Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [selinux]

Security-Enhanced Linux (SELinux) is a Linux kernel security module that provides a mechanism for supporting access control security policies.

0
votes
1answer
32 views

SElinux enforcing status is different from the config file

Deal All I have a problem with SELinux. In the config file SELINUX=enforcing but when i run getenforcing command i get disabled. I rebooted the server to see if there is any changes but stil the ...
0
votes
1answer
27 views

How to mount iso file with selinux context

I am trying to mount iso file in /var/ftp/pub/centos When I try to access those files using ftp in web browser it's not working . After troubleshooting I found that it's because of selinux. dr-xr-...
0
votes
0answers
8 views

Changing xguest configuration

I want to use xguest in Centos 7 to provide a lab interface that is secure from tamper, malicious or otherwise. The problem I am having is how to change the resolution and add startup scripts to the ...
0
votes
1answer
70 views

selinux preventing PHP/Roundcube from connecting to local SMTP or IMAP ports

EDIT: I've determined the cause is selinux. After disabling enforcement with setenforce 0 everything worked. So the new question is, what's going on with selinux? I only have default CentOS 7 policies....
0
votes
0answers
46 views

Create a private folder in Android: set the SELinux attribute of a folder in external storage

There are quite a few apps that require read and write access to the external storage, which gives them access to the whole /sdcard directory. But since that is also the only storage the user ...
0
votes
1answer
45 views

Fedora 27 LXDE closing lid doesn't lock the screen (selinux acpid xscreensaver-command)

I've installed acpid and setup an event for lid close which works in debug mode, however I cannot get it to work when acpid is started by systemd. I used the suggestions here to configure acpid Linux ...
0
votes
2answers
247 views

H00035: access to “file.php” denied, how to properly setup SELinux?

I have been struggling for the last days with this issue and so far I am not able to find any solution. The issue in a few words is (error message): H00035: access to index.php denied because ...
0
votes
0answers
200 views

VSFTPD not listing folders with SELINUX enforcing

Im trying to login with a user on a FTP server running VSFTPD on CentOS 7. When SELINUX is enforcing it always returns a 425 error: Unable to establish connection. All the necessary ports have been ...
0
votes
0answers
98 views

Unable to SSH From External

I have a CentOS 7.5 machine behind a TP Link router. I have enabled the port forwarding in the router (and rebooted). However, for some reason, I can ping the router but I can't telnet nor ssh to ...
1
vote
1answer
892 views

chmodding files with an SELinux security context / ACL

Okay, so I have a bunch of bash & python scripts that I've written, all just chilling together in one big directory. Well, actually there are separate subdirectories, but they're all nested in ...
0
votes
1answer
419 views

SELinux: restorecon wont change context to httpd_sys_content_t

I need to use Puppeteer on a Centos 7.4.1708 system but when I have SELinux set to Enforcing I'm getting AVC errors. If I run sudo cat /var/log/messages I get: SELinux is preventing /var/www/...
0
votes
1answer
500 views

Ubuntu - SSH - Unable to get valid context for <user>

I'm seeing a strange warning when I log onto my Ubuntu box from my Mac, "Unable to get valid context for <user>". I don't remember when this started, or what could've possibly changed to cause ...
0
votes
1answer
875 views

Unable to SSH after enforcing SELinux

We have an ubuntu VM on Azure. We replaced AppArmor with SELinux using Debian packages (selinux-basics_0.5.2_all.deb & selinux-policy-default_2.20140421-9_all.deb). Everything works well when ...
0
votes
0answers
194 views

Enable FFMPEG execution under Apache + Django + WSGI on CentOS 7 (SELinux)

I have a website running under Django and Apache (httpd) and inside a view I need to call FFMPEG to convert an image to video. It worked on Ubuntu 12 for years, but now we have to migrate it to CentOS ...
0
votes
1answer
89 views

Keeps detecting SELinux as enabled even though I disabled it (When trying to install FreePBX)

I was following this guide to install FreePBX on CentOS 6.9 (minimaslist), everything worked, until the last step to install FreePBX: ./install -n from /usr/src/freepbx, I keep getting the follwing ...
0
votes
1answer
2k views

Linux console: “Unable to get valid context for…”

I have the warning Unable to get valid context for crimbo appearing at login, and I have not been able to fix it... Welcome to Ubuntu 16.04.2 LTS (GNU/Linux 4.4.0-83-generic x86_64) ...
0
votes
1answer
392 views

Cant start zabbix server while firewall on

I installed zabbix server and its prerequisites and did not get any error during the process. But at the end when i type systemctl start zabbix-server Job for zabbix-server.service failed because a ...
0
votes
1answer
78 views

Puppet selboolean module

I have the following puppet module: selboolean { 'scan system': name => 'scan system', persistent => true, provider => 'antivirus_can_scan_system', value => ...
2
votes
0answers
474 views

running bash script in network namespace with systemd and selinux enforcing?

I have a script that needs to run in a network namespace (ip netns exec), and I have written a systemd service file. It fails to start however, journalctl -xe reports: ip[7918]: exec of "/usr/share/...
2
votes
0answers
236 views

How do I make a new SELinux context and add it to a file/directory?

I have the following audit.log type=AVC msg=audit(1484787464.870:381223): avc: denied { execute } for pid=10683 comm="pipe" name="tmp.pl" dev=xvde ino=30503 scontext=unconfined_u:system_r:...
1
vote
1answer
792 views

CentOS7, SELinux, Apache, PHP-FPM: Access denied for file_put_contents to a user dir

I have a CentOS7/Apache multi-user (userdir) setup with SELinux enabled and the following directory structure: /home/USER/public_html/resources/css The whole /home/USER directory and everything ...
5
votes
2answers
2k views

How do I change security context on a directory in CentOS with SELinux?

I tried to change it, but it wouldn't let me. # ls -dZ /usr/local/spamassassin drwx------. spam spam system_u:object_r:usr_t:s0 /usr/local/spamassassin # chcon -v --type=spamd_t /usr/local/...
1
vote
2answers
2k views

Unable to ssh into server: No supported authentication methods available

After trying some tips from various blogs on how to secure ssh connections to a server, I’m now unable to access my server. I receive this error message: (Disconnected: No supported authentication ...
1
vote
0answers
39 views

How do I update my kernel

So I have this kernel source and I need to update the selinux version, in order to make it support android 6.0 the last thing it supported was 4.4, how do I do that? https://github.com/Packmaan7144/...
0
votes
3answers
3k views

SElinux prevent cron from running Centos 7

I was using a cronjob to start a script that will trigger my teamspeak on reboot It was working fine for a while until i activated Selinux the cron dont work anymore I have this error on the cron ...
0
votes
1answer
341 views

Which namespaces of xattrs a non root user can set in android?

I know it isn’t possible to setsecurity.capabilitiesattributes without uid 0 or CAP_SETFCAP. However I was unable to find a complete list of what namespaces of names are allowed or what are those ...
5
votes
1answer
2k views

Apache can't access /var/www/html

Apache is denying access to all the files in /var/www/html. It claims it's because of file permissions, but the whole /var/www directory is chmod 755 and owned by apache:apache. Apache error log: ...
0
votes
2answers
182 views

Can I sandbox a binary created in C (with GCC) for Linux and make it easy for users?

I have compiled a binary that I want to distribute to other people. It's closed-source, but I want to provide users of the binary with confidence that it cannot possibly access the internet, ...
0
votes
1answer
81 views

SELinux is blocking getty from reading /etc/issue

I recently changed my hostname, and after rebooting with the new hostname, /etc/issue stopped getting displayed on the login screen. I disabled selinux temporarily, and /etc/issue was displayed again. ...
0
votes
1answer
346 views

Sudo can't see symbollically linked executables in path

On CentOS 7, I installed some executables in /opt/app-version/bin/executable. Those executables have the following permissions: rwxrwxr-x. 500 500 Ownership of every directory in the path /opt/app-...
0
votes
1answer
2k views

How can I make SELinux allow access to a file?

I have a proprietary piece of software my company owns that needs access to a root-level file. We'll call it /secfile as it is security/license related. The system runs a daemon that writes out ...
0
votes
1answer
180 views

Using semanage in CentOS 6.6 (Virtual Machine) but it shows “Killed” (solved)

Sorry for the duplicate, since stackoverflow won't answer the question and suggest to ask it here. I have a CentOS 6.6 virtual machine (lauched in Eucalyptus Private Cloud). I guess Amazon Instance ...
2
votes
1answer
1k views

Centos 6.7 on VirtualBox loses network with SELinux disabled

I've been struggling with this issue the whole day yesterday and it seems I'm in a dead end, too much Googling, reading, and trial and error without a result, so I decided to ask the gurus (you) I'm ...
0
votes
0answers
121 views

SELinux policy for ifplugd and udev in Raspbian

I've recently enabled SELinux on my RaspberryPi and recieved some AVCs denials. I'm reading SEL documentation and have resolved a few of them. But I'm not sure if I did it right. So please review my ...
2
votes
0answers
918 views

selinux: how to enable httpd to have read-write and execute permissions

I am facing problems with PHP interface that calls perl and shell scripts. These enable uploading of a file to a folder and execute them with some input while storing output into some other files. Now ...
5
votes
2answers
2k views

selinux doesn't have httpd_can_network_connect as an option on ubuntu 15.04

I installed Ubuntu 15.04 and then installed selinux by doing sudo apt-get install selinux. I then did setsebool -P httpd_can_network_connect 0 and got a "Boolean httpd_can_network_connect is not ...
12
votes
4answers
1k views

A way to trigger an SELinux policy violation?

I'm studying the basic workings of SELinux and would find it useful to trigger a denial. My test machine is running CentOS 7, it's a basic server install without any extra services, and getenforce ...
0
votes
2answers
468 views

SELinux is preventing /opt/google/chrome-beta/nacl_helper from getattr access on the file /etc/passwd

I'm not sure why and/or if it's normal, but I keep getting popup from my SELinux Alert Browser: SELinux is preventing /opt/google/chrome-beta/nacl_helper from getattr access on the file /etc/...
1
vote
1answer
544 views

“Cannot open audit interface” upgrading libuuid1 — is selinux confused?

I have a Debian chroot on a Linux system running an alternative Linux distro. It's always worked fine in the past but in the past few months I've found myself unable to upgrade libuuid1. Instead it ...
0
votes
1answer
270 views

How to prevent SELinux from installing with CentOS 6.5

I know I can disable SELinux in CentOS 6.5, but I’d prefer to just not install it at all from the point of the actual, initial installation. But I can’t find anywhere in the CentOS installer to shut ...
2
votes
1answer
3k views

SELinux remove extended ACL

I have a set of files that can't have selinux's extended acl on them. When running ls -la I get a result similar to: -rwxr-xr-x. 1 root root 1 Aug 8 2014 filea -rwxr-xr-x. 1 root root 1 ...
2
votes
1answer
48 views

Is it possible to limit remote administration accesses of an admin using Selinux?

Suppose and admin needs to access a machine remotely.Root logins are disabled but he belongs to the sudoers list. I read that "sudo command" is good practice because you don't forget you are using ...
4
votes
1answer
1k views

HIPS for Linux (ie, interactive SELinux/AppArmor)

Windows has a number of programs (generally referred to as Host-based Intrusion Prevention Systems) that offer protection against difficult security threats (such as zero-day exploits) by blocking ...
0
votes
1answer
539 views

restorecon in CentOS does not follow fcontext order

Experimenting with file contexts, I have faced a strange behaviour and it looks to me I'm missing something. Here's what I do: Create a bunch of directories and files # mkdir -p /virtual/www/cgi-bin ...
4
votes
3answers
1k views

Is SELinux important if I'm the only one who uses my computers?

I've got two Fedora laptops and a CentoOS home server, but I'm the only person who uses any of them, with the exception of a smb share that a family member uses. Does SELinux have any real benefit if ...
0
votes
1answer
550 views

Why does ssh/sshd on server try to access /home/<user>/.ssh after I moved my users home directory?

I moved my users home directory with usermod -m -d /path/to/new/home/username which seems to have worked fine. However, in my [moved] home directory I have the ".ssh" folder that is set up to allow ...
1
vote
0answers
397 views

Is there anyway you can restrict users from executing a command with another name?

I'm not asking an obvious question here. I would like to elucidate with an example. A user 'bob' is always executing 'chmod 777 /home/bob/impfiles' so that user 'alice' could make changes to the ...
1
vote
3answers
3k views

PHP can't connect to PostgreSQL with “permission denied” error with SELinux

My PHP app can connect when I turn off SELinux, but not with it on. setenforce 0; curl -I http://domain.com; setenforce 1 Yields no errors in /var/log/httpd/error_log. However, if I have it on, I ...
0
votes
1answer
1k views

Is SELinux really useful or needed [closed]

So I noticed that Fedora takes around 35 seconds to boot and ArchBang was only taking around 15. I did soom looking into it and I guess SELinux has a lot to dow ith this and I was wondering if ...
2
votes
1answer
2k views

Installing selinux headers

I'm trying to build the newest version of glibc (2.19) on CentOS 5.6 and I've run into some issues The documentation of glibc says that I need at minimum the linux kernel headers 2.6.19 (even if this ...