Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have been trying to add 2 PHP extensions to a freshly installed CentOS 6.0 Linux server, but get the error messages in /var/log/httpd/error_log:

[notice] SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0
PHP Warning:  PHP Startup: Unable to load dynamic library '/usr/lib64/php/modules/gdchart.so' - /usr/lib64/php/modules/gdchart.so: undefined symbol: php_gd_gdFontMediumBold in Unknown on line 0
PHP Warning:  PHP Startup: Unable to load dynamic library '/usr/lib64/php/modules/oci8.so' - libnnz11.so: cannot enable executable stack as shared object requires: Permission denied in Unknown on line 0
[notice] Apache/2.2.15 (Unix) DAV/2 PHP/5.3.2 mod_ssl/2.2.15 OpenSSL/1.0.0-fips mod_wsgi/3.2 Python/2.6.5 mod_perl/2.0.4 Perl/v5.10.1 configured -- resuming normal operations

I did run

# chcon system_u:object_r:lib_t:s0 /usr/lib64/php/modules/oci8.so
# chcon system_u:object_r:lib_t:s0 /usr/lib64/php/modules/gdchart.so
# ls -alZ /usr/lib64/php/modules/

-rwxr-xr-x. root root system_u:object_r:lib_t:s0       curl.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       dom.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       fileinfo.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       gdchart.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       gd.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       json.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       oci8.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       pdo_pgsql.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       pdo.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       pdo_sqlite.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       pgsql.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       phar.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       sqlite3.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       wddx.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       xmlreader.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       xmlwriter.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       xsl.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       zip.so

Here is how I compiled both modules:

1) For oci8.so - setup /etc/tnsnames.ora and then:

# rpm -Uvh oracle-instantclient11.2-basic-
# rpm -Uvh oracle-instantclient11.2-devel-
# pecl install oci8 (entered: instantclient,/usr/lib/oracle/11.2/client64/lib there)

2) For gdchart.so:

# yum install gd-devel php-devel gcc
# wget http://pecl.php.net/get/gdchart-0.2.0.tgz
# tar xvfz $!
# cd $!
# ./phpize
# ./configure
# make && make install

Does anybody please have an idea, what am I missing?

Using both libs (Oracle instant clicent and GDChart) from commandline works ok.


When I switch SELinux off by putting SELINUX=permissive into /etc/selinux/config and reboot, the oci8.so loads, but gdchart.so still has a bug.

So I guess my question is: how to enable SELinux back and still being able to use oci8.so? Please share your experience here - if you already struggle with Oracle + PHP + CentOS/RHEL 6.


When starting Apache, I see in /var/log/audit/audit.log:

type=AVC msg=audit(1316698464.300:51213): avc:  denied  { execstack } for  pid=2833 comm="httpd" scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:system_r:httpd_t:s0 tclass=process
type=SYSCALL msg=audit(1316698464.300:51213): arch=c000003e syscall=10 success=yes exit=0 a0=7fff95f4b000 a1=1000 a2=1000007 a3=7f5e22611000 items=0 ppid=1 pid=2833 auid=10116 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=34 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
share|improve this question

3 Answers 3

up vote 3 down vote accepted

Run the following command as root and try again:

# setsebool -P allow_execstack 1

You also can enable executable stack for only oci8.so with:

# execstack -c /usr/lib64/php/modules/oci8.so
share|improve this answer
The 2nd command seems to fix the issue, thank you –  Alexander Farber Sep 22 '11 at 13:38

Perhaps this is old news, but I got PHP/5.3.3 with OCI8 (Oracle instant client working on RHEL6.3 with SELinux enabled by doing this:

chcon system_u:object_r:lib_t:s0 /usr/lib64/php/modules/oci8.so
execstack -c /usr/lib/oracle/<VERSION>/client64/lib/*.so
chcon -t texrel_shlib_t /usr/lib/oracle/<VERSION>/client64/lib/*.so
setsebool -P httpd_can_network_connect_db 1

I used a combination of audit2allow -w -a and hints from this article to get to this successful conclusion.

share|improve this answer
Thank you! For other newbies like me: I had to run all commands of the two provided answers to have oci8 working. –  Frosty Z Apr 5 '13 at 9:03
Thanks you for this! After trying many other things, this combination of commands and settings worked perfectly and I can now use OCI8 connections from within PHP scripts that run within Apache on RHEL v6. –  bluebinary Apr 28 at 8:26

On CentosOS release 6.4 (Final), similar problems. Our solution seemed to be boolean 'httpd_execmem'

After applying without any success all your useful recommendations, keep failing the oci8 load on Apache. So, we got to "audit2allow" to the rescue!

$> echo "type=AVC msg=audit(1384944299.002:75458): avc: denied { execstack } for pid=6356 comm="httpd" scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:system_r:httpd_t:s0 tclass=process" | audit2allow

Obtaining the output: "This avc can be allowed using the boolean 'httpd_execmem'"

Finally the solution so far: $> setsebool httpd_execmem 1

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.