2

In Fedora how do you configure Selinux to give permissions to an arbitrary executable to be run by the PHP system or exec functions? Turning SELinux off is not an option for me.

$ getsebool -a | grep httpd  

allow_httpd_anon_write --> off  
allow_httpd_mod_auth_ntlm_winbind --> off  
allow_httpd_mod_auth_pam --> off  
allow_httpd_sys_script_anon_write --> off  
httpd_builtin_scripting --> on  
httpd_can_check_spam --> off  
httpd_can_network_connect --> off  
httpd_can_network_connect_cobbler --> off  
httpd_can_network_connect_db --> off  
httpd_can_network_memcache --> off  
httpd_can_network_relay --> off  
httpd_can_sendmail --> off  
httpd_dbus_avahi --> off  
httpd_enable_cgi --> on  
httpd_enable_ftp_server --> off  
httpd_enable_homedirs --> off  
httpd_execmem --> off  
httpd_read_user_content --> off  
httpd_setrlimit --> off  
httpd_ssi_exec --> on  
httpd_tmp_exec --> off  
httpd_tty_comm --> on  
httpd_unified --> off  
httpd_use_cifs --> off  
httpd_use_gpg --> off  
httpd_use_nfs --> off  
1
  • Please run the request again an provide the log results of "ausearch -ts recent -m avc" Nov 6, 2011 at 22:49

2 Answers 2

6

Check the current SELinux settings related to Apache with:

# /usr/sbin/getsebool -a | grep httpd

You need to turn on httpd_ssi_exec to allow Apache to execute SSI scripts:

# setsebool -P httpd_ssi_exec=1
7
  • I already tried it. In the httpd log it still shows "permission denied".
    – Memento
    Nov 6, 2011 at 9:24
  • Please post a log snippet?
    – quanta
    Nov 6, 2011 at 9:30
  • sh: /tmp/defne/eq7ZO4fu8lYI: Permission denied This is the only relevant thing in /var/log/httpd/error_log
    – Memento
    Nov 6, 2011 at 9:55
  • What did you try? Edit your original post to append the /var/log/audit/audit.log.
    – quanta
    Nov 6, 2011 at 10:25
  • IT SAYS: "End a line with two spaces to add a <br/> linebreak:" but apparently it is not working, I hope you can read this: # cat /var/log/audit/audit.log | grep executableFileName type=AVC msg=audit(1320562016.878:1786): avc: denied { execute } for pid=6004 comm="sh" name="executableFileName" dev=dm-1 ino=536509 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_rw_content_t:s0 tclass=file
    – Memento
    Nov 6, 2011 at 10:36
3

Just bumped into this same issue. Setting httpd_execmem to on solved the problem.

Not the answer you're looking for? Browse other questions tagged .