Questions tagged [selinux]
NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.
691
questions
0
votes
2
answers
330
views
CentOS8 Stream - what is security context in files permissions and how it can affect access?
I did install some of my aspnet core apps on Linux before using CentOS8. This time I used CentOS8-Stream. I dont know if that contributes to the issue.
The facts:
I could not make apache use ...
0
votes
1
answer
108
views
SELINUX : How to make child folder rule precedence higher than parent rule
SELINUX : How to make child folder rule precedence higher than parent rule
eg :
/home/kevinw/www/kp/storage(/.*)? all files system_u:object_r:httpd_sys_rw_content_t:s0
lost ...
1
vote
0
answers
614
views
How to set SELinux to allow CGI script to create a file
I'm writing a CGI for httpd on CentOS 7, which create and write files on a directory under home.
When I enable SELinux, it causes Internal Server Error. How can I setup SELinux?
The command sudo ...
0
votes
1
answer
273
views
SELinux prevent connection clamd_port_t:tcp_socket
We have API Server (tomcat) which has clamAV configuration to scan any uploaded file to the system.
clamAV configuration will require the API server to connect to clamAV server.
SELinux is enabled on ...
0
votes
0
answers
529
views
Tenable su+sudo and selinux
My Not-A-Sysadmin-Boss wants me to explain this but I can't really find an answer? When using TENABLE SC to scan a RHEL7 system the account used to do the scan connects via ssh then uses sudo to ...
0
votes
1
answer
616
views
SELinux Issue - git status fatal: Out of memory? mmap failed: Permission denied
I have Centos 7.9 server running with Apache and Git, however if I do a
[root@a]# git status
fatal: Out of memory? mmap failed: Permission denied
But if Disable or Permissive the SE-Linux via below ...
0
votes
1
answer
818
views
CGroup not mounted on Fedora 34
I have freshly provisioned Linode instance with Fedora 34. The only thing I have installed on it is libcgroup. cgconfig service is starting properly and there are no errors but the subsystem is not ...
2
votes
2
answers
2k
views
SELinux - blocks postfix emails sending out from the Web Application
My System environment, is Centos-7.9, Apache2.4, Php-fpm, PHP-7.4
I have postfix setup to send emails from the website, which is working in stand-alone test emails and when I turn the SELinux off.
...
1
vote
1
answer
447
views
Permission denied for gitweb.cgi on CentOS
I've set up gitweb on my web server. I have created projects on the server. I can add commits to them and also clone them remotely.
The gitweb "homepage" does display and the static files ...
1
vote
0
answers
203
views
selinux - why can't stuff_u with sysadm_r run postsuper?
I am trying to understand how selinux confined users really work, but there are a few behaviours that I still can not understand.
According to redhat
SELinux User Capabilities
stuff_u users should be ...
0
votes
1
answer
568
views
Allow Wordpress upgrades with SELinux in EL8 with nginx/php-fpm
I'm trying to allow the use of Wordpress upgrades (not plugin updates) directly on the web interface.
I already have SELinux working for everything except this feature. When trying to nail down what ...
1
vote
0
answers
212
views
Where is mapping of __default__ user to unconfined_u defined in SELinux policy?
semanage login -l shows following mappings
~]# semanage login -l
Login Name SELinux User MLS/MCS Range
__default__ unconfined_u s0-s0:c0.c1023
...
3
votes
0
answers
201
views
Why are docker permission errors not logged by selinux?
If you try to bind mount a directory into a container under Red Hat you might have problems with selinux. The directory will be unreadable from inside the container. Unless you add a z/Z volume option....
0
votes
1
answer
190
views
Unable to update to Wordpress 5.7.2: Could not copy file
I'm trying to update to the latest (5.7.2) version of Wordpress from a fresh installation on CentOS 7, however I keep getting the error message
Could not copy file.: wp-admin/images/about-color-...
1
vote
1
answer
2k
views
SetroubleshootPrivileged.py using 95% CPU | Centos 8 server
I have been battling with this issue for weeks.
I have a Linode with a Centos 8 server.
An application called "SetroubleshootPrivileged.py" is eating all the resources.
"setroubleshootd&...
0
votes
1
answer
370
views
Unable to create selinux policy to allow drbdadm to run
In snmpd.conf I have
exec drbd_cstate /sbin/drbdadm cstate all
exec drbd_role /sbin/drbdadm role all
exec drbd_state /sbin/drbdadm dstate all
With selinux set to permissive if I were to run the SNMP ...
3
votes
0
answers
431
views
CentOS Linux 8 freezes when changing SELinux Booleans (setsebool)
Problem
Various CentOS Linux 8 servers freeze/hang when changing SELinux Booleans.
Details and research
We manage hundreds of CentOS Linux servers. Lately we see deviant behavior on some (but not all) ...
1
vote
0
answers
196
views
What makes a selinux-caused EACCESS to not be logged in audit
I've got a system with samba running with standard targetted policy for Fedora.
At some point samba is trying to access a directory tagged unconfined_u:object_r:unlabeled_t:s0 and fails. Through ...
0
votes
1
answer
415
views
Unable to open PHP script files, even though I own them and have permissions
I'm using RHEL 8, and I have run into a crazy problem. My user account is unable to open PHP files.
If I have a file, owned by my user, and readable by my user, and I add <?php as the first line, ...
2
votes
1
answer
2k
views
Linux "ls -Z" shows question mark for security context
I've got some files that aren't being served on a site, and assuming it was a permissions issue I ran ls -Z but keep seeing ? in place of the security context:
-rw-rw-r-- pete pete ? ...
0
votes
1
answer
2k
views
How do I install `setroubleshoot-server` (sealert)
I am looking to use sealert on my Debian env.
I am unable to find the package to install to have it and the source code.
2
votes
1
answer
925
views
SELinux setting httpd_can_network_relay to on throws error, "could not convert system_u:object_r:systemd_sleep_exec_t:s0 to sid". How is this fixed?
Environment: Digital Ocean Droplet, CentOS 8
The State of httpd_can_network_relay is set to on. However the Default is set to off.
$ sudo semanage boolean -l | grep httpd_can_network_relay
...
1
vote
0
answers
858
views
Correct SELinux labels for a kvm/qemu user session VM shared folder
I am trying to set up a shared folder using the 9p protocol for a kvm/qemu VM that runs on the user session (so the qemu process runs as me, not as root). Mounting the shared folder in guest works ...
2
votes
1
answer
4k
views
Create selinux context for systemd script?
I'm trying to create a systemd service that executes a custom script I wrote. It is just a backup script that I am using with a systemd timer. When I try to execute something simple in the systemd ...
1
vote
1
answer
419
views
SELinux : Where I find selinux policy for google-chrome on Fedora Linux?
How do I find all the SELinux policies used for Google Chrome on Fedora Linux?
0
votes
2
answers
824
views
selinux audit rule not logging anything
I am trying to audit a directory tree for read, write, and permissions change. I created the rule using auditctl -w <path> -k media-watch, but ausearch -k media-watch only shows the creation (or ...
2
votes
1
answer
1k
views
What is Apache trying to do with port 80 that SELinux is blocking?
I have a small web server (CentOS 8) that runs a small php & mysql app. It also runs runs Nagios, BIND, and Postfix running as a secondary MX.
Everything seems to "work", and I've never ...
0
votes
0
answers
77
views
Why might SELinux issue a Permission Denied error when accessing an upstream Node.js server's default routes, but not static files like image files? [duplicate]
Environment: Nginx reverse proxy serving static resources and using proxy_pass to serve resources from 2 separate Node.js upstream server instances.
Simplified example nginx.conf:
server {
...
-1
votes
1
answer
70
views
Resetting lost root-pwd on CentOS 8 just don't work
i just don't know. I have reset lost root-pwds on Linux boxes maybe 5 times a year in the 30 years experience as IT-Admin, but this time i#m just confused.
I just don't manage to login on my CentOS ...
2
votes
1
answer
527
views
svnserve with selinux on nfs mount unable to start (Centos8)
might be a silly question. Struggling with my subversion server on a Centos8 with selinux enforced. We have an NFS mount to store the data (/mnt/data/svn).
The problem (when selinux is in enforcement ...
0
votes
1
answer
272
views
Centos8: Selinux blocking Samba service from starting
My Samba4 service is being blocked from starting using systemctl. The audit log shows:
type=AVC msg=audit(1606428851.446:87): avc: denied { execute } for pid=1748 comm="(samba)"
name=&...
1
vote
1
answer
2k
views
Ansible module for adding an SELinux context equivalence
Is there an Ansible module that allows an SELinux context equivalence to be added? The command is:
semanage fcontext -a -e /home/xxx /srv/xxx
This makes SELinux treat /srv/xxx as equivalent to /home/...
1
vote
1
answer
20k
views
selinux what are the differences between setenforce 0 to permanent selinux
regarding to selinux and according to some Hadoop recommendation selinux must be disabled
about selinux - more info in https://www.ibm.com/support/knowledgecenter/STXKQY_BDA_SHR/bl1bda_selinux.htm
we ...
0
votes
2
answers
2k
views
SELinux blocking Samba access to mounted volume despite samba_share_t
I repurposed an old AMD A10 APU-based machine that was collecting dust in my basement to act as a NAS, and eventually some other light-duty tech work. It's running CentOS 8.1, the boot disk is a 340GB ...
0
votes
1
answer
2k
views
Changing SELinux file contexts over NFS
I would like to change SELinux labels on a NFS-mounted shared directory.
Here is my setup (using virtual machines):
I have two machines running CentOS 7. One of them (the server) exports a directory ...
2
votes
1
answer
1k
views
Permission error when Nagios user runs a bash script, also with sudo
I want to poweroff my NAS and ESXI when there is a power failure. Both of the system run on a Eaton UPS.
I only run Linux systems and therefore I can not use the Eaton Manager, Windows only.
Since I ...
0
votes
1
answer
831
views
SELinux Permissions Error on Fedora 32
I am getting this error repeatedly while trying to run Nextcloud on Fedora 32
type=AVC msg=audit(1601229230.944:718): avc: denied { connectto } for pid=584 comm="php-fpm" path="/var/...
0
votes
1
answer
1k
views
How to list the capabilities associated with a process in *nix systems?
From - man capabilities
UNIX implementations distinguish two categories of processes:
privileged processes (whose effective user ID is 0, referred to as
superuser or root), and unprivileged processes ...
1
vote
1
answer
191
views
Configure CentOS to allow executables to create and write files in dedicated directory
I have a web app that receives, stores, and processes files using AI algorithms implemented in Python. The web app is developed in server-side scripting language, but when invoking the Python programs ...
3
votes
1
answer
2k
views
Again enabled SELINUX and now the user logins wont work in enforcing mode
I enabled the SELINUX again on my CentOS 8.2 installation.
And now the logins wont work, neither by ssh or direct.
To login i have to make the mode to permissive.
the secure log shows as below.
#login ...
0
votes
0
answers
43
views
Centos OS7 not receiving user context from FreeIPA
Hopefully there is something simple I am missing here.
I have FreeIPA 4.6.6 (can not update at this time), Centos 7 and Centos 6 systems.
SELinux is in permissive mode. Logins on the Centos 6 system ...
1
vote
0
answers
2k
views
Slab UnReclaimable Using 14GB
I need help to understand what is this slab unreclaimable memory usage, I know that is related to cache.
Here is the output of /proc/meminfo
cat /proc/meminfo
MemTotal: 23373884 kB
MemFree: ...
2
votes
2
answers
876
views
Allow Samba and Podman to rw on same dir
I'm new to SElinux so I don't know much about how to use it. I want to run my Fedora Server using a samba share (already configured and working) and configured a podman container, mounting the same ...
0
votes
1
answer
339
views
How do I find location of file that 'sealert' is referencing in it's output and suggestions?
I've been able to figure this out a little easier in the past just due to the context but this one has me stumped. When I run sealert -a /var/log/audit/audit.log and get the typical output such as...
...
2
votes
1
answer
2k
views
OpenVPN with PAM with systemd and SELinux
I am trying to set up an OpenVPN (2.4.9) server with PAM login on CentOS 8.2 and I am facing some strange issues.
Specifically, i can successfully athenticate if I start the server with the ExecStart ...
0
votes
1
answer
5k
views
How to enable selinux for a custom port
We have a service mapped to the web application.
So, we need to allow 80 port and 16700 for its backend service.
During login, it will connect to this service for authentication and other parts of ...
0
votes
1
answer
1k
views
Httpd and selinux - change root dir
I have problem with my centos 7 server and httpd. I have already install http, but i need change home dir from /var/www/html to /home/pawel/domains. I added vhost:
<VirtualHost *:80>
...
-1
votes
2
answers
10k
views
How much does httpd_can_network_connect being set to 1 actually open up on SELinux
I am getting the following SELinux denied lines in my log file when I attempt to redirect a user to Paypal to checkout. Would you please help me understand what it means and what exceptions I should ...
0
votes
0
answers
1k
views
PiHole container on Podman fails to start with SELinux enabled on Fedora 31
I'm trying to get PiHole up and running using Podman on Fedora 31 Server.
When I set SELinux to Permissive mode, and I use the following command, everything works perfectly.
sudo podman run -d --...
0
votes
1
answer
4k
views
SELINUX sysadm_u and SSH - Unable to get valid context for username
Once I set user usernameto sysadm_u they are no longer able to login via SSH and receive the error: Unable to get valid context for username
Commands
semanage login -m -s sysadm_u username
semanage ...