Hot answers tagged

41 votes
Accepted

SElinux error :ValueError: Port tcp/5000 already defined

So I found that another service had a defined status for TCP port 5000. But by replacing the -a option with -m for modify, added tcp port 5000 to http_port_t So the command that worked was: # ...
panickedprocrastinator's user avatar
34 votes
Accepted

How to enable SELinux inside of a CentOS Docker container?

SELinux is not namespaced, so individual containers cannot have their own separate SELinux policies. SELinux will always appear to be "disabled" in a container, though it is running on the host. If ...
Michael Hampton's user avatar
27 votes

How can I tell SELinux to permit nginx access to a unix socket without audit2allow?

It seems ridiculous that you can't set up a policy that allows nginx to write to a socket without first having an attempt denied and then running a tool that enables things that were denied. Well no, ...
user9517's user avatar
  • 116k
19 votes

Why is selinux blocking remote ssh access without a password?

There is a short article on this issue. It says that may be because the SELinux contexts have not been correctly set on the .ssh folder and authorized keys file [...] The way to fix this is to run ...
John Smith's user avatar
19 votes
Accepted

SELinux reset root password

I was able to duplicate this issue in a freshly installed CentOS 7.5 system. Here is what is happening: When you boot with init=/bin/bash there are two issues you may run into: The root filesystem ...
Michael Hampton's user avatar
16 votes
Accepted

How do I remove a SELinux module in CentOS?

semodule -r expects the module name, rather than a filename. So it would be something like: semodule -r opendkim Or whatever name you gave the module when defining it.
Michael Hampton's user avatar
13 votes

Vsftpd passive reply with 0,0,0,0 address even with correct pasv_address

It looks like a bug in vsftpd to me. From the code, it looks like, vsftpd always sends the 0,0,0,0, if the public pasv_address is set, and the server has a (local) IPv6 address. To fix this, make sure ...
Martin Prikryl's user avatar
12 votes

Why is selinux blocking remote ssh access without a password?

In cases where restorecon -R -v ~/.ssh does not work, and SELinux is to blame per sealert or audit2allow reports, and when the SELinux contexts for the .ssh folder are altered, the following can fix ...
kbulgrien's user avatar
  • 446
11 votes

SElinux error :ValueError: Port tcp/5000 already defined

On the systems I have to hand (C6, C7 and F24), tcp port 5000 has an SELinux context of commplex_port_t. This will be why, when you try to add it you get the error message /usr/sbin/semanage: Port ...
user9517's user avatar
  • 116k
11 votes
Accepted

SELinux prevents Nginx from reading file

SELinux is denying you access to the file, since you moved instead of copied it from somewhere else on the filesystem into its final location. Thus it kept its original security context, which didn't ...
Michael Hampton's user avatar
11 votes
Accepted

Why is selinux blocking remote ssh access without a password?

You are quick to jump on SELinux....are you sure you have /etc/ssh/sshd_config properly set to allow root access via ssh? Have you restarted the sshd service if you have made any changes to the ...
mdpc's user avatar
  • 11.9k
9 votes
Accepted

SELinux: How to undo/revert semanage permissive -a httpd_t?

I would try semanage permissive -d httpd_t as the idiot fm says -d, --delete Delete a record of the specified object type
user9517's user avatar
  • 116k
9 votes

SELinux will not disable on CentOS7

After editing file /etc/sysconfig/selinux, for the changes to take effect, you need to reboot your system to get SELinux fully disabled. You can do setenforce 0 to get the system into "permissive" ...
Jino Pl's user avatar
  • 91
8 votes
Accepted

ValueError: Type http_sys_content_t is invalid, must be a file or device type

You just need to fix your typo. You entered: http_sys_content_t But it is correctly: httpd_sys_content_t
Michael Hampton's user avatar
8 votes
Accepted

How to disallow the Docker Daemon to mount host's root file system into the container

SELinux will prevent anything not correctly labelled to be mounted as a volume inside a docker container, as proof, here using a single file, same policy applies to directories: $ sestatus SELinux ...
dawud's user avatar
  • 15.2k
8 votes
Accepted

SELinux blocking execution in systemd unit

It turns out SELinux has an idea that binaries can only be executed from certain locations and my custom directory was not explicitly marked as allowed. It inherited the type var_t from /srv/.* (I ...
runfalk's user avatar
  • 261
8 votes
Accepted

How to log executions of specific commands on Linux no matter where it came from?

You can use auditd and monitor file operations/system calls to remove files/directories. The rules will be something like: -a exit,always -S unlink -S rmdir -k Remove_dir_file Of course you can add ...
Romeo Ninov's user avatar
  • 5,908
7 votes
Accepted

CentOS 7 - Directories created through VSFTPD not inheriting SELinux contexts

There is a difference between default labelling that occurs at runtime and the regular expression based post-labelling policy that applies on the server. What you are noting here: /var/www/html(/.*)?...
Matthew Ife's user avatar
  • 23.5k
7 votes
Accepted

Boolean ftp_home_dir is not defined - RHEL7.3

Red Hat's Official Response: On further investigation, I have found that mentioned booblean was removed on RHEL 7.3. We have already filed a bugzilla for the same, BZ:1406542 https://...
Mr.J's user avatar
  • 123
7 votes

Why is selinux blocking remote ssh access without a password?

I had this problem on CentOS 7. I am a regular Debian-based Linux user so I was a fish out of the water. I noticed that in some of the servers it worked and in just one it didn't. The audit.log said ...
hanzo2001's user avatar
  • 213
7 votes

SELinux blocking execution in systemd unit

We were facing similar problem when we wanted to start celery from systemd. By following below steps it solved the problem: sudo semanage fcontext -a -t bin_t '/home/\<logged in user\>/.local/...
cshell's user avatar
  • 71
6 votes
Accepted

SELinux file path context not working with regex

Try using HOME_DIR/\.google_authenticator -- gen_context(system_u:object_r:radiusd_google_authenticator_t,s0) Instead. Home directories aren't necessarily in /home and this acts as a macro when you ...
Matthew Ife's user avatar
  • 23.5k
6 votes
Accepted

Why won't MariaDB start after upgrade (NO_NEW_PRIVILEGES)

With help from #debian-next I found out the problem was probably in the digitalocean custom kernel. Upon checking it turned out I was using a not very recent kernel – 3.2.0-4, but after selecting a ...
Spikolynn's user avatar
  • 245
6 votes

Why is selinux blocking remote ssh access without a password?

In my case was looking into root#> journalctl -f then tell SELinux that use to nfs home dirs is allowed: root#> setsebool -P use_nfs_home_dirs 1 This solve my problem.
oldgeek62's user avatar
6 votes
Accepted

semodule_package command not found

According to yum whatprovides */semodule_package you would need to install policycoreutils-python package.
Janne Pikkarainen's user avatar
6 votes

Again enabled SELINUX and now the user logins wont work in enforcing mode

Running with Selinux disabled for a long time can cause files to not be labelled or labelled with Selinux context not matching the installed policy. Also daemons and other processes (including systemd)...
zorry's user avatar
  • 136
5 votes
Accepted

SELinux context for apache ldap ssl

There's always the boolean httpd_can_connect_ldap. This allows: # sesearch -b httpd_can_connect_ldap -AC Found 1 semantic av rules: DT allow httpd_t ldap_port_t : tcp_socket name_connect ; [ ...
Michael Hampton's user avatar
5 votes

Why won't MariaDB start after upgrade (NO_NEW_PRIVILEGES)

I can't upgrade the kernel (this is a vps). I have found a solution : edit /lib/systemd/system/mariadb.service change PrivateDevices=true to PrivateDevices=false Run systemctl daemon-reload and ...
user2267379's user avatar
5 votes

How to Disable Selinux Only for Apache on Centos 7.4

Your issue is caused by incorrectly labeled executables. Relabel them to http_sys_script_exec_t (see semanage fcontext and restorecon): semanage fcontext -a -t http_sys_script_exec_t '/var/www/html/...
fuero's user avatar
  • 9,719
5 votes

How to reset selinux to its initial state in centos7?

Please try, setenforce 0 yum remove selinux-policy\* rm -rf /etc/selinux/targeted /etc/selinux/config yum install selinux-policy-targeted yum install selinux-policy-devel policycoreutils-gui ***use ...
mightyteja's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible