Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have been trying to add 2 PHP extensions to a freshly installed CentOS 6.0 Linux server, but get the error messages in /var/log/httpd/error_log:

[notice] SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0
PHP Warning:  PHP Startup: Unable to load dynamic library '/usr/lib64/php/modules/gdchart.so' - /usr/lib64/php/modules/gdchart.so: undefined symbol: php_gd_gdFontMediumBold in Unknown on line 0
PHP Warning:  PHP Startup: Unable to load dynamic library '/usr/lib64/php/modules/oci8.so' - libnnz11.so: cannot enable executable stack as shared object requires: Permission denied in Unknown on line 0
[notice] Apache/2.2.15 (Unix) DAV/2 PHP/5.3.2 mod_ssl/2.2.15 OpenSSL/1.0.0-fips mod_wsgi/3.2 Python/2.6.5 mod_perl/2.0.4 Perl/v5.10.1 configured -- resuming normal operations

I did run

# chcon system_u:object_r:lib_t:s0 /usr/lib64/php/modules/oci8.so
# chcon system_u:object_r:lib_t:s0 /usr/lib64/php/modules/gdchart.so
# ls -alZ /usr/lib64/php/modules/

-rwxr-xr-x. root root system_u:object_r:lib_t:s0       curl.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       dom.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       fileinfo.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       gdchart.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       gd.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       json.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       oci8.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       pdo_pgsql.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       pdo.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       pdo_sqlite.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       pgsql.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       phar.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       sqlite3.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       wddx.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       xmlreader.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       xmlwriter.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       xsl.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       zip.so

Here is how I compiled both modules:

1) For oci8.so - setup /etc/tnsnames.ora and then:

# rpm -Uvh oracle-instantclient11.2-basic-11.2.0.2.0.x86_64.rpm
# rpm -Uvh oracle-instantclient11.2-devel-11.2.0.2.0.x86_64.rpm
# pecl install oci8 (entered: instantclient,/usr/lib/oracle/11.2/client64/lib there)

2) For gdchart.so:

# yum install gd-devel php-devel gcc
# wget http://pecl.php.net/get/gdchart-0.2.0.tgz
# tar xvfz $!
# cd $!
# ./phpize
# ./configure
# make && make install

Does anybody please have an idea, what am I missing?

Using both libs (Oracle instant clicent and GDChart) from commandline works ok.

UPDATE:

When I switch SELinux off by putting SELINUX=permissive into /etc/selinux/config and reboot, the oci8.so loads, but gdchart.so still has a bug.

So I guess my question is: how to enable SELinux back and still being able to use oci8.so? Please share your experience here - if you already struggle with Oracle + PHP + CentOS/RHEL 6.

UPDATE 2:

When starting Apache, I see in /var/log/audit/audit.log:

type=AVC msg=audit(1316698464.300:51213): avc:  denied  { execstack } for  pid=2833 comm="httpd" scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:system_r:httpd_t:s0 tclass=process
type=SYSCALL msg=audit(1316698464.300:51213): arch=c000003e syscall=10 success=yes exit=0 a0=7fff95f4b000 a1=1000 a2=1000007 a3=7f5e22611000 items=0 ppid=1 pid=2833 auid=10116 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=34 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
share|improve this question
add comment

3 Answers 3

up vote 3 down vote accepted

Run the following command as root and try again:

# setsebool -P allow_execstack 1

You also can enable executable stack for only oci8.so with:

# execstack -c /usr/lib64/php/modules/oci8.so
share|improve this answer
    
The 2nd command seems to fix the issue, thank you –  Alexander Farber Sep 22 '11 at 13:38
add comment

Perhaps this is old news, but I got PHP/5.3.3 with OCI8 (Oracle instant client 10.2.0.5) working on RHEL6.3 with SELinux enabled by doing this:

chcon system_u:object_r:lib_t:s0 /usr/lib64/php/modules/oci8.so
execstack -c /usr/lib/oracle/<VERSION>/client64/lib/*.so
chcon -t texrel_shlib_t /usr/lib/oracle/<VERSION>/client64/lib/*.so
setsebool -P httpd_can_network_connect_db 1

I used a combination of audit2allow -w -a and hints from this article to get to this successful conclusion.

share|improve this answer
    
Thank you! For other newbies like me: I had to run all commands of the two provided answers to have oci8 working. –  Frosty Z Apr 5 '13 at 9:03
add comment

On CentosOS release 6.4 (Final), similar problems. Our solution seemed to be boolean 'httpd_execmem'

After applying without any success all your useful recommendations, keep failing the oci8 load on Apache. So, we got to "audit2allow" to the rescue!

$> echo "type=AVC msg=audit(1384944299.002:75458): avc: denied { execstack } for pid=6356 comm="httpd" scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:system_r:httpd_t:s0 tclass=process" | audit2allow

Obtaining the output: "This avc can be allowed using the boolean 'httpd_execmem'"

Finally the solution so far: $> setsebool httpd_execmem 1

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.