The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
0answers
16 views

Using SELinux with a modified OpenEmbedded release

I'm new with OpenEmbedded, so bear with me if I get some things wrong. I would like to support SELinux on an embedded target that uses a modified OpenEmbedded Linux distribution. I have enabled the ...
0
votes
2answers
31 views

Can I sandbox a binary created in C (with GCC) for Linux and make it easy for users?

I have compiled a binary that I want to distribute to other people. It's closed-source, but I want to provide users of the binary with confidence that it cannot possibly access the internet, ...
0
votes
1answer
22 views

SELinux is blocking getty from reading /etc/issue

I recently changed my hostname, and after rebooting with the new hostname, /etc/issue stopped getting displayed on the login screen. I disabled selinux temporarily, and /etc/issue was displayed again. ...
0
votes
0answers
23 views

How to Configure Sudo to Preserve Group and User IDs as Owners?

Question I am running sudo 1.8.15 on Ubuntu 15.10 (wily). The last two entries in my /etc/sudoers file are: Defaults:nginx stay_setuid,targetpw,env_reset nginx ALL=(ALL) PASSWD: ALL But, when I ...
0
votes
1answer
50 views

Sudo can't see symbollically linked executables in path

On CentOS 7, I installed some executables in /opt/app-version/bin/executable. Those executables have the following permissions: rwxrwxr-x. 500 500 Ownership of every directory in the path ...
0
votes
1answer
18 views

How can I make SELinux allow access to a file?

I have a proprietary piece of software my company owns that needs access to a root-level file. We'll call it /secfile as it is security/license related. The system runs a daemon that writes out ...
0
votes
1answer
41 views

Using semanage in CentOS 6.6 (Virtual Machine) but it shows “Killed” (solved)

Sorry for the duplicate, since stackoverflow won't answer the question and suggest to ask it here. I have a CentOS 6.6 virtual machine (lauched in Eucalyptus Private Cloud). I guess Amazon Instance ...
0
votes
0answers
77 views

Which Debian has SElinux and Firewalld out of the box?

I am willing to learn how to work with Debian, I want to know why it is the 1st server choice compared to CentOS, although CentOS seems to use SELinux and Firewalld. I am coming from a CentOS ...
2
votes
1answer
439 views

Centos 6.7 on VirtualBox loses network with SELinux disabled

I've been struggling with this issue the whole day yesterday and it seems I'm in a dead end, too much Googling, reading, and trial and error without a result, so I decided to ask the gurus (you) I'm ...
0
votes
0answers
9 views

SELinux policy for ifplugd and udev in Raspbian

I've recently enabled SELinux on my RaspberryPi and recieved some AVCs denials. I'm reading SEL documentation and have resolved a few of them. But I'm not sure if I did it right. So please review my ...
0
votes
0answers
33 views

SELinux policy for ifplugd and udev in Raspbian

I've recently enabled SELinux on my RaspberryPi and recieved some AVCs denials. I'm reading SEL documentation and have resolved a few of them. But I'm not sure if I did it right. So please review my ...
1
vote
0answers
74 views

selinux: how to enable httpd to have read-write and execute permissions

I am facing problems with PHP interface that calls perl and shell scripts. These enable uploading of a file to a folder and execute them with some input while storing output into some other files. Now ...
0
votes
0answers
11 views

Linux containerization technologies and uses

I am trying to understand various security mechanisms available in Linux and how they are related. Let's say I am trying to lock down a system daemon so that it only has access to the resources it ...
0
votes
0answers
30 views

how to automate selinux policy

I am working on a project to equip Security Enhanced Linux to take automatic decision of allowing or totally blocking access to a user, application or process based on certain environmental ...
0
votes
0answers
17 views

SELinux issue with php_shell_exec

I have a php site on CentOS7 that needs to use some shell scripts using php_shell_exec. But the scripts do not run due to SELinux (that I require). None of the scripts use sudo, I understand that ...
5
votes
1answer
505 views

selinux doesn't have httpd_can_network_connect as an option on ubuntu 15.04

I installed Ubuntu 15.04 and then installed selinux by doing sudo apt-get install selinux. I then did setsebool -P httpd_can_network_connect 0 and got a "Boolean httpd_can_network_connect is not ...
9
votes
3answers
214 views

A way to trigger an SELinux policy violation?

I'm studying the basic workings of SELinux and would find it useful to trigger a denial. My test machine is running CentOS 7, it's a basic server install without any extra services, and getenforce ...
0
votes
2answers
411 views

SELinux is preventing /opt/google/chrome-beta/nacl_helper from getattr access on the file /etc/passwd

I'm not sure why and/or if it's normal, but I keep getting popup from my SELinux Alert Browser: SELinux is preventing /opt/google/chrome-beta/nacl_helper from getattr access on the file ...
0
votes
0answers
177 views

Samba On Linux: Allow Sharing Of Files In FUSE-Mounted Partition

I have this server at home with a single SSD with the following partition scheme: sda1 = 512 MB - EFI Partition sda2 = 512 MB - FAT Boot Partition sda3 = 3096 MB - Linux-swap sda4 = 20 GB - Ext4 (OS) ...
1
vote
1answer
75 views

“Cannot open audit interface” upgrading libuuid1 — is selinux confused?

I have a Debian chroot on a Linux system running an alternative Linux distro. It's always worked fine in the past but in the past few months I've found myself unable to upgrade libuuid1. Instead it ...
0
votes
0answers
64 views

Issues with SELinux and PAM logging in

I had a recent issue where users weren't able to log in our Linux server. In the logs I found: login: FAILED LOGIN 1 FROM tty1 FOR REDACTED, Authentication failure login: pam_succeed_if(login:auth): ...
0
votes
1answer
78 views

How to prevent SELinux from installing with CentOS 6.5

I know I can disable SELinux in CentOS 6.5, but I’d prefer to just not install it at all from the point of the actual, initial installation. But I can’t find anywhere in the CentOS installer to shut ...
1
vote
1answer
342 views

SELinux remove extended ACL

I have a set of files that can't have selinux's extended acl on them. When running ls -la I get a result similar to: -rwxr-xr-x. 1 root root 1 Aug 8 2014 filea -rwxr-xr-x. 1 root root 1 ...
2
votes
1answer
36 views

Is it possible to limit remote administration accesses of an admin using Selinux?

Suppose and admin needs to access a machine remotely.Root logins are disabled but he belongs to the sudoers list. I read that "sudo command" is good practice because you don't forget you are using ...
2
votes
0answers
176 views

HIPS for Linux (ie, interactive SELinux/AppArmor)

Windows has a number of programs (generally referred to as Host-based Intrusion Prevention Systems) that offer protection against difficult security threats (such as zero-day exploits) by blocking ...
0
votes
1answer
147 views

restorecon in CentOS does not follow fcontext order

Experimenting with file contexts, I have faced a strange behaviour and it looks to me I'm missing something. Here's what I do: Create a bunch of directories and files # mkdir -p /virtual/www/cgi-bin ...
5
votes
3answers
656 views

Is SELinux important if I'm the only one who uses my computers?

I've got two Fedora laptops and a CentoOS home server, but I'm the only person who uses any of them, with the exception of a smb share that a family member uses. Does SELinux have any real benefit if ...
0
votes
1answer
118 views

Why does ssh/sshd on server try to access /home/<user>/.ssh after I moved my users home directory?

I moved my users home directory with usermod -m -d /path/to/new/home/username which seems to have worked fine. However, in my [moved] home directory I have the ".ssh" folder that is set up to allow ...
1
vote
0answers
93 views

Is there anyway you can restrict users from executing a command with another name?

I'm not asking an obvious question here. I would like to elucidate with an example. A user 'bob' is always executing 'chmod 777 /home/bob/impfiles' so that user 'alice' could make changes to the ...
1
vote
3answers
1k views

PHP can't connect to PostgreSQL with “permission denied” error with SELinux

My PHP app can connect when I turn off SELinux, but not with it on. setenforce 0; curl -I http://domain.com; setenforce 1 Yields no errors in /var/log/httpd/error_log. However, if I have it on, I ...
0
votes
1answer
478 views

Is SELinux really useful or needed [closed]

So I noticed that Fedora takes around 35 seconds to boot and ArchBang was only taking around 15. I did soom looking into it and I guess SELinux has a lot to dow ith this and I was wondering if ...
1
vote
1answer
644 views

Installing linux/selinux kernal headers

I'm trying to build the newest version of glibc (2.19) on CentOS 5.6 and I've run into some issues The documentation of glibc says that I need at minimum the linux kernal headers 2.6.19 (even if this ...
2
votes
2answers
100 views

Selinux deny root user

I am using SELinux in my centos server. I am trying to change context of the file located in the /var/www/html as a root user. Root user is also not able to make any changes in the context of the ...
0
votes
1answer
249 views

Permission denied even with 777 and disabled selinux

On a centos 6.5 machine I wanted to create a general user, where its home directory is shared among many users, called shareduser /home/shareduser has mod 700 Then the shared folder is called: ...
6
votes
1answer
253 views

What are the main impacts of SELinux, from an administration point of view?

Thanks to Wikipedia and others, we can have a vague idea of what SELinux is. I understood it gives ways to handle permissions more precisely, but I'm really not aware about how. The question would ...
0
votes
1answer
479 views

How can I run Skype under an SELinux sandbox?

I would like to run Skype under an SELinux sandbox, to protect my computer. However I get the following error: usr/bin/skype: error while loading shared libraries: /lib/libQtWebKit.so.4: cannot ...
1
vote
1answer
25 views

SELinux access only to opened files

I am studying SELinux. Using SELinux, can a binary be allowed to access files opened by its parent process, and no other files? If it cannot, then we should enhance it.
1
vote
2answers
2k views

SELinux transition from unconfined_r to user_r

On a Fedora 18 machine, I have the following SELinux context as a regular user created during installation: $ sestatus SELinux status: enabled Loaded policy name: targeted ...
0
votes
1answer
551 views

Limit program's (Viber for Linux) access only to certain directory

Is it possible to limit programs' access only to certain directory, for example, to run Viber on Fedora and force it to only be able to read under /home/username/.local/share/viber/exchange and no ...
1
vote
1answer
159 views

vsftpd hides certain extensions, how to disable it?

I just enabled vsftpd on my laptop (Fedora 18 if that matters and vsftpd version 3.0.2) and tried to connect to it with my Android phone: success! Still, some minutes later, I stumbled upon a folder ...
2
votes
3answers
2k views

semanage command not changing file context

I am trying to change selinux context for upload directory to enable anonymous upload. This is the Directory path /var/ftp/upload This is the default context [root@server ftp]# ls -Z upload ...
0
votes
1answer
91 views

Disabled SELinux then rebooted, but reboot seems to have hanged?

I disabled SELinux by editing /etc/selinux/config to include the line SELINUX=disabled This change requires rebooting to activate, so I did that. I'm now sitting in front of a black screen with ...
0
votes
1answer
234 views

Prevent FTP transfer from failing when FTP server is restarted

When downloading large files (ca. 5GB) with the lftp client, I find that a restart of the FTP service (vsftpd) stops the transfer and I have to restart it from the beginning. Is there a way to prevent ...
0
votes
0answers
715 views

How to allow apache to execute R binary from PHP exec() without disabling SELinux?

I have R installed in /opt/R of webserver. I need to execute script.r (In R BATCH mode) that is on directory /var/www/html/ using PHP function exec(). SELinux is enabled in the webserver. I suppose ...
1
vote
1answer
2k views

Configuring SELINUX to allow logging to a file that's outside /var/log

I have a daemon that uses syslog(3) to log to a file that is not a descendant of /var/log. Currently, this requires that SELINUX be disabled. How can I configure an enabled SELINUX to allow this ...
0
votes
1answer
153 views

Selinux what's the right context for module like imagemagick /usr/bin/convert

I have an application I need to call from php, but selinux is preventing execmem for the application. I want to set the right context rather than allow bin_t or httpd_user_script_t execmem access. I ...
1
vote
1answer
2k views

Trying key based password-less SSH login to remote computer but still being asked for password

Trying to SSH in to remote computer but still asking for password. I have a number of computers running SElinux and only one of them is giving me a hard time using ssh without the password. I did ...
1
vote
1answer
1k views

Cannot write samba shares

Running samba 3.5 on Red Hat Enterprise 6.1 I'm having issues sharing two folders. Here is the output of testparm: [global] workgroup = DOMAINNAME server string = Samba Server Version %v ...
1
vote
1answer
327 views

SELinux - CentOSx86_64: User command limitation

SELinux - CentOSx86_64: User command limitation Is SELinux the right tool for this job? If so, what is the best way to do it? I would like to limit a particular user to only running some list of ...
1
vote
0answers
59 views

What are the improvements of Flask compared with traditional MAC?

I know that traditional MAC has limitations, like that it provides poor support for data and application integrity, separation of duty, and least privilege requirements. So NSA and SCC developed a ...