39
votes
Accepted
SElinux error :ValueError: Port tcp/5000 already defined
So I found that another service had a defined status for TCP port 5000.
But by replacing the -a option with -m for modify, added tcp port 5000 to http_port_t
So the command that worked was:
# ...
34
votes
Accepted
How to enable SELinux inside of a CentOS Docker container?
SELinux is not namespaced, so individual containers cannot have their own separate SELinux policies. SELinux will always appear to be "disabled" in a container, though it is running on the host.
If ...
- 241k
27
votes
How can I tell SELinux to permit nginx access to a unix socket without audit2allow?
It seems ridiculous that you can't set up a policy that allows nginx to write to a socket without first having an attempt denied and then running a tool that enables things that were denied.
Well no, ...
- 115k
22
votes
SELinux preventing Apache from writing to a file
As already stated, you should instruct SELINUX to allow writing to that file. The right thing to do is to mark /var/www/webapp/k/site/ as of type httpd_sys_rw_content_t
To permanently mark that ...
- 45.5k
22
votes
SElinux: allow httpd to connect to a specific port
You may need to use
semanage port -m -t http_port_t -p tcp 6379
If semanage is missing then add the package policycoreutils-python
yum install policycoreutils-python
- 395
18
votes
Accepted
SELinux reset root password
I was able to duplicate this issue in a freshly installed CentOS 7.5 system.
Here is what is happening:
When you boot with init=/bin/bash there are two issues you may run into:
The root filesystem ...
- 241k
16
votes
Why is selinux blocking remote ssh access without a password?
There is a short article on this issue. It says that
may be because the SELinux contexts have not been correctly set on the .ssh folder and authorized keys file [...] The way to fix this is to run
...
- 291
13
votes
Vsftpd passive reply with 0,0,0,0 address even with correct pasv_address
It looks like a bug in vsftpd to me.
From the code, it looks like, vsftpd always sends the 0,0,0,0, if the public pasv_address is set, and the server has a (local) IPv6 address.
To fix this, make sure ...
- 7,564
13
votes
Accepted
How do I remove a SELinux module in CentOS?
semodule -r expects the module name, rather than a filename.
So it would be something like:
semodule -r opendkim
Or whatever name you gave the module when defining it.
- 241k
11
votes
Home directories created with wrong Selinux context
Adding to this question for future people who may come across it. If you are putting home directories on an NFS share, you will need to set the correct SELinux context. Assuming your nfs home ...
- 341
11
votes
SElinux error :ValueError: Port tcp/5000 already defined
On the systems I have to hand (C6, C7 and F24), tcp port 5000 has an SELinux context of commplex_port_t. This will be why, when you try to add it you get the error message
/usr/sbin/semanage: Port ...
- 115k
11
votes
Why is selinux blocking remote ssh access without a password?
In cases where restorecon -R -v ~/.ssh does not work, and SELinux is to blame per sealert or audit2allow reports, and when the SELinux contexts for the .ssh folder are altered, the following can fix ...
- 434
10
votes
RHEL SELinux blocking Apache access to PostgreSQL
For future readers, for me, just setting the bool to allow httpd to make DB connections was sufficient; i.e.:
setsebool -P httpd_can_network_connect_db 1
You can check/verify that the setting is set ...
- 637
10
votes
Accepted
SELinux prevents Nginx from reading file
SELinux is denying you access to the file, since you moved instead of copied it from somewhere else on the filesystem into its final location. Thus it kept its original security context, which didn't ...
- 241k
9
votes
Accepted
Enable SELinux on Centos7 LXC container with Ubuntu 14.04 host
Selinux needs to be running in your physical host, because Selinux runs in the kernel side and your container share the kernel with physical host.
Container is a normal process that run in other ...
- 5,209
9
votes
Accepted
Why is selinux blocking remote ssh access without a password?
You are quick to jump on SELinux....are you sure you have /etc/ssh/sshd_config properly set to allow root access via ssh? Have you restarted the sshd service if you have made any changes to the ...
- 11.8k
9
votes
SELinux will not disable on CentOS7
After editing file /etc/sysconfig/selinux, for the changes to take effect, you need to reboot your system to get SELinux fully disabled. You can do setenforce 0 to get the system into "permissive" ...
- 91
8
votes
Accepted
How to disallow the Docker Daemon to mount host's root file system into the container
SELinux will prevent anything not correctly labelled to be mounted as a volume inside a docker container, as proof, here using a single file, same policy applies to directories:
$ sestatus
SELinux ...
- 15k
8
votes
Accepted
SELinux: How to undo/revert semanage permissive -a httpd_t?
I would try
semanage permissive -d httpd_t
as the idiot fm says
-d, --delete Delete a record of the specified object type
- 115k
7
votes
SELinux preventing Apache from writing to a file
This will change the permissions:
chcon --type httpd_sys_rw_content_t /var/www/webapp/k/site/k.log
- 181
7
votes
CentOS - semanage - Adding Custom Port Fails
Had a very similar problem on Digital Ocean. Some VM hosts (Digital Ocean, AWS, Rackspace) may NOT have swap space enabled by default, which apparently causes semanage to get killed.
On the CentOS 7 ...
7
votes
Accepted
Unable to enable custom SELinux rule
I think this is caused because there will already be a logrotate.pp file on the system (/etc/selinux/targeted/modules/active/modules/logrotate.pp).
You should create your local policy with a ...
- 115k
7
votes
Accepted
ValueError: Type http_sys_content_t is invalid, must be a file or device type
You just need to fix your typo.
You entered:
http_sys_content_t
But it is correctly:
httpd_sys_content_t
- 241k
7
votes
Accepted
CentOS 7 - Directories created through VSFTPD not inheriting SELinux contexts
There is a difference between default labelling that occurs at runtime and the regular expression based post-labelling policy that applies on the server.
What you are noting here:
/var/www/html(/.*)?...
- 23.2k
7
votes
Accepted
Boolean ftp_home_dir is not defined - RHEL7.3
Red Hat's Official Response:
On further investigation, I have found that mentioned booblean was removed on RHEL 7.3.
We have already filed a bugzilla for the same, BZ:1406542
https://...
- 123
6
votes
Why isn't my cronjob running?
A home directory must be set for the user. If the user doesn't have one, you can specify it directly in the cron.d-file.
You probably need to provide PATH=/usr/bin/ too, or specify full path for the ...
- 233
6
votes
Accepted
Moved /home to new disk, SELinux denying access to /home for sshd
You aren't looking at the right directories.
Your AVC denials are complaining specifically about the contexts on / and /home respectively, not on any file within them.
This makes me suspect that you ...
- 241k
6
votes
Accepted
SELinux file path context not working with regex
Try using
HOME_DIR/\.google_authenticator -- gen_context(system_u:object_r:radiusd_google_authenticator_t,s0)
Instead. Home directories aren't necessarily in /home and this acts as a macro when you ...
- 23.2k
6
votes
Accepted
Why won't MariaDB start after upgrade (NO_NEW_PRIVILEGES)
With help from #debian-next I found out the problem was probably in the digitalocean custom kernel.
Upon checking it turned out I was using a not very recent kernel – 3.2.0-4, but after selecting a ...
- 245
6
votes
Why is selinux blocking remote ssh access without a password?
In my case was looking into
root#> journalctl -f
then tell SELinux that use to nfs home dirs is allowed:
root#> setsebool -P use_nfs_home_dirs 1
This solve my problem.
- 61
Only top scored, non community-wiki answers of a minimum length are eligible