Collaborate Disseminate
I have nginx and php-fm set up to front a word press site. I used certbot to setup TLS.
When I load any page, I see selinux violations and it looks like php-fpm is trying to reach out to some port 443 for some reason and getting blocked.
… Continue reading Why is php-fpm trying to connect somewhere on port 443?
Suddenly my lockscreen changed from the gnome (blue one) lockscreen that detects the username and asks for password to the login screen that asks for both username and password. I am trying to get it back, but nothing is working.
as far as my understanding goes, an OS needs to implement some sort of reference monitor, as the entity which grants or denies permissions as an access control decision.
Furthermore, I think the Linux kernel does this by providing Linux Se… Continue reading Linux security modules (LSM) and reference monitor implementation
I’m trying to harden a Linux installation on a personal computer – I decided to try both SELinux and AppArmor as a Mandatory Access Control (MAC) to supplement the default Discretionary Access Control (DAC) that Linux comes with by default… Continue reading Linux whitelist-based Mandatory Access Control instead of a blacklist-based model
Our company is developing an AOSP-based platform for our customer. Some of our vendor services are using HWBinder for IPC which is using SELinux to restrict service discovery and access. The problem is that our customer insists that SELinu… Continue reading Is there a good reason (and what can it be) to require DAC restriction on IPC in addition to SELinux rules?
I have a system where root user is sysadm_u. When the user tries to start at job, get this error “execle: couldn’t get security context for user root”.
After going through the source code of at and other selinux docs, the issue seems to b… Continue reading selinux : root as sysadm_u not able to start at job
My question is similar to these:
Protect sensitive data from sysadmin prying eyes
Restrict access to a specific directory on Linux
From those, I understand that SELinux could accomplish my goal. But we do not have the r… Continue reading Restrict privileged users from accessing certain directories on Linux servers with Grsecurity?
(Apologies for multi-question. Theme is the same, but there are quite a few edge cases.)
Browsing the web, I come across resources (see below), but they don’t make this quite clear what the situation really is, so this is my attempt to cla… Continue reading Ways to transition SELinux domain / process context (securing SELinux boundaries)
Ive been chipping away at this for days and going in circles so I need to put this out there – somewhere.
My Samsung s9+ hasnt been acting properly for a long time – but in the past few weeks this thing has become a nightma… Continue reading Android exploited – elevated privileges – SE Policy exploit – system as root – dual boot – living in my ramdisk. What now? [on hold]
I need to intercept log messages from Apache (used as reverse proxy and authentication gateway). In order to do this reliably, I want to use a CustomLogs configuration to run a python script. This is not too complicated. I un… Continue reading SElinux blocks rotatelogs when called from an intermediate script