Questions tagged [selinux]
NSA Security-Enhanced Linux (SELinux) is an implementation of a flexible mandatory access control architecture in the Linux operating system.
674
questions
0
votes
0
answers
10
views
binary executable in java android permission denied
I'm trying to use busybox in my non-rooted application but for some reason I'm getting a permission denied error, I'm testing on Android 11 and I gave all permissions to the executable like 'chmod 777'...
0
votes
1
answer
43
views
PHP PDO Unix socket to Postgresql fails
Testing out a LAMP like application, fails with:
SQLSTATE[08006] [7] connection to server on socket "/tmp/.s.PGSQL.5432" failed: No such file or directory
After a lot of troubleshooting, I ...
0
votes
1
answer
78
views
Producing a user build of AOSP with permissive SElinux policy
I am going to build an AOSP 13 for a Pixel 4a device. I have embedded a few system apps related to OTA functionalities. So, the system needs to be set permissive after each boot operation. I know that ...
0
votes
0
answers
29
views
Selinux reference one type in another file
I'm working on a avc denial in AOSP project.
When I try to fix it in the appropriate file: vendor/somevendor/common/sepolicy/product/private/some_app.te
allow some_app some_debugfs:dir search;
I get ...
0
votes
0
answers
24
views
What is the difference between RHEL and RHCOS when it comes to Selinux. csi-driver-registrar sidecar container works without privilege access in RHEL
On a RHEL setup, csi-driver-registrar has following securitycontext
securityContext:
runAsNonRoot: false
runAsUser: 0
privileged: false
...
0
votes
1
answer
125
views
How to allow system_app set vendor_default_prop, or mtk_hal_camera (in vnd partition) get system_prop?
I tried to set a persist prop from a system_app, and get it from the mtk_hal_camera process. I tried 2 ways, neither worked:
system_app set system_prop OK, but mtk_hal_camera get system_prop FAILED:
...
0
votes
1
answer
47
views
need solution for sys_rawio AVC denial error in Android
I am creating native HAL service in android and provides an interface to read information's from SCSI devices. In-order to read information's form the SCSI devices, i used ioctl with SG_IO request to ...
0
votes
0
answers
38
views
How to disable SELinux running Android Operating Software in Orange Pi 3 LTS
As of this instance, my application needed to read and write from the android application that need an access to the boards core system to read and write. Currently, the error appears to be related ...
-1
votes
1
answer
29
views
in yocto selinux the selinux-image.bbclass fails
i am building a readonly rootfs from yocto and i need to add the selinux. i added
inherit selinux-image
#install SELinux packages
IMAGE_INSTALL_append = "
packagegroup-core-selinux
"
...
0
votes
0
answers
55
views
Creating bash for systemd running background
I am trying to write a script to log the change in MySQL table:
/home/user/trigger_systemd/check_db1.bash
#!/bin/bash
mysqloption='--defaults-extra-file=/home/user/.mycnf/local_root.cnf'
lastUpdate_0=...
0
votes
0
answers
134
views
How to get SELinux status on Android
So far I have tried a few methods available on the official website and other online sources. Such as getting the result by executing the getenforce command.
private fun isSELinuxEnabled(): () -> ...
0
votes
0
answers
100
views
Adding a daemon process in Android and SELinux
I am struggling to add a daemon process for system (not vendor). I added this process to init.rc:
service start_md /system/bin/start_md
class core
user root
seclabel u:r:start_md:s0
in ...
1
vote
2
answers
69
views
running python script under httpd_t SELinux context
I have a python script, running as a systemd unit, that I need to run in the httpd_t SELinux context under the nginx user, I have tried using runcon but it says that the transition is not allowed and ...
0
votes
1
answer
142
views
A selinux permission problem occurs when android 13 adds a new service
Added a custom service, the service name is bean, the service is no problem, manually shutting down selinux can run normally.
Established vendor/jiangc/sepolicy in aosp
vendor
└── jiangc
...
0
votes
1
answer
27
views
Can't Enable SELINUX in Yocto (Dunfell) build for imx8
I have been working on trying to enable SELINUX for Yocto Builds of my customer image for a congatec iMX8m som. It seems to install but I am unable to move to enabled (enforcing or permissive mode)
...
0
votes
0
answers
173
views
How to resolve SElinux denials in android 12 for tcontext with _app extension e.g. tcontext=priv_app
I am getting denials even after adding allow rules in the corresponding .te file. Below error I am getting for toolbox. I have added "allow toolbox platform_app:file read;" in toolbox.te ...
-1
votes
1
answer
134
views
Is there a way to create custom label for files in linux system?
Is there a way to give any file a customized "ID card", so that I can identify its source, or record anything that I want.
But at the same time, firstly, do not modify the file content, ...
0
votes
0
answers
64
views
understand weird crash stack from android 13 device
I have a android 13 device, below crash happen sometimes during bootup! but the crash stack not show the crash libname, how should I know where is the crash code line?
Cmdline: media.codec hw/android....
0
votes
0
answers
45
views
Allow bpf map_create for specific process or user
I'm running my program with my own privileged user, and SELinux blocks me from using bpf maps with the next message at /var/log/audit/audit.log:
type=AVC msg=audit(1687955676.515:405): avc: denied { ...
0
votes
1
answer
89
views
403 Forbidden on rhel 8.4 using httpd userdir on a folder that is not /home
I'm in the process of configuring our new server on RedHat 8.4 and making userdir work with httpd has been bugging me.
I've configured the file /etc/httpd/conf.d/userdir.conf as follows:
<IfModule ...
0
votes
0
answers
91
views
Android shows denial message though selinux policy for the same is available
For my appconf service, got a selinux policy already as below: (showing only required lines)
allow modeappconf system_data_file:dir search;
But throws below denial message:
W cat : type=1400 ...
0
votes
1
answer
160
views
selinux audit log flooded with avc denials to /tmp tmpfs when user is set to user_r
I want to learn to create a role based on user_r for my custom motion daemon. The daemon works fine as unconstrained, but I want to lock it down further. I am on fedora 38 coreos.
Selinux tutorials ...
0
votes
0
answers
99
views
How to get adb working in user build recovery?
I have Tecno Spark 10 pro. It has recovery ramdisk as boot. It has initboot vendorboot partitions but they are all not in use (written with 0s)
I can modify the ramdisk and change the build prop for ...
0
votes
0
answers
62
views
What does "invalid_context" in /var/log/audit/audit.log mean?
I have a SELinux log line from /var/log/audit/audit.log as below:
*type=SELINUX_ERR msg=audit(1686136392.111:154486): op=security_compute_sid invalid_context="user_u:unconfined_r:unconfined_t:s0-...
0
votes
1
answer
150
views
SELinux: root user cannot delete file, AVC denial for custom type
I want to use Pihole on Rocky Linux 9 and wrote a policy for it. During testing some files were put there (by the sed command) which I now want to clean up. Upon trying to remove the files it looks as ...
0
votes
0
answers
95
views
Cannot read a device's serial number when SELinux runs in enforcing mode
I developed a native application for Android 12 which needs access to the system property ro.boot.serialno. As the application is part of a release ROM, SELinux runs in enforcing mode.
Due to this, ...
0
votes
0
answers
25
views
Deploy app as platform_app in rooted android device
I have rooted my android device. I can put my app in /product/priv-app/debug folder. The app is a priv_app in selinux rule.
How can I make it to be a platform_app in selinux rule?
0
votes
1
answer
304
views
Selinux blocking the module. Is seboolean "nis_enabled" secure enough?
I have recently configured alerting system using vmalert module (Victoriametrics product). On my system there is an enforcing SELinux policy, which shall remain so. When trying to run vmalert, it got ...
-1
votes
1
answer
45
views
Why are uploaded files getting a httpd_tmp_t label when a custom temp dir is used?
When I use PHP's move_uploaded_file function to upload files in to a directory, those files have the label httpd_sys_rw_content_t and inherit the parent directory's ACLs. If I configure PHP to use a ...
0
votes
1
answer
220
views
Rsync & SELinux - Required SELinux Settings Required
TL/DR: SELinux stopping Rsync from writing to local Repository Mirror from Public Repositories - Please Help
First off: Sorry if this is posted to the wrong thread.
I've been researching this issue ...
0
votes
1
answer
73
views
Semanage fcontext httpd_user_content add new context
I have an issue because when I have added semanage fcontext -a -t httpd_user_content_t '/home/[^/]+/((domains)|(public_html))(/.+)?' this context doesn't work. For example I have created new user ...
0
votes
0
answers
60
views
bitbake recipe error setfattr: Operation not permitted
Here is a minimal excerpt from my recipe.
fakeroot label_sign_verity() {
...
SETFATTR=${TMPDIR}/sysroots-components/$(uname -m)/attr-native/usr/bin/setfattr
echo $(whoami) #prints root ...
0
votes
1
answer
129
views
Can selinux be permissive during the build process?
I downloaded the AOSP code from Ubuntu as below.
repo init -u https://android.googlesource.com/platform/manifest -b android-10.0.0_r39
After that, the downloaded code was built and flashed.
The Pixel ...
0
votes
0
answers
518
views
SELINUX Error: Failed to resolve typeattributeset statement at /var/lib/selinux/targeted/tmp/modules/100/abrt/cil:73
On Redhat 8, based on the following SELINUX denial log generated in audit.log (note I have replaced sections of the original log with three dots for the sake of confidentiality):
type=AVC msg=audit(......
0
votes
0
answers
79
views
Android App Development: SELinux blocks permission to read file
I'm currently trying to get OpenJDK 17 JRE to work in my Android App. I've used some of the code by PojavLauncher to get a better understanding of how to get Java 17 to run on Android.
Java itself is ...
0
votes
0
answers
130
views
/sys/fs/selinux/policy doesn't get loaded
I am working in an ecosystem wherein a main server running RHEL8.4 boots up first, and then for any accessory single CPU machine that boots up subsequently, a copy of the loaded OS is transferred at ...
0
votes
0
answers
270
views
Rancher RKE on Fedora CoreOS fails with SELinux
I'm trying to install Ranche RKE on some Fedora CoreOS 37 VMs. The installation happens through a SSH bastion host and I set up SSH key pairs correctly.
I got the following error during the ...
0
votes
1
answer
196
views
ssmtp called from a script fails with ssmtp: Cannot open mailhub:25 but script is running with user in mail group
I am trying to get motion to run a script on the on_movie_end event.
The script, below, calls ssmtp to send the file as an attachment. If I call the file from the command line, as the normal user, or ...
0
votes
1
answer
138
views
What is the format of an selinux context (security_context_t)?
The getfilecon() API call is declared to return a security_context_t as follows:
int getfilecon(const char *path, security_context_t *con);
What is the formal definition of a security_context_t?
...
0
votes
0
answers
155
views
SELinux-ValueError: unable to open /sys/fs/selinux/policy: invalid argument
In the process of trying to address SELinux denials reported in /data/var/log/audit/audit.log as a batch using bash script, based on the approach outlined in
How can I make SELinux allow access to a ...
0
votes
0
answers
27
views
How to create a symlink from /sys/fs/selinux to user space?
Working with SELinux, I would like the /sys/fs/selinux/ folder be soft-linked to /data/sys/fs/selinux on boot, so that during successive reboots I would be working with the same policy file.
Is there ...
0
votes
0
answers
466
views
NEVERALLOW error when writing a SEPolicy rule
I am new to AOSP world, and definitely new to SELinux and SEPolicy.
I see in the logcat the following two errors are logged as soon as I faceunlock my device:
avc: denied { read } for name="u:...
0
votes
0
answers
160
views
Fields specified in seLinuxOptions section not getting applied to containers
I have an on-prem v1.24.6 Kubernetes cluster with selinux enabled on worker nodes (set to permissive), which are running containerd version 1.6.15.
[root@master-1 ~]# kubelet --version
Kubernetes v1....
-1
votes
1
answer
189
views
SELinux problem during RPMS repository configuration with Ansible
I am using this Ansible task to deploy an rpm package to an RHEL8 server:
- name: Add the shibboleth Repository configuration
yum_repository:
name: security_shibboleth
description: ...
0
votes
0
answers
118
views
SE Linux Android 9 AOSP: Adding some permissions in system/sepolicy/non_plat/my_app.te file leading to a build failure
I am working on Android 9 AOSP for Car, when I add some permissions in my my_app.te (located in system/sepolicy/non_plat/my_app.te), my build fails.
ERROR 'unknown type statsd' at token ';' on line...
...
0
votes
0
answers
113
views
selinux is preventing from execute access on the "binary file .so"
With Rhel 8.1, I'm working on a project for middleware between the client and the server. I must launch the Apache server in this project in order for the middleware features to operate as intended.
...
0
votes
0
answers
31
views
Discrepancy between link type and its target type
I am running SELinux in permissive mode on Redhat8 server.
I am seeing a discrepancy between the types reported by ls -Z for a link file /etc/systemd/system/multi-user.target.wants/target.service ...
1
vote
2
answers
440
views
RHEL - SELinux access control errors
I have problem with SElinux privilages with docker, in docker i run mailcow but now i have a blank screen and looks like it might be problem with privilages.
Because diagnostic says this:
SELinux is ...
1
vote
2
answers
258
views
file_get_contents(/target/file/here/file.json): Failed to open stream: Permission denied in homepage.php
I'm trying to read a json file from my php code by using file_get_contents but I get "Failed to open stream: Permission denied", but it worked when I tried to make selinux in Permissive mode....
0
votes
0
answers
482
views
Cannot execute file in android "No such file or directory" even though I can read the file
I sideloaded a binary that I built using the NDK for android and I used to be able to push it to /data and then I could run it by just calling it in adb shell with /data/program.
Now suddenly, without ...