selinux | PKGBUILDs to build SELinux enabled packages for Arch Linux

 by   archlinuxhardened Shell Version: ArchLinux-SELinux License: No License

kandi X-RAY | selinux Summary

kandi X-RAY | selinux Summary

selinux is a Shell library. selinux has no bugs and it has low support. However selinux has 4 vulnerabilities. You can download it from GitHub.

Complete documentation will soon be available at:
Support
    Quality
      Security
        License
          Reuse

            kandi-support Support

              selinux has a low active ecosystem.
              It has 138 star(s) with 23 fork(s). There are 15 watchers for this library.
              OutlinedDot
              It had no major release in the last 12 months.
              There are 16 open issues and 46 have been closed. On average issues are closed in 23 days. There are no pull requests.
              It has a neutral sentiment in the developer community.
              The latest version of selinux is ArchLinux-SELinux

            kandi-Quality Quality

              selinux has 0 bugs and 0 code smells.

            kandi-Security Security

              selinux has 4 vulnerability issues reported (0 critical, 0 high, 0 medium, 4 low).
              selinux code analysis shows 0 unresolved vulnerabilities.
              There are 0 security hotspots that need review.

            kandi-License License

              selinux does not have a standard license declared.
              Check the repository for any license declaration and review the terms closely.
              OutlinedDot
              Without a license, all rights are reserved, and you cannot use the library in your applications.

            kandi-Reuse Reuse

              selinux releases are available to install and integrate.
              Installation instructions, examples and code snippets are available.
              It has 369 lines of code, 17 functions and 3 files.
              It has high code complexity. Code complexity directly impacts maintainability of the code.

            Top functions reviewed by kandi - BETA

            kandi's functional review helps you automatically verify the functionalities of the libraries and avoid rework.
            Currently covering the most popular Java, JavaScript and Python libraries. See a Sample of selinux
            Get all kandi verified functions for this library.

            selinux Key Features

            No Key Features are available at this moment for selinux.

            selinux Examples and Code Snippets

            No Code Snippets are available at this moment for selinux.

            Community Discussions

            QUESTION

            How does Termux get around the SELinux restriction on running programs?
            Asked 2022-Apr-03 at 10:21

            I see that Termux has its executable files in /data/data/com.termux/files/usr. Execution from this location must be prohibited by SELinux policies. How it works?

            Thanks.

            ...

            ANSWER

            Answered 2022-Apr-03 at 10:21

            Actually any Android App can run executable files natively, using the Android's Os class. It provides low-level functionality to the app, which also includes running executables. So, basically, Termux is just a bridge between this API and the user.

            However, Android has updated its policy after Android 10, and apps can't run executables natively.

            Untrusted apps that target Android 10 cannot invoke exec() on files within the app's home directory.

            From the official Termux website

            Applications built with target SDK level 29 (means compatibility with Android 10) will no longer be able to execute data files. All executables must be packaged within the APK file. That's a reasonable restriction. Application must not be able to modify itself. Updates and new features must come within the APK of newer version. However there is a problem: Termux is technically a bridge between Android application and Linux environments.

            Fortunately, we chose to force use compatibility with Android 9 APIs (SDK 28) at the cost of ability to publish updates on Google Play. That is until we will workaround the issue. For now do not worry - it works perfectly.

            And that's also why, Termux updates are not coming on Play Store and you need to download the updates from F-Droid.

            Source https://stackoverflow.com/questions/71663819

            QUESTION

            PHP Error "Unknown: failed to open stream... in Unknown on line 0..." when editing php files
            Asked 2022-Mar-15 at 17:37

            I get a strange php error:

            ...

            ANSWER

            Answered 2022-Mar-15 at 11:51

            In the error log, the path doesn't start with a slash "/"

            var/www/vhosts/webdev/sites/test/hello.php

            which indicates a misconfiguration in lighttpd/fastcgi configuration

            Fixing the path should make everything work correctly.

            Source https://stackoverflow.com/questions/71466839

            QUESTION

            QEMU hostfwd works only for some ports
            Asked 2022-Feb-24 at 04:17

            I compiled qemu-system-x86_64 on aarch64 host, and was able to run a x86_64 guest with a command like

            ...

            ANSWER

            Answered 2022-Feb-24 at 04:17

            The problem was actually about firewall. My VM (based on Oracle Linux 8.5 on Oracle Linux VM Templates) actually had firewall rules in both iptables and nft. After disabling both iptables and nft, the port forward worked.

            Source https://stackoverflow.com/questions/71033704

            QUESTION

            Should POSIX sticky bit deny appending by root?
            Asked 2022-Jan-28 at 13:26

            POSIX directory permissions include the "sticky" bit (S_ISVTX) which is described as limiting deletion or renaming to just the owner of a file, or to root. This is often used for directories such as /tmp and /var/tmp which may have permissions drwxrwxrwt to allow all users to create temporary files, but prevent other non-root users from deleting those files.

            My question is about root's permission to modify files created by ordinary users within directories marked with the sticky bit.

            Suppose, an ordinary user creates a file in a sticky-bit protected /var/tmp (which is on a local, non-NFS filesystem, with no SELinux restrictions):

            ...

            ANSWER

            Answered 2022-Jan-28 at 13:26
            Answer found

            The behavior you are showing seems to depend on the fs.protected_regular Linux kernel parameter, introduced along with fs.protected_fifos by this commit, with the aim to fix security vulnerabilities.

            Solution:

            sudo sysctl fs.protected_regular=0

            Resources:

            Since it is a patch, it probably won't be documented in more detail.

            https://askubuntu.com/questions/1250974/user-root-cant-write-to-file-in-tmp-owned-by-someone-else-in-20-04-but-can-in/1251030#1251030
            https://unix.stackexchange.com/questions/503111/group-permissions-for-root-not-working-in-tmp

            Source https://stackoverflow.com/questions/70479857

            QUESTION

            Ansible win_updates won't work on Debian 11 /("msg": "winrm put_file failed; \nstdout: Active code page: 1252\r)
            Asked 2022-Jan-21 at 14:02

            I am fairly new to Ansible and have now started automating some repetitive Windows administration tasks.

            As a controller I use a Debian 11 VM where I have only Ansible and pywinrm installed. My test target is a Windows Server 2016 and everything works fine, I can install programs, create users or copy files. The only thing that does not work is the module "win_updates".

            I get the following message back when I call win_updates.

            ...

            ANSWER

            Answered 2022-Jan-21 at 14:02

            Adding the suitable env vars solved my problem.

            Source https://stackoverflow.com/questions/70773723

            QUESTION

            vsftpd - Cannot upload file. Get err: 553
            Asked 2022-Jan-16 at 21:41

            I installed VSFTPD on Centos7 and tried to set up FTP. The vsftpd.conf file information is as follows:

            ...

            ANSWER

            Answered 2022-Jan-16 at 21:41

            I think the problems are that allow_ftpd_full_access is not a vsftpd.conf option, and that the /home/share directory has the wrong owner (see Steps 5 and 6).

            Try this out...

            NOTE - Tested using two CentOS 7.9 virtual machines, on an Internal network, with IP addresses of 192.168.0.10 (client) and 192.168.0.11 (server), using your vsftpd.conf settings.

            1. On the client, ensure the FTP client is installed: sudo yum install ftp
            2. On the server, ensure the FTP daemon is installed: sudo yum install vsftpd
            3. Temporarily open the firewall for FTP traffic on both machines, so you do not receive a No route to host error:

            Source https://stackoverflow.com/questions/70724552

            QUESTION

            Podman unable to mount local file into container
            Asked 2021-Dec-20 at 07:31

            I'm planning to move away from Docker to Podman. I use docker-compose a lot so am planning to switch to podman-compose as well.

            However I'm stuck at the simplest of podman examples, I can't seem to mount a volume onto my container? Obviously I'm doing something wrong however I cant figure out what it is.

            My source file definitely exists on my (hardware) host (so not the podman machine). but I keep getting the error 'no such file or directory'.

            Funny thing is if I manually create the same file locally on the podman machine (podman machine ssh --> touch /tmp/test.txt) it works perfectly fine.

            Question is;

            • should I (manually?) mount all my local files onto the Fedora VM (podman machine) so that in turn this Fedora mount can be used in my actual container? and if so, how do I do this?
            • The podman run cmd below should work and there is something else I'm doing wrong?
            ...

            ANSWER

            Answered 2021-Dec-20 at 07:31

            As mentioned by @ErikSjölund there has been an active treat on https://github.com/containers/podman. Apparantely Centos (Podman Machine) does not (yet) support different types of volume creation on the machine.

            It's not perse Podman lacking this feature it's waiting for CentOS to support this feature as well.

            However, should you want to mount a local directory onto the machine I recommend have a look at https://github.com/containers/podman/issues/8016#issuecomment-995242552. It describes how to do a read-only mount on CoreOS (or break compatibility with local version).

            Info:

            https://github.com/containers/podman/pull/11454 https://github.com/containers/podman/pull/12584

            Source https://stackoverflow.com/questions/70275279

            QUESTION

            When to call SELinux.restorecon()?
            Asked 2021-Nov-09 at 14:35

            The Android open source code contains code such as this. Can anyone explain why and under which circumstances it is necessary to do SELinux.restorecon(File)?

            ...

            ANSWER

            Answered 2021-Nov-09 at 14:35

            SELinux restorecon is used to restore the default security contexts on some files/dir.

            The thing (which is not obvious) is that we also use it to apply context changes, and/or to ensure that the file contexts are as you expect.

            Usually, we define/override default security contexts using semanage-fcontext, and then run restorecon to relabel files according to these new defaults.

            Here the code tries to relabel mBaseStateDir but fails to do so. It could be that :

            • there is no policy supporting the default context associated to that directory (given it's path)
            • mBaseStateDir is mislabeled (context type is not apllicable)
            • user/process running that code doesn't have the sufficient permission to relabel the directory (even it just created it).

            Source https://stackoverflow.com/questions/69897163

            QUESTION

            How to setup internal and external networking for rootless containers with podman
            Asked 2021-Oct-27 at 19:52

            I am trying to get networking working with rootless containers using podman. Getting either external networking up and running or internal networking is not the issue. Using the --network option, containers are able to see each other. However ping 8.8.8.8 does not work. Starting containers without --network or with --network=slirp4netns ping 8.8.8.8 does work as expected. Of course in the latter case, there is no internal networking. What I think this tells me is that host is not blocking external access from within containers. The issues that I am facing is that I seem to be unable to get both internal and external networking working within containers at the same time.

            ...

            ANSWER

            Answered 2021-Oct-21 at 17:36

            I just tried this on RHEL 8 and I was able to reproduce this issue. We also figured out the issue (I think). Try the following:

            sudo sysctl -w net.ipv4.ping_group_range="0 2147483647"

            You might be being limited by the group range and /etc/subuid /etc/subgid:

            https://man7.org/linux/man-pages/man7/icmp.7.html

            I'm not sure what the long term solution is yet, but if this works, you can likely fix it with sysctl for now.

            Source https://stackoverflow.com/questions/69636101

            QUESTION

            Failed to start Zabbix Agent for every 10 seconds
            Asked 2021-Oct-02 at 02:16

            I am using centos 7.

            How did I check the log.

            ...

            ANSWER

            Answered 2021-Oct-02 at 02:16

            add permission to the directory - /var/log/zabbix/ & /var/log/zabbix-agent/

            Source https://stackoverflow.com/questions/69413383

            Community Discussions, Code Snippets contain sources that include Stack Exchange Network

            Vulnerabilities

            No vulnerabilities reported

            Install selinux

            Remember to build as a non-root user, and to keep a root logged-in console to install packages (especially for sudo/shadow/pam packages).
            libsepol
            libselinux
            secilc
            checkpolicy
            setools
            libsemanage
            semodule-utils
            policycoreutils
            selinux-dbus-config
            selinux-gui
            selinux-python
            selinux-sandbox
            mcstrans
            restorecond
            pambase-selinux
            pam-selinux
            coreutils-selinux shadow-selinux cronie-selinux sudo-selinux
            util-linux-selinux
            systemd-selinux
            logrotate-selinux
            dbus-selinux

            Support

            Complete documentation will soon be available at: https://wiki.archlinux.org/index.php/SELinux.
            Find more information at:

            Find, review, and download reusable Libraries, Code Snippets, Cloud APIs from over 650 million Knowledge Items

            Find more libraries
            CLONE
          • HTTPS

            https://github.com/archlinuxhardened/selinux.git

          • CLI

            gh repo clone archlinuxhardened/selinux

          • sshUrl

            git@github.com:archlinuxhardened/selinux.git

          • Stay Updated

            Subscribe to our newsletter for trending solutions and developer bootcamps

            Agree to Sign up and Terms & Conditions

            Share this Page

            share link