The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
1answer
13 views

Which namespaces of xattrs a non root user can set in android?

I know it isn’t possible to setsecurity.capabilitiesattributes without uid 0 or CAP_SETFCAP. However I was unable to find a complete list of what namespaces of names are allowed or what are those ...
4
votes
1answer
203 views

Apache can't access /var/www/html

Apache is denying access to all the files in /var/www/html. It claims it's because of file permissions, but the whole /var/www directory is chmod 755 and owned by apache:apache. Apache error log: ...
0
votes
0answers
44 views

Using SELinux with a modified OpenEmbedded release

I'm new with OpenEmbedded, so bear with me if I get some things wrong. I would like to support SELinux on an embedded target that uses a modified OpenEmbedded Linux distribution. I have enabled the ...
0
votes
2answers
51 views

Can I sandbox a binary created in C (with GCC) for Linux and make it easy for users?

I have compiled a binary that I want to distribute to other people. It's closed-source, but I want to provide users of the binary with confidence that it cannot possibly access the internet, ...
0
votes
1answer
27 views

SELinux is blocking getty from reading /etc/issue

I recently changed my hostname, and after rebooting with the new hostname, /etc/issue stopped getting displayed on the login screen. I disabled selinux temporarily, and /etc/issue was displayed again. ...
0
votes
0answers
37 views

How to Configure Sudo to Preserve Group and User IDs as Owners?

Question I am running sudo 1.8.15 on Ubuntu 15.10 (wily). The last two entries in my /etc/sudoers file are: Defaults:nginx stay_setuid,targetpw,env_reset nginx ALL=(ALL) PASSWD: ALL But, when I ...
0
votes
1answer
76 views

Sudo can't see symbollically linked executables in path

On CentOS 7, I installed some executables in /opt/app-version/bin/executable. Those executables have the following permissions: rwxrwxr-x. 500 500 Ownership of every directory in the path /opt/app-...
0
votes
1answer
30 views

How can I make SELinux allow access to a file?

I have a proprietary piece of software my company owns that needs access to a root-level file. We'll call it /secfile as it is security/license related. The system runs a daemon that writes out ...
0
votes
1answer
77 views

Using semanage in CentOS 6.6 (Virtual Machine) but it shows “Killed” (solved)

Sorry for the duplicate, since stackoverflow won't answer the question and suggest to ask it here. I have a CentOS 6.6 virtual machine (lauched in Eucalyptus Private Cloud). I guess Amazon Instance ...
0
votes
0answers
117 views

Which Debian has SElinux and Firewalld out of the box?

I am willing to learn how to work with Debian, I want to know why it is the 1st server choice compared to CentOS, although CentOS seems to use SELinux and Firewalld. I am coming from a CentOS ...
2
votes
1answer
771 views

Centos 6.7 on VirtualBox loses network with SELinux disabled

I've been struggling with this issue the whole day yesterday and it seems I'm in a dead end, too much Googling, reading, and trial and error without a result, so I decided to ask the gurus (you) I'm ...
0
votes
0answers
51 views

SELinux policy for ifplugd and udev in Raspbian

I've recently enabled SELinux on my RaspberryPi and recieved some AVCs denials. I'm reading SEL documentation and have resolved a few of them. But I'm not sure if I did it right. So please review my ...
0
votes
0answers
12 views

SELinux policy for ifplugd and udev in Raspbian

I've recently enabled SELinux on my RaspberryPi and recieved some AVCs denials. I'm reading SEL documentation and have resolved a few of them. But I'm not sure if I did it right. So please review my ...
1
vote
0answers
169 views

selinux: how to enable httpd to have read-write and execute permissions

I am facing problems with PHP interface that calls perl and shell scripts. These enable uploading of a file to a folder and execute them with some input while storing output into some other files. Now ...
1
vote
1answer
112 views

“Cannot open audit interface” upgrading libuuid1 — is selinux confused?

I have a Debian chroot on a Linux system running an alternative Linux distro. It's always worked fine in the past but in the past few months I've found myself unable to upgrade libuuid1. Instead it ...
0
votes
0answers
11 views

Linux containerization technologies and uses

I am trying to understand various security mechanisms available in Linux and how they are related. Let's say I am trying to lock down a system daemon so that it only has access to the resources it ...
0
votes
0answers
46 views

how to automate selinux policy

I am working on a project to equip Security Enhanced Linux to take automatic decision of allowing or totally blocking access to a user, application or process based on certain environmental conditions....
5
votes
1answer
752 views

selinux doesn't have httpd_can_network_connect as an option on ubuntu 15.04

I installed Ubuntu 15.04 and then installed selinux by doing sudo apt-get install selinux. I then did setsebool -P httpd_can_network_connect 0 and got a "Boolean httpd_can_network_connect is not ...
0
votes
2answers
430 views

SELinux is preventing /opt/google/chrome-beta/nacl_helper from getattr access on the file /etc/passwd

I'm not sure why and/or if it's normal, but I keep getting popup from my SELinux Alert Browser: SELinux is preventing /opt/google/chrome-beta/nacl_helper from getattr access on the file /etc/...
11
votes
3answers
326 views

A way to trigger an SELinux policy violation?

I'm studying the basic workings of SELinux and would find it useful to trigger a denial. My test machine is running CentOS 7, it's a basic server install without any extra services, and getenforce ...
0
votes
1answer
213 views

restorecon in CentOS does not follow fcontext order

Experimenting with file contexts, I have faced a strange behaviour and it looks to me I'm missing something. Here's what I do: Create a bunch of directories and files # mkdir -p /virtual/www/cgi-bin ...
1
vote
1answer
1k views

SELinux issues when adding rules

On my laptop I use Fedora 17 distro for the first time and I'm having some issues adding rules to semodule An example: # grep httpd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i ...
0
votes
1answer
101 views

How to prevent SELinux from installing with CentOS 6.5

I know I can disable SELinux in CentOS 6.5, but I’d prefer to just not install it at all from the point of the actual, initial installation. But I can’t find anywhere in the CentOS installer to shut ...
1
vote
1answer
595 views

SELinux remove extended ACL

I have a set of files that can't have selinux's extended acl on them. When running ls -la I get a result similar to: -rwxr-xr-x. 1 root root 1 Aug 8 2014 filea -rwxr-xr-x. 1 root root 1 ...
2
votes
1answer
38 views

Is it possible to limit remote administration accesses of an admin using Selinux?

Suppose and admin needs to access a machine remotely.Root logins are disabled but he belongs to the sudoers list. I read that "sudo command" is good practice because you don't forget you are using ...
2
votes
0answers
254 views

HIPS for Linux (ie, interactive SELinux/AppArmor)

Windows has a number of programs (generally referred to as Host-based Intrusion Prevention Systems) that offer protection against difficult security threats (such as zero-day exploits) by blocking ...
1
vote
3answers
2k views

PHP can't connect to PostgreSQL with “permission denied” error with SELinux

My PHP app can connect when I turn off SELinux, but not with it on. setenforce 0; curl -I http://domain.com; setenforce 1 Yields no errors in /var/log/httpd/error_log. However, if I have it on, I ...
57
votes
4answers
56k views

What does the dot mean at the end of `-rw-r--r--`? How do you set it with `chmod`?

I see that some of the files in my directories under Linux have a . at the end of the permissions listing. What does the dot mean at the end of -rw-r--r--? How do you set it with chmod?
1
vote
2answers
2k views

SELinux transition from unconfined_r to user_r

On a Fedora 18 machine, I have the following SELinux context as a regular user created during installation: $ sestatus SELinux status: enabled Loaded policy name: targeted ...
5
votes
3answers
716 views

Is SELinux important if I'm the only one who uses my computers?

I've got two Fedora laptops and a CentoOS home server, but I'm the only person who uses any of them, with the exception of a smb share that a family member uses. Does SELinux have any real benefit if ...
2
votes
2answers
115 views

Selinux deny root user

I am using SELinux in my centos server. I am trying to change context of the file located in the /var/www/html as a root user. Root user is also not able to make any changes in the context of the ...
0
votes
1answer
183 views

Why does ssh/sshd on server try to access /home/<user>/.ssh after I moved my users home directory?

I moved my users home directory with usermod -m -d /path/to/new/home/username which seems to have worked fine. However, in my [moved] home directory I have the ".ssh" folder that is set up to allow ...
2
votes
3answers
2k views

semanage command not changing file context

I am trying to change selinux context for upload directory to enable anonymous upload. This is the Directory path /var/ftp/upload This is the default context [root@server ftp]# ls -Z upload drwxr-...
1
vote
0answers
133 views

Is there anyway you can restrict users from executing a command with another name?

I'm not asking an obvious question here. I would like to elucidate with an example. A user 'bob' is always executing 'chmod 777 /home/bob/impfiles' so that user 'alice' could make changes to the ...
0
votes
1answer
580 views

Is SELinux really useful or needed [closed]

So I noticed that Fedora takes around 35 seconds to boot and ArchBang was only taking around 15. I did soom looking into it and I guess SELinux has a lot to dow ith this and I was wondering if ...
1
vote
1answer
26 views

SELinux access only to opened files

I am studying SELinux. Using SELinux, can a binary be allowed to access files opened by its parent process, and no other files? If it cannot, then we should enhance it.
1
vote
1answer
890 views

Installing linux/selinux kernal headers

I'm trying to build the newest version of glibc (2.19) on CentOS 5.6 and I've run into some issues The documentation of glibc says that I need at minimum the linux kernal headers 2.6.19 (even if this ...
0
votes
1answer
533 views

How can I run Skype under an SELinux sandbox?

I would like to run Skype under an SELinux sandbox, to protect my computer. However I get the following error: usr/bin/skype: error while loading shared libraries: /lib/libQtWebKit.so.4: cannot ...
0
votes
1answer
265 views

Permission denied even with 777 and disabled selinux

On a centos 6.5 machine I wanted to create a general user, where its home directory is shared among many users, called shareduser /home/shareduser has mod 700 Then the shared folder is called: /home/...
6
votes
1answer
292 views

What are the main impacts of SELinux, from an administration point of view?

Thanks to Wikipedia and others, we can have a vague idea of what SELinux is. I understood it gives ways to handle permissions more precisely, but I'm really not aware about how. The question would ...
0
votes
1answer
612 views

Limit program's (Viber for Linux) access only to certain directory

Is it possible to limit programs' access only to certain directory, for example, to run Viber on Fedora and force it to only be able to read under /home/username/.local/share/viber/exchange and no ...
1
vote
1answer
178 views

vsftpd hides certain extensions, how to disable it?

I just enabled vsftpd on my laptop (Fedora 18 if that matters and vsftpd version 3.0.2) and tried to connect to it with my Android phone: success! Still, some minutes later, I stumbled upon a folder ...
0
votes
1answer
98 views

Disabled SELinux then rebooted, but reboot seems to have hanged?

I disabled SELinux by editing /etc/selinux/config to include the line SELINUX=disabled This change requires rebooting to activate, so I did that. I'm now sitting in front of a black screen with '...
0
votes
1answer
266 views

Prevent FTP transfer from failing when FTP server is restarted

When downloading large files (ca. 5GB) with the lftp client, I find that a restart of the FTP service (vsftpd) stops the transfer and I have to restart it from the beginning. Is there a way to prevent ...
6
votes
2answers
16k views

How do I remove any SELinux context or ACL?

HI, I have some files, that I'd like to remove the SELinux context or ACLs from (denoted by a '.' or a '+' respectively when using ls -alZ). I don't have too much time on my hands to read on the , ...
0
votes
0answers
812 views

How to allow apache to execute R binary from PHP exec() without disabling SELinux?

I have R installed in /opt/R of webserver. I need to execute script.r (In R BATCH mode) that is on directory /var/www/html/ using PHP function exec(). SELinux is enabled in the webserver. I suppose ...
1
vote
1answer
2k views

Configuring SELINUX to allow logging to a file that's outside /var/log

I have a daemon that uses syslog(3) to log to a file that is not a descendant of /var/log. Currently, this requires that SELINUX be disabled. How can I configure an enabled SELINUX to allow this ...
4
votes
2answers
6k views

Making SELinux play nice with OpenVPN (in NetworkManager)

I have been trying to use OpenVPN to connect to my work network. Using it via the command line works fine: openvpn user.conf I haven't bothered to set it up with DNS properly though, and it looks ...
0
votes
1answer
493 views

Sandbox tool on OpenSUSE with operation not permited

I have installed Se Linux on my OpenSUSE 11.3 system. All configuration are correct. When I use the sandbox tool: > LANG=C sandbox -X -H sehome -T tmp -t sandbox_web_t firefox /usr/bin/chcon: ...
0
votes
1answer
172 views

Selinux what's the right context for module like imagemagick /usr/bin/convert

I have an application I need to call from php, but selinux is preventing execmem for the application. I want to set the right context rather than allow bin_t or httpd_user_script_t execmem access. I ...