By default, the SELinux policy will only allow services access to recognized ports associated with those services:
# semanage port -l | egrep '(^http_port_t|6379)'
http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000
# curl http://localhost/redis.php
Cannot connect to redis server.
- add Redis port (6379) to SELinux policy
To check SELinux
To see what flags are set on httpd processes
getsebool -a | grep httpd
To allow Apache to connect to remote database through SELinux
setsebool httpd_can_network_connect_db 1
Use -P option makes the change permanent. Without this option, the boolean would be reset to 0 at reboot.
setsebool -P httpd_can_network_connect_db 1
So I found that another service had a defined status for TCP port 5000.
But by replacing the -a option with -m for modify, added tcp port 5000 to http_port_t
So the command that worked was:
# semanage port -m -t http_port_t -p tcp 5000
SELinux is not namespaced, so individual containers cannot have their own separate SELinux policies. SELinux will always appear to be "disabled" in a container, though it is running on the host.
If your application requires SELinux, you cannot use it inside Docker. You will need to use a regular virtual machine.
It seems ridiculous that you can't set up a policy that allows nginx to write to a socket without first having an attempt denied and then running a tool that enables things that were denied.
Well no, SELinux is Mandatory Access Control, things are denied by default and you have to explicitly allow something. If the policy authors have not considered a ...
As already stated, you should instruct SELINUX to allow writing to that file. The right thing to do is to mark /var/www/webapp/k/site/ as of type httpd_sys_rw_content_t
To permanently mark that directory as httpd_sys_rw_content_t, you can use the command semanage fcontext -a -t httpd_sys_rw_content_t /var/www/webapp/k/site(/.*)?; restorecon -RF /var/www/...
I've often encountered a similar bug on CentOS 6 machines involving ssh-copy-id and SELinux.
When ssh-copy-id creates the authorized keys files it creates it with the proper permissions, but with the wrong SELinux label. The fix for this is restoring the labels to their policy defaults using this command:
restorecon -R ~/.ssh
I was able to duplicate this issue in a freshly installed CentOS 7.5 system.
Here is what is happening:
When you boot with init=/bin/bash there are two issues you may run into:
The root filesystem may be mounted readonly. In this case passwd will complain of an Authentication token manipulation error.
This is pretty obvious: If the filesystem is not ...
These things are always much easier debugged from the server side, if that is possible. If you can start a sshd on another port in debug mode, it will tell you immediately why the key is being rejected (my wild guess is that your home directory is group writable). You can, for example, start a sshd in debug mode on port 2222 with /usr/sbin/sshd -d -p 2222, ...
The Actual Problem
To translate the second line of the log you provided:
The rotatelogs process with PID 64617 tried to search in the home directory, which is on device md2 and on inode 7208961. Access was denied.
The security context of the rotatelogs process is: unconfined_u:system_r:httpd_rotatelogs_t:s0
The security context of the home directory is:
Next time when you will reboot the system, it will relabel the filesystem for SElinux automatically.
This usually occurs when labeling a file system for SELinux for the first time, or when switching between different types of policy, such as changing from the targeted to the strict policy.
The place to start is to look at your /var/log/audit/audit.log for AVC denied messages relating to mysqld. These can be passed to audit2why to gather more information to help you decide what to do.
You have your mysql files in a non standard location and although the directories have the correct context it's likely that the files in them are not. The best ...
There is a short article on this issue. It says that
may be because the SELinux contexts have not been correctly set on the .ssh folder and authorized keys file [...] The way to fix this is to run
# restorecon -R -v /root/.ssh
The article also shows how to set permissions correctly from the beginning:
# chmod 755 /root/.ssh/
# chmod 600 /root/.ssh/...
httpd_read_user_content allows any confined web server to read files in user home directories in /home.
httpd_enable_homedirs allows Apache to use its UserDir directive (i.e. URLs that look like http://www.example.com/~username/).
If you are just mapping domain names to users' directories, it should be sufficient to enable the first one, ...
Your VPS runs on OpenVZ, a container based "virtualization" which has no support for SELinux. If you need SELinux, you will need to switch to another hypervisor which supports SELinux in guests, such as Hyper-V, VMware, KVM, Xen, and possibly others.
Some of the commands to obtain this info are (examples use httpd_log_t):
# seinfo -x --type=httpd_log_t /etc/selinux/default/policy/policy.26
# sesearch --dontaudit -t httpd_log_t /etc/selinux/default/policy/policy.26 | head
Found 35 semantic av rules:
Not confirmed if this is the right answer yet...
/usr/sbin/semanage fcontext -a -t sysfs_t "/www(/.*)";
/usr/sbin/semanage fcontext -a -t httpd_sys_content_t "/www/live/.*/.*";
/usr/sbin/semanage fcontext -a -t httpd_log_t "/www/live/.*/logs(/.*)?";
/sbin/restorecon -vr "/www";
There the sysfs_t is the important bit.
I can find the domains that LogRotate ...
On the systems I have to hand (C6, C7 and F24), tcp port 5000 has an SELinux context of commplex_port_t. This will be why, when you try to add it you get the error message
/usr/sbin/semanage: Port tcp/5000 already defined
To change the context of tcp port 5000 from commplex_port_t to http_port_t you will need to use the -m | --modify switch
-m, --modify ...
The actual config file is /etc/sellinux/config to which /etc/sysconfig/selinux links. It seems you might have lost the link and ended up with a regular file.
# ls -l /etc/sysconfig/selinux
lrwxrwxrwx. 1 root root 17 Dec 22 18:59 /etc/sysconfig/selinux -> ../selinux/config
or check the contents of /etc/selinux/config
The kernel makes the following procedure to determine what the file type of a newly created file will be.
There exists in policy a specific file transition rule. So apply this.
Make the newly created file acquire the type of the parent directory.
In the vast majority of cases, new files inherit the parent directories type. Sometimes this is not desirable --...
The way to handle this is to collect all the information about what access the program needs, and then explicitly allow only that access in a custom policy module.
This is fairly easy to do.
First, you set the domain permissive, so that SELinux temporarily does not enforce its rules. It will still log the denials, and later you will use these logs.
It looks like a bug in vsftpd to me.
From the code, it looks like, vsftpd always sends the 0,0,0,0, if the public pasv_address is set, and the server has a (local) IPv6 address.
To fix this, make sure the server does not listen on IPv6 address (what is the default behavior, which you are overriding by setting listen_ipv6=YES):
After editing file /etc/sysconfig/selinux, for the changes to take effect, you need to reboot your system to get SELinux fully disabled. You can do setenforce 0 to get the system into "permissive" mode until a reboot occurs.
make sure you change SELinux=enforcing to SELinux=disabled
Well that was impressive, you made me go to source code to find an answer. You did stumble across the proper way to define a range with your first try: two numbers must be separated by a hyphen.
What's hanging you up is this:
(rc, exists) = semanage_port_exists(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if port %s/%s is defined") % (...
I'll be using the passwd program to explain a lot of this.
To definitely answer this question in the context of DAC (standard unix access control model):
How do you work out from the file what subject I might end up running a binary in?
The answer is you run ls -l /bin/passwd, check if the setuid bit is set. If it is you'll run the program as the files ...