$ sealert -l 3e0f34bc-787a-4288-bde3-8bca65306491
SELinux is preventing /sbin/ifconfig from read access on the file /var/run/vmware-active-nics.
***** Plugin restorecon (99.5 confidence) suggests *************************
If you want to fix the label.
/var/run/vmware-active-nics default label should be vmware_host_pid_t.
Then you can run restorecon.
Do
# /sbin/restorecon -v /var/run/vmware-active-nics
***** Plugin catchall (1.49 confidence) suggests ***************************
If you believe that ifconfig should be allowed read access on the vmware-active-nics file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep /sbin/ifconfig /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Showing posts with label selinux. Show all posts
Showing posts with label selinux. Show all posts
setroubleshoot: SELinux is preventing /sbin/ifconfig from read access on the file /var/run/vmware-active-nics
SELinux is preventing /sbin/ifconfig "search" access for ddclient
per https://bugzilla.redhat.com/show_bug.cgi?id=657947
sudo semanage permissive -a ddclient_t
Configure Squirrelmail
Change
To use https on apache, add the following to
Finally, selinux settings:
domain in /etc/squirrelmail/config.php:$domain = 'mydomain.com';so the email received will have
user@mydomain.comTo use https on apache, add the following to
/etc/httpd/conf.d/squirrelmail.conf:<Location /webmail>RewriteEngine on
RewriteCond %{HTTPS} !=on
RewriteRule .* https://%{HTTP_HOST}:443%{REQUEST_URI} [QSA,R=permanent,L]
</Location>
Finally, selinux settings:
setsebool -P httpd_can_network_connect=1
CentOS Selinux
Install setroubleshoot.noarch to show selinux error messages:
Allow Apache to listen to a different port and check which port is selinux allowed:
selinux also prevent mysqld to start after relocate /var/lib/mysql to /home/mysql:
Allow mysqld to use /home/mysql
httpd access denial, change type to httpd_sys_content_t
yum install setroubleshoot-server.noarch setroubleshoot.noarch
Allow Apache to listen to a different port and check which port is selinux allowed:
semanage port -a -t http_port_t -p tcp 81
semanage port -l
selinux also prevent mysqld to start after relocate /var/lib/mysql to /home/mysql:
chcon -R -t mysqld_var_run_t /home/mysql
ll -Z .
-rw-rw---- mysql mysql user_u:object_r:mysqld_var_run_t ibdata1
-rw-rw---- mysql mysql user_u:object_r:mysqld_var_run_t ib_logfile0
-rw-rw---- mysql mysql user_u:object_r:mysqld_var_run_t ib_logfile1
drwx------ mysql mysql user_u:object_r:mysqld_var_run_t mysql
drwx------ mysql mysql user_u:object_r:mysqld_var_run_t test
Allow mysqld to use /home/mysql
# cat /tmp/avc
host=tortoise type=AVC msg=audit(1221459330.317:413): avc: denied { create } for pid=7642 comm="mysqld" name="forum_db" scontext=system_u:system_r:mysqld_t:s0 tcontext=system_u:object_r:mysqld_var_run_t:s0 tclass=dir
# audit2allow -M local < /tmp/avc
******************** IMPORTANT ***********************
To make this policy package active, execute:
semodule -i local.pp
# semodule -i local.pp
#audit2allow -M local -i /var/log/audit/audit.log
httpd access denial, change type to httpd_sys_content_t
chcon -R -t httpd_sys_content_t /var/www/html/
Subscribe to:
Posts (Atom)