-alone test emails and when I turn the SELinux off. ...
mahen3d's user avatar
  • 4,422
1 vote
1 answer
447 views

Permission denied for gitweb.cgi on CentOS

I've set up gitweb on my web server. I have created projects on the server. I can add commits to them and also clone them remotely. The gitweb "homepage" does display and the static files ...
carlitobrigante's user avatar
1 vote
0 answers
203 views

selinux - why can't stuff_u with sysadm_r run postsuper?

I am trying to understand how selinux confined users really work, but there are a few behaviours that I still can not understand. According to redhat SELinux User Capabilities stuff_u users should be ...
Jose's user avatar
  • 21
0 votes
1 answer
568 views

Allow Wordpress upgrades with SELinux in EL8 with nginx/php-fpm

I'm trying to allow the use of Wordpress upgrades (not plugin updates) directly on the web interface. I already have SELinux working for everything except this feature. When trying to nail down what ...
Vinícius Ferrão's user avatar
1 vote
0 answers
212 views

Where is mapping of __default__ user to unconfined_u defined in SELinux policy?

semanage login -l shows following mappings ~]# semanage login -l Login Name SELinux User MLS/MCS Range __default__ unconfined_u s0-s0:c0.c1023 ...
jlas's user avatar
  • 11
3 votes
0 answers
201 views

Why are docker permission errors not logged by selinux?

If you try to bind mount a directory into a container under Red Hat you might have problems with selinux. The directory will be unreadable from inside the container. Unless you add a z/Z volume option....
x-yuri's user avatar
  • 2,280
0 votes
1 answer
190 views

Unable to update to Wordpress 5.7.2: Could not copy file

I'm trying to update to the latest (5.7.2) version of Wordpress from a fresh installation on CentOS 7, however I keep getting the error message Could not copy file.: wp-admin/images/about-color-...
MorayM's user avatar
  • 159
1 vote
1 answer
2k views

SetroubleshootPrivileged.py using 95% CPU | Centos 8 server

I have been battling with this issue for weeks. I have a Linode with a Centos 8 server. An application called "SetroubleshootPrivileged.py" is eating all the resources. "setroubleshootd&...
Erus's user avatar
  • 21
0 votes
1 answer
370 views

Unable to create selinux policy to allow drbdadm to run

In snmpd.conf I have exec drbd_cstate /sbin/drbdadm cstate all exec drbd_role /sbin/drbdadm role all exec drbd_state /sbin/drbdadm dstate all With selinux set to permissive if I were to run the SNMP ...
Dovid Bender's user avatar
3 votes
0 answers
431 views

CentOS Linux 8 freezes when changing SELinux Booleans (setsebool)

Problem Various CentOS Linux 8 servers freeze/hang when changing SELinux Booleans. Details and research We manage hundreds of CentOS Linux servers. Lately we see deviant behavior on some (but not all) ...
acropia's user avatar
  • 51
1 vote
0 answers
196 views

What makes a selinux-caused EACCESS to not be logged in audit

I've got a system with samba running with standard targetted policy for Fedora. At some point samba is trying to access a directory tagged unconfined_u:object_r:unlabeled_t:s0 and fails. Through ...
viraptor's user avatar
  • 1,306
0 votes
1 answer
415 views

Unable to open PHP script files, even though I own them and have permissions

I'm using RHEL 8, and I have run into a crazy problem. My user account is unable to open PHP files. If I have a file, owned by my user, and readable by my user, and I add <?php as the first line, ...
Nick2253's user avatar
  • 141
2 votes
1 answer
2k views

Linux "ls -Z" shows question mark for security context

I've got some files that aren't being served on a site, and assuming it was a permissions issue I ran ls -Z but keep seeing ? in place of the security context: -rw-rw-r-- pete pete ? ...
Pete's user avatar
  • 303
0 votes
1 answer
2k views

How do I install `setroubleshoot-server` (sealert)

I am looking to use sealert on my Debian env. I am unable to find the package to install to have it and the source code.
jnbdz's user avatar
  • 947
2 votes
1 answer
925 views

SELinux setting httpd_can_network_relay to on throws error, "could not convert system_u:object_r:systemd_sleep_exec_t:s0 to sid". How is this fixed?

Environment: Digital Ocean Droplet, CentOS 8 The State of httpd_can_network_relay is set to on. However the Default is set to off. $ sudo semanage boolean -l | grep httpd_can_network_relay ...
myNewAccount's user avatar
1 vote
0 answers
858 views

Correct SELinux labels for a kvm/qemu user session VM shared folder

I am trying to set up a shared folder using the 9p protocol for a kvm/qemu VM that runs on the user session (so the qemu process runs as me, not as root). Mounting the shared folder in guest works ...
Simon's user avatar
  • 255
2 votes
1 answer
4k views

Create selinux context for systemd script?

I'm trying to create a systemd service that executes a custom script I wrote. It is just a backup script that I am using with a systemd timer. When I try to execute something simple in the systemd ...
user615862's user avatar
1 vote
1 answer
419 views

SELinux : Where I find selinux policy for google-chrome on Fedora Linux?

How do I find all the SELinux policies used for Google Chrome on Fedora Linux?
Cătălin George Feștilă's user avatar
0 votes
2 answers
824 views

selinux audit rule not logging anything

I am trying to audit a directory tree for read, write, and permissions change. I created the rule using auditctl -w <path> -k media-watch, but ausearch -k media-watch only shows the creation (or ...
RedTedRedemption's user avatar
2 votes
1 answer
1k views

What is Apache trying to do with port 80 that SELinux is blocking?

I have a small web server (CentOS 8) that runs a small php & mysql app. It also runs runs Nagios, BIND, and Postfix running as a secondary MX. Everything seems to "work", and I've never ...
David W's user avatar
  • 3,459
0 votes
0 answers
77 views

Why might SELinux issue a Permission Denied error when accessing an upstream Node.js server's default routes, but not static files like image files? [duplicate]

Environment: Nginx reverse proxy serving static resources and using proxy_pass to serve resources from 2 separate Node.js upstream server instances. Simplified example nginx.conf: server { ...
stackedAndOverflowed's user avatar
-1 votes
1 answer
70 views

Resetting lost root-pwd on CentOS 8 just don't work

i just don't know. I have reset lost root-pwds on Linux boxes maybe 5 times a year in the 30 years experience as IT-Admin, but this time i#m just confused. I just don't manage to login on my CentOS ...
Chris9834's user avatar
  • 181
2 votes
1 answer
527 views

svnserve with selinux on nfs mount unable to start (Centos8)

might be a silly question. Struggling with my subversion server on a Centos8 with selinux enforced. We have an NFS mount to store the data (/mnt/data/svn). The problem (when selinux is in enforcement ...
Reto Stauffer's user avatar
0 votes
1 answer
272 views

Centos8: Selinux blocking Samba service from starting

My Samba4 service is being blocked from starting using systemctl. The audit log shows: type=AVC msg=audit(1606428851.446:87): avc: denied { execute } for pid=1748 comm="(samba)" name=&...
Paul Paku's user avatar
  • 151
1 vote
1 answer
2k views

Ansible module for adding an SELinux context equivalence

Is there an Ansible module that allows an SELinux context equivalence to be added? The command is: semanage fcontext -a -e /home/xxx /srv/xxx This makes SELinux treat /srv/xxx as equivalent to /home/...
Richard Fearn's user avatar
1 vote
1 answer
20k views

selinux what are the differences between setenforce 0 to permanent selinux

regarding to selinux and according to some Hadoop recommendation selinux must be disabled about selinux - more info in https://www.ibm.com/support/knowledgecenter/STXKQY_BDA_SHR/bl1bda_selinux.htm we ...
sheffadmin's user avatar
0 votes
2 answers
2k views

SELinux blocking Samba access to mounted volume despite samba_share_t

I repurposed an old AMD A10 APU-based machine that was collecting dust in my basement to act as a NAS, and eventually some other light-duty tech work. It's running CentOS 8.1, the boot disk is a 340GB ...
p0lar_bear's user avatar
0 votes
1 answer
2k views

Changing SELinux file contexts over NFS

I would like to change SELinux labels on a NFS-mounted shared directory. Here is my setup (using virtual machines): I have two machines running CentOS 7. One of them (the server) exports a directory ...
Holger's user avatar
  • 19
2 votes
1 answer
1k views

Permission error when Nagios user runs a bash script, also with sudo

I want to poweroff my NAS and ESXI when there is a power failure. Both of the system run on a Eaton UPS. I only run Linux systems and therefore I can not use the Eaton Manager, Windows only. Since I ...
aPugLife's user avatar
  • 287
0 votes
1 answer
831 views

SELinux Permissions Error on Fedora 32

I am getting this error repeatedly while trying to run Nextcloud on Fedora 32 type=AVC msg=audit(1601229230.944:718): avc: denied { connectto } for pid=584 comm="php-fpm" path="/var/...
navjotjsingh's user avatar
0 votes
1 answer
1k views

How to list the capabilities associated with a process in *nix systems?

From - man capabilities UNIX implementations distinguish two categories of processes: privileged processes (whose effective user ID is 0, referred to as superuser or root), and unprivileged processes ...
samshers's user avatar
  • 238
1 vote
1 answer
191 views

Configure CentOS to allow executables to create and write files in dedicated directory

I have a web app that receives, stores, and processes files using AI algorithms implemented in Python. The web app is developed in server-side scripting language, but when invoking the Python programs ...
DannyNiu's user avatar
  • 121
3 votes
1 answer
2k views

Again enabled SELINUX and now the user logins wont work in enforcing mode

I enabled the SELINUX again on my CentOS 8.2 installation. And now the logins wont work, neither by ssh or direct. To login i have to make the mode to permissive. the secure log shows as below. #login ...
Vipin Jain's user avatar
0 votes
0 answers
43 views

Centos OS7 not receiving user context from FreeIPA

Hopefully there is something simple I am missing here. I have FreeIPA 4.6.6 (can not update at this time), Centos 7 and Centos 6 systems. SELinux is in permissive mode. Logins on the Centos 6 system ...
Wydnesdae's user avatar
1 vote
0 answers
2k views

Slab UnReclaimable Using 14GB

I need help to understand what is this slab unreclaimable memory usage, I know that is related to cache. Here is the output of /proc/meminfo cat /proc/meminfo MemTotal: 23373884 kB MemFree: ...
Gabriel carvalho's user avatar
2 votes
2 answers
876 views

Allow Samba and Podman to rw on same dir

I'm new to SElinux so I don't know much about how to use it. I want to run my Fedora Server using a samba share (already configured and working) and configured a podman container, mounting the same ...
Michael Hirschler's user avatar
0 votes
1 answer
339 views

How do I find location of file that 'sealert' is referencing in it's output and suggestions?

I've been able to figure this out a little easier in the past just due to the context but this one has me stumped. When I run sealert -a /var/log/audit/audit.log and get the typical output such as... ...
oucil's user avatar
  • 598
2 votes
1 answer
2k views

OpenVPN with PAM with systemd and SELinux

I am trying to set up an OpenVPN (2.4.9) server with PAM login on CentOS 8.2 and I am facing some strange issues. Specifically, i can successfully athenticate if I start the server with the ExecStart ...
check's user avatar
  • 51
0 votes
1 answer
5k views

How to enable selinux for a custom port

We have a service mapped to the web application. So, we need to allow 80 port and 16700 for its backend service. During login, it will connect to this service for authentication and other parts of ...
Uday Kiran Reddy's user avatar
0 votes
1 answer
1k views

Httpd and selinux - change root dir

I have problem with my centos 7 server and httpd. I have already install http, but i need change home dir from /var/www/html to /home/pawel/domains. I added vhost: <VirtualHost *:80> ...
PawelC's user avatar
  • 179
-1 votes
2 answers
10k views

How much does httpd_can_network_connect being set to 1 actually open up on SELinux

I am getting the following SELinux denied lines in my log file when I attempt to redirect a user to Paypal to checkout. Would you please help me understand what it means and what exceptions I should ...
J W's user avatar
  • 11
0 votes
0 answers
1k views

PiHole container on Podman fails to start with SELinux enabled on Fedora 31

I'm trying to get PiHole up and running using Podman on Fedora 31 Server. When I set SELinux to Permissive mode, and I use the following command, everything works perfectly. sudo podman run -d --...
distortedsignal's user avatar
0 votes
1 answer
4k views

SELINUX sysadm_u and SSH - Unable to get valid context for username

Once I set user usernameto sysadm_u they are no longer able to login via SSH and receive the error: Unable to get valid context for username Commands semanage login -m -s sysadm_u username semanage ...
Michael Hobbs's user avatar

1
2
3 4 5
14