Questions tagged [selinux]

NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.

Filter by
Sorted by
Tagged with
0 votes
0 answers
10 views

binary executable in java android permission denied

I'm trying to use busybox in my non-rooted application but for some reason I'm getting a permission denied error, I'm testing on Android 11 and I gave all permissions to the executable like 'chmod 777'...
sw team's user avatar
0 votes
1 answer
43 views

PHP PDO Unix socket to Postgresql fails

Testing out a LAMP like application, fails with: SQLSTATE[08006] [7] connection to server on socket "/tmp/.s.PGSQL.5432" failed: No such file or directory After a lot of troubleshooting, I ...
Big Pete's user avatar
0 votes
1 answer
78 views

Producing a user build of AOSP with permissive SElinux policy

I am going to build an AOSP 13 for a Pixel 4a device. I have embedded a few system apps related to OTA functionalities. So, the system needs to be set permissive after each boot operation. I know that ...
Mehran Alidoost Nia's user avatar
0 votes
0 answers
29 views

Selinux reference one type in another file

I'm working on a avc denial in AOSP project. When I try to fix it in the appropriate file: vendor/somevendor/common/sepolicy/product/private/some_app.te allow some_app some_debugfs:dir search; I get ...
Invader Zim's user avatar
0 votes
0 answers
24 views

What is the difference between RHEL and RHCOS when it comes to Selinux. csi-driver-registrar sidecar container works without privilege access in RHEL

On a RHEL setup, csi-driver-registrar has following securitycontext securityContext: runAsNonRoot: false runAsUser: 0 privileged: false ...
ambikanair's user avatar
  • 4,112
0 votes
1 answer
125 views

How to allow system_app set vendor_default_prop, or mtk_hal_camera (in vnd partition) get system_prop?

I tried to set a persist prop from a system_app, and get it from the mtk_hal_camera process. I tried 2 ways, neither worked: system_app set system_prop OK, but mtk_hal_camera get system_prop FAILED: ...
zhangxaochen's user avatar
  • 33.2k
0 votes
1 answer
47 views

need solution for sys_rawio AVC denial error in Android

I am creating native HAL service in android and provides an interface to read information's from SCSI devices. In-order to read information's form the SCSI devices, i used ioctl with SG_IO request to ...
Selva Kumar's user avatar
0 votes
0 answers
38 views

How to disable SELinux running Android Operating Software in Orange Pi 3 LTS

As of this instance, my application needed to read and write from the android application that need an access to the boards core system to read and write. Currently, the error appears to be related ...
Wan Ammar's user avatar
-1 votes
1 answer
29 views

in yocto selinux the selinux-image.bbclass fails

i am building a readonly rootfs from yocto and i need to add the selinux. i added inherit selinux-image #install SELinux packages IMAGE_INSTALL_append = " packagegroup-core-selinux " ...
user2095970's user avatar
0 votes
0 answers
55 views

Creating bash for systemd running background

I am trying to write a script to log the change in MySQL table: /home/user/trigger_systemd/check_db1.bash #!/bin/bash mysqloption='--defaults-extra-file=/home/user/.mycnf/local_root.cnf' lastUpdate_0=...
Troy Chan's user avatar
0 votes
0 answers
134 views

How to get SELinux status on Android

So far I have tried a few methods available on the official website and other online sources. Such as getting the result by executing the getenforce command. private fun isSELinuxEnabled(): () -> ...
Takshak Rajput's user avatar
0 votes
0 answers
100 views

Adding a daemon process in Android and SELinux

I am struggling to add a daemon process for system (not vendor). I added this process to init.rc: service start_md /system/bin/start_md class core user root seclabel u:r:start_md:s0 in ...
John Smith's user avatar
1 vote
2 answers
69 views

running python script under httpd_t SELinux context

I have a python script, running as a systemd unit, that I need to run in the httpd_t SELinux context under the nginx user, I have tried using runcon but it says that the transition is not allowed and ...
supercrazylash's user avatar
0 votes
1 answer
142 views

A selinux permission problem occurs when android 13 adds a new service

Added a custom service, the service name is bean, the service is no problem, manually shutting down selinux can run normally. Established vendor/jiangc/sepolicy in aosp vendor └── jiangc ...
Chao Jiang's user avatar
0 votes
1 answer
27 views

Can't Enable SELINUX in Yocto (Dunfell) build for imx8

I have been working on trying to enable SELINUX for Yocto Builds of my customer image for a congatec iMX8m som. It seems to install but I am unable to move to enabled (enforcing or permissive mode) ...
Josh Patterson's user avatar
0 votes
0 answers
173 views

How to resolve SElinux denials in android 12 for tcontext with _app extension e.g. tcontext=priv_app

I am getting denials even after adding allow rules in the corresponding .te file. Below error I am getting for toolbox. I have added "allow toolbox platform_app:file read;" in toolbox.te ...
anupam mazumder's user avatar
-1 votes
1 answer
134 views

Is there a way to create custom label for files in linux system?

Is there a way to give any file a customized "ID card", so that I can identify its source, or record anything that I want. But at the same time, firstly, do not modify the file content, ...
yoooPai's user avatar
  • 16
0 votes
0 answers
64 views

understand weird crash stack from android 13 device

I have a android 13 device, below crash happen sometimes during bootup! but the crash stack not show the crash libname, how should I know where is the crash code line? Cmdline: media.codec hw/android....
lucky1928's user avatar
  • 8,822
0 votes
0 answers
45 views

Allow bpf map_create for specific process or user

I'm running my program with my own privileged user, and SELinux blocks me from using bpf maps with the next message at /var/log/audit/audit.log: type=AVC msg=audit(1687955676.515:405): avc: denied { ...
rshemesh's user avatar
0 votes
1 answer
89 views

403 Forbidden on rhel 8.4 using httpd userdir on a folder that is not /home

I'm in the process of configuring our new server on RedHat 8.4 and making userdir work with httpd has been bugging me. I've configured the file /etc/httpd/conf.d/userdir.conf as follows: <IfModule ...
Florent JEHANNIN's user avatar
0 votes
0 answers
91 views

Android shows denial message though selinux policy for the same is available

For my appconf service, got a selinux policy already as below: (showing only required lines) allow modeappconf system_data_file:dir search; But throws below denial message: W cat : type=1400 ...
Nerdy's user avatar
  • 1,041
0 votes
1 answer
160 views

selinux audit log flooded with avc denials to /tmp tmpfs when user is set to user_r

I want to learn to create a role based on user_r for my custom motion daemon. The daemon works fine as unconstrained, but I want to lock it down further. I am on fedora 38 coreos. Selinux tutorials ...
miller the gorilla's user avatar
0 votes
0 answers
99 views

How to get adb working in user build recovery?

I have Tecno Spark 10 pro. It has recovery ramdisk as boot. It has initboot vendorboot partitions but they are all not in use (written with 0s) I can modify the ramdisk and change the build prop for ...
Bret Joseph's user avatar
0 votes
0 answers
62 views

What does "invalid_context" in /var/log/audit/audit.log mean?

I have a SELinux log line from /var/log/audit/audit.log as below: *type=SELINUX_ERR msg=audit(1686136392.111:154486): op=security_compute_sid invalid_context="user_u:unconfined_r:unconfined_t:s0-...
teckky's user avatar
  • 1
0 votes
1 answer
150 views

SELinux: root user cannot delete file, AVC denial for custom type

I want to use Pihole on Rocky Linux 9 and wrote a policy for it. During testing some files were put there (by the sed command) which I now want to clean up. Upon trying to remove the files it looks as ...
derdeagle's user avatar
  • 166
0 votes
0 answers
95 views

Cannot read a device's serial number when SELinux runs in enforcing mode

I developed a native application for Android 12 which needs access to the system property ro.boot.serialno. As the application is part of a release ROM, SELinux runs in enforcing mode. Due to this, ...
CRM's user avatar
  • 4,587
0 votes
0 answers
25 views

Deploy app as platform_app in rooted android device

I have rooted my android device. I can put my app in /product/priv-app/debug folder. The app is a priv_app in selinux rule. How can I make it to be a platform_app in selinux rule?
lucky1928's user avatar
  • 8,822
0 votes
1 answer
304 views

Selinux blocking the module. Is seboolean "nis_enabled" secure enough?

I have recently configured alerting system using vmalert module (Victoriametrics product). On my system there is an enforcing SELinux policy, which shall remain so. When trying to run vmalert, it got ...
Near N's user avatar
  • 1
-1 votes
1 answer
45 views

Why are uploaded files getting a httpd_tmp_t label when a custom temp dir is used?

When I use PHP's move_uploaded_file function to upload files in to a directory, those files have the label httpd_sys_rw_content_t and inherit the parent directory's ACLs. If I configure PHP to use a ...
jamieburchell's user avatar
0 votes
1 answer
220 views

Rsync & SELinux - Required SELinux Settings Required

TL/DR: SELinux stopping Rsync from writing to local Repository Mirror from Public Repositories - Please Help First off: Sorry if this is posted to the wrong thread. I've been researching this issue ...
Dulux-Oz's user avatar
0 votes
1 answer
73 views

Semanage fcontext httpd_user_content add new context

I have an issue because when I have added semanage fcontext -a -t httpd_user_content_t '/home/[^/]+/((domains)|(public_html))(/.+)?' this context doesn't work. For example I have created new user ...
inomi13's user avatar
  • 13
0 votes
0 answers
60 views

bitbake recipe error setfattr: Operation not permitted

Here is a minimal excerpt from my recipe. fakeroot label_sign_verity() { ... SETFATTR=${TMPDIR}/sysroots-components/$(uname -m)/attr-native/usr/bin/setfattr echo $(whoami) #prints root ...
user3513402's user avatar
0 votes
1 answer
129 views

Can selinux be permissive during the build process?

I downloaded the AOSP code from Ubuntu as below. repo init -u https://android.googlesource.com/platform/manifest -b android-10.0.0_r39 After that, the downloaded code was built and flashed. The Pixel ...
Rainker's user avatar
  • 11
0 votes
0 answers
518 views

SELINUX Error: Failed to resolve typeattributeset statement at /var/lib/selinux/targeted/tmp/modules/100/abrt/cil:73

On Redhat 8, based on the following SELINUX denial log generated in audit.log (note I have replaced sections of the original log with three dots for the sake of confidentiality): type=AVC msg=audit(......
Vinod's user avatar
  • 1,041
0 votes
0 answers
79 views

Android App Development: SELinux blocks permission to read file

I'm currently trying to get OpenJDK 17 JRE to work in my Android App. I've used some of the code by PojavLauncher to get a better understanding of how to get Java 17 to run on Android. Java itself is ...
benfah's user avatar
  • 21
0 votes
0 answers
130 views

/sys/fs/selinux/policy doesn't get loaded

I am working in an ecosystem wherein a main server running RHEL8.4 boots up first, and then for any accessory single CPU machine that boots up subsequently, a copy of the loaded OS is transferred at ...
Vinod's user avatar
  • 1,041
0 votes
0 answers
270 views

Rancher RKE on Fedora CoreOS fails with SELinux

I'm trying to install Ranche RKE on some Fedora CoreOS 37 VMs. The installation happens through a SSH bastion host and I set up SSH key pairs correctly. I got the following error during the ...
sctx's user avatar
  • 154
0 votes
1 answer
196 views

ssmtp called from a script fails with ssmtp: Cannot open mailhub:25 but script is running with user in mail group

I am trying to get motion to run a script on the on_movie_end event. The script, below, calls ssmtp to send the file as an attachment. If I call the file from the command line, as the normal user, or ...
miller the gorilla's user avatar
0 votes
1 answer
138 views

What is the format of an selinux context (security_context_t)?

The getfilecon() API call is declared to return a security_context_t as follows: int getfilecon(const char *path, security_context_t *con); What is the formal definition of a security_context_t? ...
Graham Leggett's user avatar
0 votes
0 answers
155 views

SELinux-ValueError: unable to open /sys/fs/selinux/policy: invalid argument

In the process of trying to address SELinux denials reported in /data/var/log/audit/audit.log as a batch using bash script, based on the approach outlined in How can I make SELinux allow access to a ...
Vinod's user avatar
  • 1,041
0 votes
0 answers
27 views

How to create a symlink from /sys/fs/selinux to user space?

Working with SELinux, I would like the /sys/fs/selinux/ folder be soft-linked to /data/sys/fs/selinux on boot, so that during successive reboots I would be working with the same policy file. Is there ...
Vinod's user avatar
  • 1,041
0 votes
0 answers
466 views

NEVERALLOW error when writing a SEPolicy rule

I am new to AOSP world, and definitely new to SELinux and SEPolicy. I see in the logcat the following two errors are logged as soon as I faceunlock my device: avc: denied { read } for name="u:...
Waddah Shamroukh's user avatar
0 votes
0 answers
160 views

Fields specified in seLinuxOptions section not getting applied to containers

I have an on-prem v1.24.6 Kubernetes cluster with selinux enabled on worker nodes (set to permissive), which are running containerd version 1.6.15. [root@master-1 ~]# kubelet --version Kubernetes v1....
Aniketh Anagawadi's user avatar
-1 votes
1 answer
189 views

SELinux problem during RPMS repository configuration with Ansible

I am using this Ansible task to deploy an rpm package to an RHEL8 server: - name: Add the shibboleth Repository configuration yum_repository: name: security_shibboleth description: ...
elster's user avatar
  • 13
0 votes
0 answers
118 views

SE Linux Android 9 AOSP: Adding some permissions in system/sepolicy/non_plat/my_app.te file leading to a build failure

I am working on Android 9 AOSP for Car, when I add some permissions in my my_app.te (located in system/sepolicy/non_plat/my_app.te), my build fails. ERROR 'unknown type statsd' at token ';' on line... ...
Akatsuki's user avatar
0 votes
0 answers
113 views

selinux is preventing from execute access on the "binary file .so"

With Rhel 8.1, I'm working on a project for middleware between the client and the server. I must launch the Apache server in this project in order for the middleware features to operate as intended. ...
Mohak's user avatar
  • 3
0 votes
0 answers
31 views

Discrepancy between link type and its target type

I am running SELinux in permissive mode on Redhat8 server. I am seeing a discrepancy between the types reported by ls -Z for a link file /etc/systemd/system/multi-user.target.wants/target.service ...
Vinod's user avatar
  • 1,041
1 vote
2 answers
440 views

RHEL - SELinux access control errors

I have problem with SElinux privilages with docker, in docker i run mailcow but now i have a blank screen and looks like it might be problem with privilages. Because diagnostic says this: SELinux is ...
ArchMatt's user avatar
1 vote
2 answers
258 views

file_get_contents(/target/file/here/file.json): Failed to open stream: Permission denied in homepage.php

I'm trying to read a json file from my php code by using file_get_contents but I get "Failed to open stream: Permission denied", but it worked when I tried to make selinux in Permissive mode....
HASSANI Hamza's user avatar
0 votes
0 answers
482 views

Cannot execute file in android "No such file or directory" even though I can read the file

I sideloaded a binary that I built using the NDK for android and I used to be able to push it to /data and then I could run it by just calling it in adb shell with /data/program. Now suddenly, without ...
Markusbug's user avatar

1
2 3 4 5
14