selinux | PKGBUILDs to build SELinux enabled packages for Arch Linux
kandi X-RAY | selinux Summary
kandi X-RAY | selinux Summary
Complete documentation will soon be available at:
Support
Quality
Security
License
Reuse
Top functions reviewed by kandi - BETA
Currently covering the most popular Java, JavaScript and Python libraries. See a Sample of selinux
selinux Key Features
selinux Examples and Code Snippets
Community Discussions
Trending Discussions on selinux
QUESTION
I see that Termux has its executable files in /data/data/com.termux/files/usr. Execution from this location must be prohibited by SELinux policies. How it works?
Thanks.
...ANSWER
Answered 2022-Apr-03 at 10:21Actually any Android App can run executable files natively, using the Android's Os class. It provides low-level functionality to the app, which also includes running executables. So, basically, Termux is just a bridge between this API and the user.
However, Android has updated its policy after Android 10, and apps can't run executables natively.
Untrusted apps that target Android 10 cannot invoke exec() on files within the app's home directory.
From the official Termux website
Applications built with target SDK level 29 (means compatibility with Android 10) will no longer be able to execute data files. All executables must be packaged within the APK file. That's a reasonable restriction. Application must not be able to modify itself. Updates and new features must come within the APK of newer version. However there is a problem: Termux is technically a bridge between Android application and Linux environments.
Fortunately, we chose to force use compatibility with Android 9 APIs (SDK 28) at the cost of ability to publish updates on Google Play. That is until we will workaround the issue. For now do not worry - it works perfectly.
And that's also why, Termux updates are not coming on Play Store and you need to download the updates from F-Droid.
QUESTION
I get a strange php error:
...ANSWER
Answered 2022-Mar-15 at 11:51In the error log, the path doesn't start with a slash "/"
var/www/vhosts/webdev/sites/test/hello.php
which indicates a misconfiguration in lighttpd/fastcgi configuration
Fixing the path should make everything work correctly.
QUESTION
I compiled qemu-system-x86_64
on aarch64 host, and was able to run a x86_64 guest with a command like
ANSWER
Answered 2022-Feb-24 at 04:17The problem was actually about firewall. My VM (based on Oracle Linux 8.5 on Oracle Linux VM Templates) actually had firewall rules in both iptables
and nft
. After disabling both iptables
and nft
, the port forward worked.
QUESTION
POSIX directory permissions include the "sticky" bit (S_ISVTX
) which is described as limiting deletion or renaming to just the owner of a file, or to root. This is often used for directories such as /tmp
and /var/tmp
which may have permissions drwxrwxrwt
to allow all users to create temporary files, but prevent other non-root users from deleting those files.
My question is about root's permission to modify files created by ordinary users within directories marked with the sticky bit.
Suppose, an ordinary user creates a file in a sticky-bit protected /var/tmp
(which is on a local, non-NFS filesystem, with no SELinux restrictions):
ANSWER
Answered 2022-Jan-28 at 13:26The behavior you are showing seems to depend on the fs.protected_regular
Linux kernel parameter, introduced along with fs.protected_fifos
by this commit, with the aim to fix security vulnerabilities.
sudo sysctl fs.protected_regular=0
Since it is a patch, it probably won't be documented in more detail.
https://askubuntu.com/questions/1250974/user-root-cant-write-to-file-in-tmp-owned-by-someone-else-in-20-04-but-can-in/1251030#1251030
https://unix.stackexchange.com/questions/503111/group-permissions-for-root-not-working-in-tmp
QUESTION
I am fairly new to Ansible and have now started automating some repetitive Windows administration tasks.
As a controller I use a Debian 11 VM where I have only Ansible and pywinrm installed. My test target is a Windows Server 2016 and everything works fine, I can install programs, create users or copy files. The only thing that does not work is the module "win_updates".
I get the following message back when I call win_updates.
...ANSWER
Answered 2022-Jan-21 at 14:02Adding the suitable env vars solved my problem.
QUESTION
I installed VSFTPD on Centos7 and tried to set up FTP. The vsftpd.conf file information is as follows:
...ANSWER
Answered 2022-Jan-16 at 21:41I think the problems are that allow_ftpd_full_access
is not a vsftpd.conf
option, and that the /home/share
directory has the wrong owner (see Steps 5 and 6).
Try this out...
NOTE - Tested using two CentOS 7.9 virtual machines, on an Internal network, with IP addresses of 192.168.0.10 (client) and 192.168.0.11 (server), using your
vsftpd.conf
settings.
- On the client, ensure the FTP client is installed:
sudo yum install ftp
- On the server, ensure the FTP daemon is installed:
sudo yum install vsftpd
- Temporarily open the firewall for FTP traffic on both machines, so you do not receive a
No route to host
error:
QUESTION
I'm planning to move away from Docker to Podman. I use docker-compose a lot so am planning to switch to podman-compose as well.
However I'm stuck at the simplest of podman examples, I can't seem to mount a volume onto my container? Obviously I'm doing something wrong however I cant figure out what it is.
My source file definitely exists on my (hardware) host (so not the podman machine). but I keep getting the error 'no such file or directory'.
Funny thing is if I manually create the same file locally on the podman machine (podman machine ssh --> touch /tmp/test.txt) it works perfectly fine.
Question is;
- should I (manually?) mount all my local files onto the Fedora VM (podman machine) so that in turn this Fedora mount can be used in my actual container? and if so, how do I do this?
- The
podman run
cmd below should work and there is something else I'm doing wrong?
ANSWER
Answered 2021-Dec-20 at 07:31As mentioned by @ErikSjölund there has been an active treat on https://github.com/containers/podman. Apparantely Centos (Podman Machine) does not (yet) support different types of volume creation on the machine.
It's not perse Podman lacking this feature it's waiting for CentOS to support this feature as well.
However, should you want to mount a local directory onto the machine I recommend have a look at https://github.com/containers/podman/issues/8016#issuecomment-995242552. It describes how to do a read-only mount on CoreOS (or break compatibility with local version).
Info:
https://github.com/containers/podman/pull/11454 https://github.com/containers/podman/pull/12584
QUESTION
The Android open source code contains code such as this. Can anyone explain why and under which circumstances it is necessary to do SELinux.restorecon(File)?
...ANSWER
Answered 2021-Nov-09 at 14:35SELinux restorecon
is used to restore the default security contexts on some files/dir.
The thing (which is not obvious) is that we also use it to apply context changes, and/or to ensure that the file contexts are as you expect.
Usually, we define/override default security contexts using semanage-fcontext
, and then run restorecon
to relabel files according to these new defaults.
Here the code tries to relabel mBaseStateDir
but fails to do so. It could be that :
- there is no policy supporting the default context associated to that directory (given it's path)
mBaseStateDir
is mislabeled (context type is not apllicable)- user/process running that code doesn't have the sufficient permission to relabel the directory (even it just created it).
QUESTION
I am trying to get networking working with rootless containers using podman. Getting either external networking up and running or internal networking is not the issue. Using the --network option, containers are able to see each other. However ping 8.8.8.8 does not work. Starting containers without --network or with --network=slirp4netns ping 8.8.8.8 does work as expected. Of course in the latter case, there is no internal networking. What I think this tells me is that host is not blocking external access from within containers. The issues that I am facing is that I seem to be unable to get both internal and external networking working within containers at the same time.
...ANSWER
Answered 2021-Oct-21 at 17:36I just tried this on RHEL 8 and I was able to reproduce this issue. We also figured out the issue (I think). Try the following:
sudo sysctl -w net.ipv4.ping_group_range="0 2147483647"
You might be being limited by the group range and /etc/subuid /etc/subgid:
https://man7.org/linux/man-pages/man7/icmp.7.html
I'm not sure what the long term solution is yet, but if this works, you can likely fix it with sysctl for now.
QUESTION
I am using centos 7.
How did I check the log.
...ANSWER
Answered 2021-Oct-02 at 02:16add permission to the directory - /var/log/zabbix/ & /var/log/zabbix-agent/
Community Discussions, Code Snippets contain sources that include Stack Exchange Network
Vulnerabilities
No vulnerabilities reported
Install selinux
libsepol
libselinux
secilc
checkpolicy
setools
libsemanage
semodule-utils
policycoreutils
selinux-dbus-config
selinux-gui
selinux-python
selinux-sandbox
mcstrans
restorecond
pambase-selinux
pam-selinux
coreutils-selinux shadow-selinux cronie-selinux sudo-selinux
util-linux-selinux
systemd-selinux
logrotate-selinux
dbus-selinux
Support
Reuse Trending Solutions
Find, review, and download reusable Libraries, Code Snippets, Cloud APIs from over 650 million Knowledge Items
Find more librariesStay Updated
Subscribe to our newsletter for trending solutions and developer bootcamps
Share this Page