Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In Fedora how do you configure Selinux to give permissions to an arbitrary executable to be run by the PHP system or exec functions? Turning SELinux off is not an option for me.

$ getsebool -a | grep httpd  

allow_httpd_anon_write --> off  
allow_httpd_mod_auth_ntlm_winbind --> off  
allow_httpd_mod_auth_pam --> off  
allow_httpd_sys_script_anon_write --> off  
httpd_builtin_scripting --> on  
httpd_can_check_spam --> off  
httpd_can_network_connect --> off  
httpd_can_network_connect_cobbler --> off  
httpd_can_network_connect_db --> off  
httpd_can_network_memcache --> off  
httpd_can_network_relay --> off  
httpd_can_sendmail --> off  
httpd_dbus_avahi --> off  
httpd_enable_cgi --> on  
httpd_enable_ftp_server --> off  
httpd_enable_homedirs --> off  
httpd_execmem --> off  
httpd_read_user_content --> off  
httpd_setrlimit --> off  
httpd_ssi_exec --> on  
httpd_tmp_exec --> off  
httpd_tty_comm --> on  
httpd_unified --> off  
httpd_use_cifs --> off  
httpd_use_gpg --> off  
httpd_use_nfs --> off  
share|improve this question

closed as not a real question by Michael Hampton Jun 2 '13 at 17:37

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

Please run the request again an provide the log results of "ausearch -ts recent -m avc" – Matthew Ife Nov 6 '11 at 22:49

Check the current SELinux settings related to Apache with:

# /usr/sbin/getsebool -a | grep httpd

You need to turn on httpd_ssi_exec to allow Apache to execute SSI scripts:

# setsebool -P httpd_ssi_exec=1
share|improve this answer
I already tried it. In the httpd log it still shows "permission denied". – Memento Nov 6 '11 at 9:24
Please post a log snippet? – quanta Nov 6 '11 at 9:30
sh: /tmp/defne/eq7ZO4fu8lYI: Permission denied This is the only relevant thing in /var/log/httpd/error_log – Memento Nov 6 '11 at 9:55
What did you try? Edit your original post to append the /var/log/audit/audit.log. – quanta Nov 6 '11 at 10:25
IT SAYS: "End a line with two spaces to add a <br/> linebreak:" but apparently it is not working, I hope you can read this: # cat /var/log/audit/audit.log | grep executableFileName type=AVC msg=audit(1320562016.878:1786): avc: denied { execute } for pid=6004 comm="sh" name="executableFileName" dev=dm-1 ino=536509 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_rw_content_t:s0 tclass=file – Memento Nov 6 '11 at 10:36

Just bumped into this same issue. Setting httpd_execmem to on solved the problem.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.