Questions tagged [selinux]

Security-Enhanced Linux (SELinux) is a Linux kernel security module that provides a mechanism for supporting access control security policies.

Filter by
Sorted by
Tagged with
0
votes
0answers
26 views

linux login user not having the expected selinux context

I have a centos 7 based server. The login user is always showing up as system_u user in "id -Z". But according to semanage login -l, it should be unconfined_u. What could be the problem ? # semanage ...
0
votes
0answers
18 views

XenForo folder permission error

Recently I migrated my website from a server to another. The OS and the web server software are the same on both servers (Apache HTTPD on CentOS 7). When I transferred the forum I encountered a ...
0
votes
0answers
43 views

Is it possible to limit the permissions of a user based on his or her actions?

I'm currently working on a research project, that includes the question, if it is possible to implement a Chinese-Wall based information flow control model based on SELinux. One of the core principles ...
0
votes
2answers
119 views

Restricting Access to Files when Standard Linux Permissions Won't Suffice

I administer several RHEL 6.9 systems. On each system, a particular directory, call it /app_dir, is the top level of where our project's scripts, executables, configuration files, and logs are stored. ...
0
votes
1answer
46 views

How do I run a War File in confined SELinux domain on CentOS7?

I am currently working on the deployment of my Java Web Application. This application is available to me as a WAR file. My goal is that the application starts with a limited SELinux startup. This ...
0
votes
0answers
22 views

Allow httpd access to a system file with SELinux

On a host is a dnsmasq server, and using PHP I have a simple script which fetches the contents of the dnsmasq leases file and displays the active leases on a web page: // load and loop each client ...
-1
votes
1answer
18 views

What is the different between file with Selinux Context and without Selinux Context?

Good day, Today I compare file permission of 2 environment. Found that 1 of it having the dot at the end of the permission, but another environment no have. Environment 1 (with Selinux Context): -...
1
vote
1answer
203 views

Mounting docker into container shows executable but errors with: /usr/bin/docker: No such file or directory

Enviornment details $ docker --version Docker version 19.03.4, build 9013bf583a $ hostnamectl Static hostname: ohpc.novalocal Icon name: computer-vm Chassis: vm ...
0
votes
3answers
275 views

Cannot execute systemd service running as a non privileged user on CentOS 8

There is (maybe) a change between CentOS 7 and 8 in regard of systemd and selinux I yet do not know how to deal with this. For some reason (cross distribution compat) we are using postgresql 9.6 from ...
0
votes
0answers
14 views

What should the selinux context be for ecryptfs encryted homedir

I am running fedora 30 with an encrypted homedir using ecryptfs, and selinux set to enforcing. Most of it works just fine out of the box, but I do keep getting some AVC denial errors once in a while. ...
1
vote
1answer
38 views

syslog-ng starts and runs fine manually… starts but doesnt create logs when using systemd

Redhat 7.6 with latest syslog-ng (3.22) ive searched and tried all the old remedies. Nothing has worked to resolve this. My syslog-ng.conf file has a bunch of ports and a bunch of destinations. When ...
0
votes
0answers
186 views

CentOS 7 failed to load SELinux Policy and Failed to connect to system bus

Today i started my CentOS 7 on VirtualBox as usual but get this error: Failed to load SELinux Policy. Freezing. I found the solution and reinstalled it from rescue mod on DVD. I run this: chroot /...
0
votes
2answers
48 views

SELinux blocking procmail from executing dspam but no AVC message

I have a CentOS 7 system in which I use postfix as the MTA. Certain users use procmail via .forward in their home directories: # cat .forward "|exec /usr/bin/procmail -f- || exit 75" In this case, I ...
0
votes
0answers
30 views

chattr command in logrotate prerotate script; selinux blocking with “operation not permitted”

I have a logrotate script that runs a chattr command as part of the prerotate. In /var/spool/mail/root I am getting chattr: Operation not permitted while setting flags on /var/log/messages I know ...
0
votes
0answers
30 views

Implementing SElinux in production environment

I am trying to implement SElinux in production environment. Presently I have set it to permissive in the server(Centos 6). I have added the custom apache ports to the respective domain. He comes the ...
0
votes
0answers
23 views

CentOS 7 SELinux not enforcing

I have a fresh install of CentOS 7 in a VM. All HTTPD booleans are off and SELinux is enforcing. I'm seeing several things I don't understand: restorecon fails to change contexts in /etc/httpd/conf.d ...
0
votes
1answer
468 views

Fedora 30 boot freeze - Failed to load SELinux policy

Updated Fedora 30 (workstation) via CLI sudo dnf upgrade -y everything ok, updates downloaded and installed. SELinux configuration file is set as follows: SELINUX = disabled Then reboot. System ...
1
vote
1answer
109 views

Generate selinux policy from audit2allow

I need to upload to aws from logrotate. When the logrotate is triggered the SELinux blocking it. The error line is type=AVC msg=audit(1562162502.670:101127): avc: denied { name_connect } for ...
0
votes
1answer
50 views

How to grant 'search' permission in SELinux

I am trying to get dspam working under SELinux (CentOS 7). I added the following without issue: allow dspam_t dspam_rw_content_t:dir getattr; allow dspam_t dspam_rw_content_t:file { append getattr ...
1
vote
0answers
54 views

You don't have permission to access /{local} on this server even though allowed from all

I'm trying to set up a local repository on my cluster but when I try to access to the defined directory with curl "http://$(hostname -f):80/local_HDP/" , the error messages shown <html><...
0
votes
0answers
87 views

tmux doesn't start in centos 7 + SELinux

I have a server with Centos 7 + SELinux in enforcing mode, running several internet services without problems. The problem is that when you run tmux as a non-root user, it doesn't run and shows c1;2 ...
0
votes
1answer
2k views

Set permission and ownership correctly, still getting “storage/logs/laravel.log” Permission denied

There are lots of Q&As for this problem: "storage/logs/laravel.log" could not be opened: failed to open stream: Permission denied The solution, correctly, is to set the right permissions for ...
0
votes
0answers
24 views

sh(conf) script can not run php file

I am trying to run a php script within my fail2ban action file. When I disable selinux everything works fine, but when I enabled it again I get a constant error in my fail2ban log. php.conf (action) ...
0
votes
1answer
106 views

Why has my existing Nginx failed to run after rebooting the system which says 13: Permission denied, although chmod 777?

My Nginx configured with docker. but when I reboot my system my existing nginx failed to run, I face the error message: [emerg] 1#1: open() "/etc/nginx/nginx.conf" failed (13: Permission denied)
0
votes
1answer
92 views

Change SE Linux context label of a specific folder inside a cifs mount

I have cifs mount on my setup mounted via /etc/fstab with context set to system_u:object_r:cifs_t:s0. There are some specific folders that I want to override default context to set public_content_t ...
0
votes
1answer
1k views

How to run an X11 application (xclock) on podman?

podman says Error: Can't open display: localhost:10.0 when I try to run xclock in a container with the command podman run -ti -e DISPLAY --rm -v ~/.Xauthority:/root/.Xauthority:Z localhost/...
0
votes
2answers
90 views

SElinux enforcing status is different from the config file

Deal All I have a problem with SELinux. In the config file SELINUX=enforcing but when i run getenforcing command i get disabled. I rebooted the server to see if there is any changes but stil the ...
0
votes
1answer
214 views

How to mount iso file with selinux context

I am trying to mount iso file in /var/ftp/pub/centos When I try to access those files using ftp in web browser it's not working . After troubleshooting I found that it's because of selinux. dr-xr-...
0
votes
1answer
719 views

selinux preventing PHP/Roundcube from connecting to local SMTP or IMAP ports

EDIT: I've determined the cause is selinux. After disabling enforcement with setenforce 0 everything worked. So the new question is, what's going on with selinux? I only have default CentOS 7 policies....
0
votes
1answer
91 views

Fedora 27 LXDE closing lid doesn't lock the screen (selinux acpid xscreensaver-command)

I've installed acpid and setup an event for lid close which works in debug mode, however I cannot get it to work when acpid is started by systemd. I used the suggestions here to configure acpid Linux ...
0
votes
2answers
719 views

H00035: access to “file.php” denied, how to properly setup SELinux?

I have been struggling for the last days with this issue and so far I am not able to find any solution. The issue in a few words is (error message): H00035: access to index.php denied because ...
0
votes
0answers
255 views

Unable to SSH From External

I have a CentOS 7.5 machine behind a TP Link router. I have enabled the port forwarding in the router (and rebooted). However, for some reason, I can ping the router but I can't telnet nor ssh to ...
3
votes
1answer
4k views

chmodding files with an SELinux security context / ACL

Okay, so I have a bunch of bash & python scripts that I've written, all just chilling together in one big directory. Well, actually there are separate subdirectories, but they're all nested in ...
0
votes
2answers
979 views

SELinux: restorecon wont change context to httpd_sys_content_t

I need to use Puppeteer on a Centos 7.4.1708 system but when I have SELinux set to Enforcing I'm getting AVC errors. If I run sudo cat /var/log/messages I get: SELinux is preventing /var/www/...
0
votes
1answer
1k views

Ubuntu - SSH - Unable to get valid context for <user>

I'm seeing a strange warning when I log onto my Ubuntu box from my Mac, "Unable to get valid context for <user>". I don't remember when this started, or what could've possibly changed to cause ...
0
votes
1answer
2k views

Unable to SSH after enforcing SELinux

We have an ubuntu VM on Azure. We replaced AppArmor with SELinux using Debian packages (selinux-basics_0.5.2_all.deb & selinux-policy-default_2.20140421-9_all.deb). Everything works well when ...
0
votes
0answers
329 views

Enable FFMPEG execution under Apache + Django + WSGI on CentOS 7 (SELinux)

I have a website running under Django and Apache (httpd) and inside a view I need to call FFMPEG to convert an image to video. It worked on Ubuntu 12 for years, but now we have to migrate it to CentOS ...
0
votes
1answer
252 views

Keeps detecting SELinux as enabled even though I disabled it (When trying to install FreePBX)

I was following this guide to install FreePBX on CentOS 6.9 (minimaslist), everything worked, until the last step to install FreePBX: ./install -n from /usr/src/freepbx, I keep getting the follwing ...
1
vote
1answer
6k views

Linux console: “Unable to get valid context for…”

I have the warning Unable to get valid context for crimbo appearing at login, and I have not been able to fix it... Welcome to Ubuntu 16.04.2 LTS (GNU/Linux 4.4.0-83-generic x86_64) ...
0
votes
1answer
694 views

Cant start zabbix server while firewall on

I installed zabbix server and its prerequisites and did not get any error during the process. But at the end when i type systemctl start zabbix-server Job for zabbix-server.service failed because a ...
0
votes
1answer
110 views

Puppet selboolean module

I have the following puppet module: selboolean { 'scan system': name => 'scan system', persistent => true, provider => 'antivirus_can_scan_system', value => ...
2
votes
0answers
633 views

running bash script in network namespace with systemd and selinux enforcing?

I have a script that needs to run in a network namespace (ip netns exec), and I have written a systemd service file. It fails to start however, journalctl -xe reports: ip[7918]: exec of "/usr/share/...
2
votes
0answers
345 views

How do I make a new SELinux context and add it to a file/directory?

I have the following audit.log type=AVC msg=audit(1484787464.870:381223): avc: denied { execute } for pid=10683 comm="pipe" name="tmp.pl" dev=xvde ino=30503 scontext=unconfined_u:system_r:...
2
votes
1answer
1k views

CentOS7, SELinux, Apache, PHP-FPM: Access denied for file_put_contents to a user dir

I have a CentOS7/Apache multi-user (userdir) setup with SELinux enabled and the following directory structure: /home/USER/public_html/resources/css The whole /home/USER directory and everything ...
4
votes
2answers
5k views

How do I change security context on a directory in CentOS with SELinux?

I tried to change it, but it wouldn't let me. # ls -dZ /usr/local/spamassassin drwx------. spam spam system_u:object_r:usr_t:s0 /usr/local/spamassassin # chcon -v --type=spamd_t /usr/local/...
0
votes
2answers
2k views

Unable to ssh into server: No supported authentication methods available

After trying some tips from various blogs on how to secure ssh connections to a server, I’m now unable to access my server. I receive this error message: (Disconnected: No supported authentication ...
1
vote
0answers
39 views

How do I update my kernel

So I have this kernel source and I need to update the selinux version, in order to make it support android 6.0 the last thing it supported was 4.4, how do I do that? https://github.com/Packmaan7144/...
1
vote
3answers
7k views

SElinux prevent cron from running Centos 7

I was using a cronjob to start a script that will trigger my teamspeak on reboot It was working fine for a while until i activated Selinux the cron dont work anymore I have this error on the cron ...
0
votes
1answer
491 views

Which namespaces of xattrs a non root user can set in android?

I know it isn’t possible to setsecurity.capabilitiesattributes without uid 0 or CAP_SETFCAP. However I was unable to find a complete list of what namespaces of names are allowed or what are those ...
4
votes
1answer
2k views

Apache can't access /var/www/html

Apache is denying access to all the files in /var/www/html. It claims it's because of file permissions, but the whole /var/www directory is chmod 755 and owned by apache:apache. Apache error log: ...