Questions tagged [selinux]

Security-Enhanced Linux (SELinux) is a Linux kernel security module that provides a mechanism for supporting access control security policies.

Filter by
Sorted by
Tagged with
0 votes
0 answers
14 views

Permission denied when trying to create file in with .timer extension as root in /usr/lib/systemd/system directory

when running as root on RHEL 8 machine i get: touch /usr/lib/systemd/system/asdf.timer touch: cannot touch '/usr/lib/systemd/system/asdf.timer': Permission denied selinux has been disabled and ...
user avatar
1 vote
1 answer
67 views

Can environment variables be made immutable?

With the recent discovery of the Symbiote vulnerability, it is now apparent that we need a mitigation for LD_PRELOAD injection attacks and similar. One way we may be able to prevent this exploitation ...
user avatar
  • 897
1 vote
0 answers
14 views

Fedora Tor Failed to bind one of the listener ports

Tor Log: Jun 03 15:12:53.463 [notice] Tor 0.4.7.7 running on Linux with Libevent 2.1.12-stable, OpenSSL 1.1.1n, Zlib 1.2.11, Liblzma 5.2.5, Libzstd 1.5.2 and Glibc 2.34 as libc. Jun 03 15:12:53.463 [...
user avatar
  • 33
1 vote
0 answers
67 views

SELinux - add access rights for a new type

I am new to SELinux and I need to create a new type for a file and then specify access rights for a standard Linux user with its security context: user_u : user_r : user_t. I created new module (.te ...
user avatar
  • 11
0 votes
0 answers
21 views

Is there a difference between SELinux behaviour between different kernel versions?

between kernel 3.x and 4.x, if SELinux is permissive, is it possible that a process doesn't have access to a particular file for one case and not for the other? Where can I read exact changelog?
user avatar
0 votes
0 answers
133 views

Why does a shared samba directory show different file permissions?

The file permission in my samba server (local filesystem) are as follows: -rw-r-----+ 1 sambaserver sambaserver 49 Jan 9 01:14 staticfile.md However, when accessed remotely through a client, the ...
user avatar
  • 11
0 votes
0 answers
20 views

selinux ssh key login

I want to know how to enable and disable ssh key on Ubuntu 20.4 and CentOS 8. On both systems selinux is on Enforcing. On both systems I turn it on or off: setsebool -P ssh_keysign off setsebool -P ...
user avatar
  • 1
0 votes
0 answers
23 views

SElinux allow policy for particular process

While trying to debug why a command was failing in RHEL7, it was found that SElinux was blocking the command to run. It was fixed by having a allow policy to let process transition from initrc_t to ...
user avatar
  • 173
0 votes
0 answers
19 views

Frequent SE Linux alert after upgrading systemd from rpm rebuild

This is the scenario. I am using CentOS 8 and I have updated the systemd to a higher version (rebuild rpm from fedora 33). Now I get frequent SE Linux alert. I am pretty sure its not a systemd bug, ...
user avatar
  • 373
1 vote
1 answer
54 views

Can SELinux brick your server?

I have enabled SELinux on CentOS Stream (it was in disabled state before, do not know the exact history). I simply changed the following line in /etc/selinux/config (it was disabled before): SELINUX=...
user avatar
  • 123
1 vote
0 answers
93 views

Use SELinux(?) to disable root access to iptables for procrastination

This might not be a problem for you but I suffer from poor impulse control and as a result constant procrastination while in front of a computer. I can't procrastinate much on my phone because I ...
user avatar
0 votes
1 answer
68 views

Selinux: changing root mapping

I want to control some accesses of root in Linux- fedora, for example, I want to run a process and I want root not to be able to kill it. I use SELinux and I changed root mapping from unconfined to ...
user avatar
  • 1
1 vote
1 answer
206 views

How to add a capability to SELinux custom role?

I created a role foo_r, and I would like that a user with this role, can open a reserved port (< 1024) with the CAP_NET_BIND_SERVICE capability. For this I added a security context: policy_module(...
user avatar
0 votes
1 answer
430 views

How to get "su" to work in init scripts in Red Hat 8 with SELinux?

In an init script I'm trying to run a command: su - user -c "/home/user/bin/command” but SELinux prevents this: systemd[1]: Starting LSB: Start the my_script at boot... su[5941]: pam_unix(su-l:...
user avatar
  • 101
0 votes
0 answers
96 views

How can I get my gnome lockscreen as default instead of the grey system one?

Suddenly my lockscreen changed from the gnome (blue one) lockscreen that detects the username and asks for password to the login screen that asks for both username and password. I am trying to get it ...
user avatar
1 vote
0 answers
446 views

Unable to login after switching to "multi-user" target in Yocto Linux

I have a device running yocto(warrior) and selinux is enabled by default. I am unable to login to device if I switch to multi-user target. If I change selinux in permissive mode, I am able to login ...
user avatar
0 votes
1 answer
352 views

CentOS 8 auditd AVC denials message flood caused by denied setuid

Today my CentOS 8 suddenly frozen and not responding to user inputs. When I tried to login from console, I saw messages like these: audit: backlog limit exceeded audit: backlog limit exceeded audit: ...
user avatar
  • 1
0 votes
1 answer
188 views

How can an SELinux filesystem be relabeled in an unpacked squashfs filesystem?

I am trying to configure selinux for a live boot Debian system. SELinux is inoperable due to copious changes during build and system configuration and requires the entire filesystem to be relabeled. ...
user avatar
  • 59
0 votes
0 answers
50 views

Is it possible to limit the permissions of a user based on his or her actions?

I'm currently working on a research project, that includes the question, if it is possible to implement a Chinese-Wall based information flow control model based on SELinux. One of the core principles ...
user avatar
0 votes
2 answers
126 views

Restricting Access to Files when Standard Linux Permissions Won't Suffice

I administer several RHEL 6.9 systems. On each system, a particular directory, call it /app_dir, is the top level of where our project's scripts, executables, configuration files, and logs are stored. ...
user avatar
  • 839
0 votes
1 answer
210 views

How do I run a War File in confined SELinux domain on CentOS7?

I am currently working on the deployment of my Java Web Application. This application is available to me as a WAR file. My goal is that the application starts with a limited SELinux startup. This ...
user avatar
  • 1
-1 votes
1 answer
49 views

What is the different between file with Selinux Context and without Selinux Context?

Good day, Today I compare file permission of 2 environment. Found that 1 of it having the dot at the end of the permission, but another environment no have. Environment 1 (with Selinux Context): -...
user avatar
1 vote
1 answer
1k views

Mounting docker into container shows executable but errors with: /usr/bin/docker: No such file or directory

Enviornment details $ docker --version Docker version 19.03.4, build 9013bf583a $ hostnamectl Static hostname: ohpc.novalocal Icon name: computer-vm Chassis: vm ...
user avatar
0 votes
3 answers
1k views

Cannot execute systemd service running as a non privileged user on CentOS 8

There is (maybe) a change between CentOS 7 and 8 in regard of systemd and selinux I yet do not know how to deal with this. For some reason (cross distribution compat) we are using postgresql 9.6 from ...
user avatar
  • 21
1 vote
1 answer
189 views

syslog-ng starts and runs fine manually... starts but doesnt create logs when using systemd

Redhat 7.6 with latest syslog-ng (3.22) ive searched and tried all the old remedies. Nothing has worked to resolve this. My syslog-ng.conf file has a bunch of ports and a bunch of destinations. When ...
user avatar
0 votes
2 answers
118 views

SELinux blocking procmail from executing dspam but no AVC message

I have a CentOS 7 system in which I use postfix as the MTA. Certain users use procmail via .forward in their home directories: # cat .forward "|exec /usr/bin/procmail -f- || exit 75" In this case, I ...
user avatar
  • 3
0 votes
1 answer
1k views

Fedora 30 boot freeze - Failed to load SELinux policy

Updated Fedora 30 (workstation) via CLI sudo dnf upgrade -y everything ok, updates downloaded and installed. SELinux configuration file is set as follows: SELINUX = disabled Then reboot. System ...
user avatar
1 vote
1 answer
275 views

Generate selinux policy from audit2allow

I need to upload to aws from logrotate. When the logrotate is triggered the SELinux blocking it. The error line is type=AVC msg=audit(1562162502.670:101127): avc: denied { name_connect } for ...
user avatar
  • 173
0 votes
1 answer
303 views

How to grant 'search' permission in SELinux

I am trying to get dspam working under SELinux (CentOS 7). I added the following without issue: allow dspam_t dspam_rw_content_t:dir getattr; allow dspam_t dspam_rw_content_t:file { append getattr ...
user avatar
  • 3
1 vote
0 answers
72 views

You don't have permission to access /{local} on this server even though allowed from all

I'm trying to set up a local repository on my cluster but when I try to access to the defined directory with curl "http://$(hostname -f):80/local_HDP/" , the error messages shown <html><...
user avatar
0 votes
1 answer
2k views

Set permission and ownership correctly, still getting "storage/logs/laravel.log" Permission denied

There are lots of Q&As for this problem: "storage/logs/laravel.log" could not be opened: failed to open stream: Permission denied The solution, correctly, is to set the right permissions for ...
user avatar
0 votes
0 answers
29 views

sh(conf) script can not run php file

I am trying to run a php script within my fail2ban action file. When I disable selinux everything works fine, but when I enabled it again I get a constant error in my fail2ban log. php.conf (action) ...
user avatar
  • 1
0 votes
1 answer
148 views

Why has my existing Nginx failed to run after rebooting the system which says 13: Permission denied, although chmod 777?

My Nginx configured with docker. but when I reboot my system my existing nginx failed to run, I face the error message: [emerg] 1#1: open() "/etc/nginx/nginx.conf" failed (13: Permission denied)
user avatar
  • 1
0 votes
1 answer
199 views

Change SE Linux context label of a specific folder inside a cifs mount

I have cifs mount on my setup mounted via /etc/fstab with context set to system_u:object_r:cifs_t:s0. There are some specific folders that I want to override default context to set public_content_t ...
user avatar
3 votes
2 answers
5k views

How to run an X11 application (xclock) on podman?

podman says Error: Can't open display: localhost:10.0 when I try to run xclock in a container with the command podman run -ti -e DISPLAY --rm -v ~/.Xauthority:/root/.Xauthority:Z localhost/...
user avatar
0 votes
2 answers
162 views

SElinux enforcing status is different from the config file

Deal All I have a problem with SELinux. In the config file SELINUX=enforcing but when i run getenforcing command i get disabled. I rebooted the server to see if there is any changes but stil the ...
user avatar
0 votes
1 answer
425 views

How to mount iso file with selinux context

I am trying to mount iso file in /var/ftp/pub/centos When I try to access those files using ftp in web browser it's not working . After troubleshooting I found that it's because of selinux. dr-xr-...
user avatar
  • 3,713
0 votes
2 answers
1k views

selinux preventing PHP/Roundcube from connecting to local SMTP or IMAP ports

EDIT: I've determined the cause is selinux. After disabling enforcement with setenforce 0 everything worked. So the new question is, what's going on with selinux? I only have default CentOS 7 policies....
user avatar
  • 581
0 votes
1 answer
119 views

Fedora 27 LXDE closing lid doesn't lock the screen (selinux acpid xscreensaver-command)

I've installed acpid and setup an event for lid close which works in debug mode, however I cannot get it to work when acpid is started by systemd. I used the suggestions here to configure acpid Linux ...
user avatar
0 votes
2 answers
1k views

H00035: access to "file.php" denied, how to properly setup SELinux?

I have been struggling for the last days with this issue and so far I am not able to find any solution. The issue in a few words is (error message): H00035: access to index.php denied because ...
user avatar
  • 341
0 votes
0 answers
362 views

Unable to SSH From External

I have a CentOS 7.5 machine behind a TP Link router. I have enabled the port forwarding in the router (and rebooted). However, for some reason, I can ping the router but I can't telnet nor ssh to ...
user avatar
  • 165
3 votes
1 answer
9k views

chmodding files with an SELinux security context / ACL

Okay, so I have a bunch of bash & python scripts that I've written, all just chilling together in one big directory. Well, actually there are separate subdirectories, but they're all nested in ...
user avatar
  • 2,531
0 votes
2 answers
1k views

SELinux: restorecon wont change context to httpd_sys_content_t

I need to use Puppeteer on a Centos 7.4.1708 system but when I have SELinux set to Enforcing I'm getting AVC errors. If I run sudo cat /var/log/messages I get: SELinux is preventing /var/www/...
user avatar
0 votes
1 answer
2k views

Ubuntu - SSH - Unable to get valid context for <user>

I'm seeing a strange warning when I log onto my Ubuntu box from my Mac, "Unable to get valid context for <user>". I don't remember when this started, or what could've possibly changed to cause ...
user avatar
0 votes
1 answer
2k views

Unable to SSH after enforcing SELinux

We have an ubuntu VM on Azure. We replaced AppArmor with SELinux using Debian packages (selinux-basics_0.5.2_all.deb & selinux-policy-default_2.20140421-9_all.deb). Everything works well when ...
user avatar
  • 101
0 votes
0 answers
422 views

Enable FFMPEG execution under Apache + Django + WSGI on CentOS 7 (SELinux)

I have a website running under Django and Apache (httpd) and inside a view I need to call FFMPEG to convert an image to video. It worked on Ubuntu 12 for years, but now we have to migrate it to CentOS ...
user avatar
0 votes
1 answer
325 views

Keeps detecting SELinux as enabled even though I disabled it (When trying to install FreePBX)

I was following this guide to install FreePBX on CentOS 6.9 (minimaslist), everything worked, until the last step to install FreePBX: ./install -n from /usr/src/freepbx, I keep getting the follwing ...
user avatar
2 votes
1 answer
10k views

Linux console: "Unable to get valid context for..."

I have the warning Unable to get valid context for crimbo appearing at login, and I have not been able to fix it... Welcome to Ubuntu 16.04.2 LTS (GNU/Linux 4.4.0-83-generic x86_64) ...
user avatar
  • 121
0 votes
1 answer
756 views

Cant start zabbix server while firewall on

I installed zabbix server and its prerequisites and did not get any error during the process. But at the end when i type systemctl start zabbix-server Job for zabbix-server.service failed because a ...
user avatar
  • 3
0 votes
1 answer
135 views

Puppet selboolean module

I have the following puppet module: selboolean { 'scan system': name => 'scan system', persistent => true, provider => 'antivirus_can_scan_system', value => ...
user avatar
  • 63