People who code: we want your input. Take the Survey

Questions tagged [selinux]

Security-Enhanced Linux (SELinux) is a Linux kernel security module that provides a mechanism for supporting access control security policies.

Filter by
Sorted by
Tagged with
0
votes
0answers
30 views

Use SELinux(?) to disable root access to iptables for procrastination

This might not be a problem for you but I suffer from poor impulse control and as a result constant procrastination while in front of a computer. I can't procrastinate much on my phone because I ...
1
vote
1answer
45 views

How to add a capability to SELinux custom role?

I created a role foo_r, and I would like that a user with this role, can open a reserved port (< 1024) with the CAP_NET_BIND_SERVICE capability. For this I added a security context: policy_module(...
0
votes
1answer
46 views

How to get “su” to work in init scripts in Red Hat 8 with SELinux?

In an init script I'm trying to run a command: su - user -c "/home/user/bin/command” but SELinux prevents this: systemd[1]: Starting LSB: Start the my_script at boot... su[5941]: pam_unix(su-l:...
0
votes
0answers
39 views

How can I get my gnome lockscreen as default instead of the grey system one?

Suddenly my lockscreen changed from the gnome (blue one) lockscreen that detects the username and asks for password to the login screen that asks for both username and password. I am trying to get it ...
1
vote
0answers
229 views

Unable to login after switching to “multi-user” target in Yocto Linux

I have a device running yocto(warrior) and selinux is enabled by default. I am unable to login to device if I switch to multi-user target. If I change selinux in permissive mode, I am able to login ...
0
votes
0answers
166 views

SElinux Invalid AVC allowed in current policy

When i ran sudo sealert -a /var/log/audit/audit.log getting below error; What could be reason and how to fix it. Reading some blogs got to know it would be labeling problem but how to fix not sure. ***...
0
votes
0answers
11 views

How/when SELinux labels are applied when rpm is installed

I've read tons of documents explaining SELinux, but I cannot find the answer for the following question: Let's assume I use Centos 8 which has SELinux enabled. As I understand Centos 8 maintainers ...
0
votes
1answer
304 views

CentOS 8 auditd AVC denials message flood caused by denied setuid

Today my CentOS 8 suddenly frozen and not responding to user inputs. When I tried to login from console, I saw messages like these: audit: backlog limit exceeded audit: backlog limit exceeded audit: ...
0
votes
0answers
43 views

How can SELinux be run within an unpacked squashfs filesystem?

Currently I enter a chroot and mount proc and sysfs to operate dpkg/apt: chroot [FS] mount -t proc none /proc/ mount -t sysfs none /sys/ export HOME=/root This will not allow SELinux commands to be ...
0
votes
1answer
51 views

How can an SELinux filesystem be relabeled in an unpacked squashfs filesystem?

I am trying to configure selinux for a live boot Debian system. SELinux is inoperable due to copious changes during build and system configuration and requires the entire filesystem to be relabeled. ...
0
votes
0answers
45 views

Is it possible to limit the permissions of a user based on his or her actions?

I'm currently working on a research project, that includes the question, if it is possible to implement a Chinese-Wall based information flow control model based on SELinux. One of the core principles ...
0
votes
2answers
120 views

Restricting Access to Files when Standard Linux Permissions Won't Suffice

I administer several RHEL 6.9 systems. On each system, a particular directory, call it /app_dir, is the top level of where our project's scripts, executables, configuration files, and logs are stored. ...
0
votes
1answer
124 views

How do I run a War File in confined SELinux domain on CentOS7?

I am currently working on the deployment of my Java Web Application. This application is available to me as a WAR file. My goal is that the application starts with a limited SELinux startup. This ...
-1
votes
1answer
20 views

What is the different between file with Selinux Context and without Selinux Context?

Good day, Today I compare file permission of 2 environment. Found that 1 of it having the dot at the end of the permission, but another environment no have. Environment 1 (with Selinux Context): -...
1
vote
1answer
669 views

Mounting docker into container shows executable but errors with: /usr/bin/docker: No such file or directory

Enviornment details $ docker --version Docker version 19.03.4, build 9013bf583a $ hostnamectl Static hostname: ohpc.novalocal Icon name: computer-vm Chassis: vm ...
0
votes
3answers
845 views

Cannot execute systemd service running as a non privileged user on CentOS 8

There is (maybe) a change between CentOS 7 and 8 in regard of systemd and selinux I yet do not know how to deal with this. For some reason (cross distribution compat) we are using postgresql 9.6 from ...
1
vote
1answer
93 views

syslog-ng starts and runs fine manually… starts but doesnt create logs when using systemd

Redhat 7.6 with latest syslog-ng (3.22) ive searched and tried all the old remedies. Nothing has worked to resolve this. My syslog-ng.conf file has a bunch of ports and a bunch of destinations. When ...
0
votes
2answers
92 views

SELinux blocking procmail from executing dspam but no AVC message

I have a CentOS 7 system in which I use postfix as the MTA. Certain users use procmail via .forward in their home directories: # cat .forward "|exec /usr/bin/procmail -f- || exit 75" In this case, I ...
0
votes
1answer
769 views

Fedora 30 boot freeze - Failed to load SELinux policy

Updated Fedora 30 (workstation) via CLI sudo dnf upgrade -y everything ok, updates downloaded and installed. SELinux configuration file is set as follows: SELINUX = disabled Then reboot. System ...
1
vote
1answer
161 views

Generate selinux policy from audit2allow

I need to upload to aws from logrotate. When the logrotate is triggered the SELinux blocking it. The error line is type=AVC msg=audit(1562162502.670:101127): avc: denied { name_connect } for ...
0
votes
1answer
149 views

How to grant 'search' permission in SELinux

I am trying to get dspam working under SELinux (CentOS 7). I added the following without issue: allow dspam_t dspam_rw_content_t:dir getattr; allow dspam_t dspam_rw_content_t:file { append getattr ...
1
vote
0answers
55 views

You don't have permission to access /{local} on this server even though allowed from all

I'm trying to set up a local repository on my cluster but when I try to access to the defined directory with curl "http://$(hostname -f):80/local_HDP/" , the error messages shown <html><...
0
votes
1answer
2k views

Set permission and ownership correctly, still getting “storage/logs/laravel.log” Permission denied

There are lots of Q&As for this problem: "storage/logs/laravel.log" could not be opened: failed to open stream: Permission denied The solution, correctly, is to set the right permissions for ...
0
votes
0answers
25 views

sh(conf) script can not run php file

I am trying to run a php script within my fail2ban action file. When I disable selinux everything works fine, but when I enabled it again I get a constant error in my fail2ban log. php.conf (action) ...
0
votes
1answer
123 views

Why has my existing Nginx failed to run after rebooting the system which says 13: Permission denied, although chmod 777?

My Nginx configured with docker. but when I reboot my system my existing nginx failed to run, I face the error message: [emerg] 1#1: open() "/etc/nginx/nginx.conf" failed (13: Permission denied)
0
votes
1answer
151 views

Change SE Linux context label of a specific folder inside a cifs mount

I have cifs mount on my setup mounted via /etc/fstab with context set to system_u:object_r:cifs_t:s0. There are some specific folders that I want to override default context to set public_content_t ...
3
votes
2answers
3k views

How to run an X11 application (xclock) on podman?

podman says Error: Can't open display: localhost:10.0 when I try to run xclock in a container with the command podman run -ti -e DISPLAY --rm -v ~/.Xauthority:/root/.Xauthority:Z localhost/...
0
votes
2answers
123 views

SElinux enforcing status is different from the config file

Deal All I have a problem with SELinux. In the config file SELINUX=enforcing but when i run getenforcing command i get disabled. I rebooted the server to see if there is any changes but stil the ...
0
votes
1answer
302 views

How to mount iso file with selinux context

I am trying to mount iso file in /var/ftp/pub/centos When I try to access those files using ftp in web browser it's not working . After troubleshooting I found that it's because of selinux. dr-xr-...
0
votes
1answer
1k views

selinux preventing PHP/Roundcube from connecting to local SMTP or IMAP ports

EDIT: I've determined the cause is selinux. After disabling enforcement with setenforce 0 everything worked. So the new question is, what's going on with selinux? I only have default CentOS 7 policies....
0
votes
1answer
105 views

Fedora 27 LXDE closing lid doesn't lock the screen (selinux acpid xscreensaver-command)

I've installed acpid and setup an event for lid close which works in debug mode, however I cannot get it to work when acpid is started by systemd. I used the suggestions here to configure acpid Linux ...
0
votes
2answers
1k views

H00035: access to “file.php” denied, how to properly setup SELinux?

I have been struggling for the last days with this issue and so far I am not able to find any solution. The issue in a few words is (error message): H00035: access to index.php denied because ...
0
votes
0answers
332 views

Unable to SSH From External

I have a CentOS 7.5 machine behind a TP Link router. I have enabled the port forwarding in the router (and rebooted). However, for some reason, I can ping the router but I can't telnet nor ssh to ...
3
votes
1answer
7k views

chmodding files with an SELinux security context / ACL

Okay, so I have a bunch of bash & python scripts that I've written, all just chilling together in one big directory. Well, actually there are separate subdirectories, but they're all nested in ...
0
votes
2answers
1k views

SELinux: restorecon wont change context to httpd_sys_content_t

I need to use Puppeteer on a Centos 7.4.1708 system but when I have SELinux set to Enforcing I'm getting AVC errors. If I run sudo cat /var/log/messages I get: SELinux is preventing /var/www/...
0
votes
1answer
1k views

Ubuntu - SSH - Unable to get valid context for <user>

I'm seeing a strange warning when I log onto my Ubuntu box from my Mac, "Unable to get valid context for <user>". I don't remember when this started, or what could've possibly changed to cause ...
0
votes
1answer
2k views

Unable to SSH after enforcing SELinux

We have an ubuntu VM on Azure. We replaced AppArmor with SELinux using Debian packages (selinux-basics_0.5.2_all.deb & selinux-policy-default_2.20140421-9_all.deb). Everything works well when ...
0
votes
0answers
380 views

Enable FFMPEG execution under Apache + Django + WSGI on CentOS 7 (SELinux)

I have a website running under Django and Apache (httpd) and inside a view I need to call FFMPEG to convert an image to video. It worked on Ubuntu 12 for years, but now we have to migrate it to CentOS ...
0
votes
1answer
295 views

Keeps detecting SELinux as enabled even though I disabled it (When trying to install FreePBX)

I was following this guide to install FreePBX on CentOS 6.9 (minimaslist), everything worked, until the last step to install FreePBX: ./install -n from /usr/src/freepbx, I keep getting the follwing ...
2
votes
1answer
8k views

Linux console: “Unable to get valid context for…”

I have the warning Unable to get valid context for crimbo appearing at login, and I have not been able to fix it... Welcome to Ubuntu 16.04.2 LTS (GNU/Linux 4.4.0-83-generic x86_64) ...
0
votes
1answer
739 views

Cant start zabbix server while firewall on

I installed zabbix server and its prerequisites and did not get any error during the process. But at the end when i type systemctl start zabbix-server Job for zabbix-server.service failed because a ...
0
votes
1answer
114 views

Puppet selboolean module

I have the following puppet module: selboolean { 'scan system': name => 'scan system', persistent => true, provider => 'antivirus_can_scan_system', value => ...
2
votes
0answers
686 views

running bash script in network namespace with systemd and selinux enforcing?

I have a script that needs to run in a network namespace (ip netns exec), and I have written a systemd service file. It fails to start however, journalctl -xe reports: ip[7918]: exec of "/usr/share/...
2
votes
0answers
396 views

How do I make a new SELinux context and add it to a file/directory?

I have the following audit.log type=AVC msg=audit(1484787464.870:381223): avc: denied { execute } for pid=10683 comm="pipe" name="tmp.pl" dev=xvde ino=30503 scontext=unconfined_u:system_r:...
2
votes
1answer
1k views

CentOS7, SELinux, Apache, PHP-FPM: Access denied for file_put_contents to a user dir

I have a CentOS7/Apache multi-user (userdir) setup with SELinux enabled and the following directory structure: /home/USER/public_html/resources/css The whole /home/USER directory and everything ...
4
votes
2answers
7k views

How do I change security context on a directory in CentOS with SELinux?

I tried to change it, but it wouldn't let me. # ls -dZ /usr/local/spamassassin drwx------. spam spam system_u:object_r:usr_t:s0 /usr/local/spamassassin # chcon -v --type=spamd_t /usr/local/...
0
votes
2answers
3k views

Unable to ssh into server: No supported authentication methods available

After trying some tips from various blogs on how to secure ssh connections to a server, I’m now unable to access my server. I receive this error message: (Disconnected: No supported authentication ...
1
vote
0answers
39 views

How do I update my kernel

So I have this kernel source and I need to update the selinux version, in order to make it support android 6.0 the last thing it supported was 4.4, how do I do that? https://github.com/Packmaan7144/...
1
vote
4answers
9k views

SElinux prevent cron from running Centos 7

I was using a cronjob to start a script that will trigger my teamspeak on reboot It was working fine for a while until i activated Selinux the cron dont work anymore I have this error on the cron ...
0
votes
1answer
539 views

Which namespaces of xattrs a non root user can set in android?

I know it isn’t possible to setsecurity.capabilitiesattributes without uid 0 or CAP_SETFCAP. However I was unable to find a complete list of what namespaces of names are allowed or what are those ...