Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am configuring Apache\PHP and noticed Apache complaining about permissions with the php shared object.

Starting httpd: 
httpd: Syntax error on line 206 of /etc/httpd/conf/httpd.conf: 
Cannot load /usr/lib/httpd/modules/libphp5.so into server: 
/usr/lib/httpd/modules/libphp5.so: cannot restore segment prot after reloc: 
Permission denied

I looked at the context (started fine with enforcement off) and found:

# ls --context /usr/lib/httpd/modules/libphp5.so
-rwxr-xr-x root root root:object_r:httpd_modules_t /usr/lib/httpd/modules/libphp5.so

Shouldn't httpd (apache) be able to access files with a context of httpd_modules_t? I got it fixed by applying

chcon -t textrel_shlib_t '/usr/lib/httpd/modules/libphp5.so'

But I would think the httpd version would work before this one. Can someone explain this to me?

share|improve this question
add comment

1 Answer

Under SELinux each item is required to have a context. Text relocation can be described as an error. Changing the context creates an exception coaxing SELinux into allowing it to load even though it in essence is b0rken. Way better text relocation explanation: http://www.akkadia.org/drepper/textrelocs.html. BTW using 'chcon' isn't permanent: relabeling will reset the context. Use 'semanage fcontext -a -t textrel_shlib_t /usr/lib/httpd/modules/libphp5.so' to make it stick (see /etc/selinux/targeted/contexts/files/file_contexts.local).

HTH

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.