similar to: Samba won't start on Centos 7.3.1611

Hi folks, I've been googling for an hour on this which seems to be awfully basic. But I cannot find anything definitive. [root at centos-gig ~]# systemctl enable smb.service Failed to execute operation: Access denied [root at centos-gig ~]# setenforce 0 [root at centos-gig ~]# systemctl enable smb.service Failed to execute operation: No such file or directory Have tried things like : chcon

On 04/26/2017 12:29 AM, Robert Moskowitz wrote: > But the policy generates errors. I will have to submit a bug report, > it seems A bug report would probably be helpful. I'm looking back at the message you wrote describing errors in ld-2.17.so. I think what's happening is that the policy on your system includes a silent rule that somehow breaks your system. You'll need

How to resolve this SElinux problem? type=USER_AVC msg=audit(1513478641.700:1920): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { reload } for auid=0 uid=0 gid=0 cmdline="/usr/bin/systemctl reload named-chroot.service" scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:system_r:init_t:s0 tclass=service

Hi Guys, After some moths the server has been running in SELinux Permesive mode ... Some avc: denied messages has been recored ... I thought it was time to go to the next step and set SELinux Enforcing mode in the server ... it is a mail(postfix+cyrus+sasl), web, snmp with mrtg, squid sever with a local TLS configured for webmail access ... I took a look to the Deployment Guide about how to do

Hi Leon, I don't have access to a CentOS 6.10 system handy, but it looks like a policy issue. If I take you're ausearch output and pipe it to audit2allow on my CentOS 7.6 system, I get the following: #============= httpd_t ============== #!!!! This avc is allowed in the current policy allow httpd_t httpd_sys_script_t:process signull; Noting that on my 7.6 system with selinux enforcing

Hi, how do I allow lighttpd access to a directory like this: dr-xrwxr-x. lighttpd example unconfined_u:object_r:samba_share_t:s0 files_articles I tried to create and install a selinux module, and it didn?t work. The non-working module can not be removed, either: semodule -r lighttpd-files_articles.pp libsemanage.semanage_direct_remove_key: Unable to remove module lighttpd-files_articles.pp at

I'm seeing this in /var/log/messages: Oct 7 20:46:25 centos dbus: Can't send to audit system: USER_AVC avc: received setenforce notice (enforcing=0) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?) Some googling suggested this was due to a policy issue a year ago, but I'm seeing it with selinux-policy-targeted-2.4.6-30.el5. I've got a game server program (Enemy

Le mardi 25 avril 2017 ? 10:39 +0200, Robert Moskowitz a ?crit : > Thanks Laurent. You obviously know a LOT more about SELinux than I. I > pretty much just use commands and not build policies. So I need some > more information here. > > From what you provided below, how do I determine what is currently in > place and how do I add your stuff (changing postgresql with

Robert, in regards to your Postfix and Dovecot issue with MySQL and SELinux, > Apr 26 01:25:45 z9m9z dovecot: dict: Error: > mysql(/var/lib/mysql/mysql.sock): Connect failed to database > (postfix): Can't connect to local MySQL server through socket > '/var/lib/mysql/mysql.sock' (13) - waiting for 1 seconds before retry > Apr 26 01:25:45 z9m9z dovecot: dict: Error:

I reread my sql.conf.ext files and realized they were actually connecting to localhost. So I did some googling, and found how to connect to the socket: connect = host=/var/lib/mysql/mysql.sock dbname=postfix user=postfix password=Postfix_Database_Password And all fixed. No more failures. Plus probably securer. On 04/07/2017 10:57 AM, Robert Moskowitz wrote: > The strange thing is that

Hi folks, I am in the process of getting rsyslog 5.8.2 to work on CentOS 5.6 (both 64 and 32 bit). All that is left is getting SELinux to work with it. Has anybody out there gone through the process of working this out and can provide a policy file? If not, is anyone interested in the work I will do then (is there some place to publish those files?)? Best regards, Dirk

Gordon, Thank you for your help on this. Still not working... On 04/26/2017 06:27 PM, Gordon Messmer wrote: > On 04/26/2017 12:29 AM, Robert Moskowitz wrote: >> But the policy generates errors. I will have to submit a bug report, >> it seems > > > A bug report would probably be helpful. > > I'm looking back at the message you wrote describing errors in >

Hi everyone, Is there anything else we could do to check on this problem and try to fix it? The issue is definitively related to either the samba vfs gluster plugin or gluster itself. I am not sure how to pin it down futher. I went ahead and created a new share in the samba server which is on a local filesystem where the OS is installed, not part of gluster: # mount | grep home ]# ls -ld /home

PS: Now I found this: type=PROCTITLE msg=audit(09/22/2017 12:08:29.911:1023) : proctitle=/usr/lib/sendmail -t -oi -oem -fwawi-genimp type=SYSCALL msg=audit(09/22/2017 12:08:29.911:1023) : arch=x86_64 syscall=setgroups success=no exit=EPERM(Operation not permitted) a0=0x1 a1=0x7ffc1df3b0d0 a2=0x0 a3=0x7f5d77c3a300 items=0 ppid=19417 pid=19418 auid=unset uid=lighttpd gid=lighttpd euid=root

Thanks for taking the time to look into this. Since we needed downtime due to the gluster update, we also updated the OS, including samba. We went from 4.2.x to 4.4.4 and many other packages for CentOS were updated as well. OS and samba updates were installed, then server rebooted, then gluster was updated. Created a new test samba share to minimize logs, etc: [VfsGluster] path = /vfsgluster

On 10/03/2017 05:33 AM, Rowland Penny via samba wrote: > Sorry if some of these sound like teaching your grandmother to suck > eggs, but it is better to say them than not;-) > > Rowland Hi Rowland, I appreciate the the help! You did exactly what I ask for, which was to let it rip. I will have to read over slowly several times. Be nice to disable winbind too. My ego

On 03-Jun-2017 3:27 AM, "Diego Remolina" <dijuremo at gmail.com> wrote: Hi everyone, Is there anything else we could do to check on this problem and try to fix it? The issue is definitively related to either the samba vfs gluster plugin or gluster itself. I am not sure how to pin it down futher. I don't think it is vfs plugin because you haven't updated samba packages

On 04/25/2017 06:45 PM, Gordon Messmer wrote: > On 04/25/2017 01:58 AM, Laurent Wandrebeck wrote: >> Quick?n?(really) dirty SELinux howto: > > > Alternate process: > > 1: setenforce permissive > 2: tail -f /var/log/audit/audit.log | grep AVC > 3: use the service, exercise each function that's constrained by the > existing policy > 4: copy and paste the

Did the logs provide any hints as to what the issue may be? Diego On Sat, Jun 3, 2017 at 12:16 PM, Diego Remolina <dijuremo at gmail.com> wrote: > Thanks for taking the time to look into this. Since we needed downtime > due to the gluster update, we also updated the OS, including samba. We > went from 4.2.x to 4.4.4 and many other packages for CentOS were > updated as well. OS

I read about this bug in the Centos 6.2 faq and the link showing it fixed in https://bugzilla.redhat.com/show_bug.cgi?id=769859 but I am still getting it updating on a Centos 6.5 server that had selinux disabled. I want to run selinux as permissive but it won't load now on reboot. I ran the yum update to apply this latest selinux update