Home/ Questions/Q 6691803
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-26T05:47:41+00:00

I have a bunch of programs which use IPC Semaphores to interact (semget). One

  • 0

I have a bunch of programs which use IPC Semaphores to interact (semget).

One of the programs is an Apache module, which runs in (some sort of) restricted SELinux context (which I don’t understand too well).

The module is capable of interacting with any regular files correctly, if of-course the files have their SELinux security context set appropriately.

However – when my (Module) goes to access the IPC Semaphore, the semget call fails with a EPERM. When SELinux is turned off, I don’t get this error.

So – there is obviously something I need to do to set some sort of SELinux security context or something on the Semaphore for this to work. If it was a regular file, I could just call “chcon” on it. Since it’s a System-V IPC Semaphore, I can’t do that.

What can I do to make this work??

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The basic steps to get SELinux working with the changes you need are:

    1. Enable permissive mode
    2. Capture denials
    3. Add a new policy module or modify an existing policy module
    4. Enable enforcing mode and test

    Exactly how to do these steps depends on what Linux distribution you are using; here are references for CentOS, Debian, Gentoo, RedHat and Ubuntu. You can also find SELinux information from NSA. The best documentation I found is from Gentoo: step 1, step 2, step 3, step 4.

    As @smassey noted, you most probably need to modify some IPC permission.

    • 0