Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am creating a web application. Part of the functionality is depending on that the user can start/stop a cronjob that imports emails.

It doesn't work.

Just to make sure I'm on the right track, as a starter I just want to make 'crontab -l' from php to work and print it to the web browser.

This is how I do it (handle_email_cronjob.php):

$output = shell_exec('crontab -l');
echo $output;

but all I get is nothing. (doing shell_exec('ls -l'); gives me the list of files/dir in the directory)

cat error_log:

'/var/spool/cron' is not a directory, bailing out.

Well, it is a directory no matter what the error log say. ls -Z /var/spool:

drwxr-xr-x. apache apache system_u:object_r:httpd_sys_rw_content_t:s0 cron

SELinux is on and I don't want that to change.

ls -Z /var/spool/cron:

-rwxrwxrwx. apache apache unconfined_u:object_r:httpd_sys_rw_content_t:s0 apache
-rw-------. root   root   unconfined_u:object_r:cron_spool_t:s0 root

it's apache that should be used. (I did try setting cron_spool_t to apache, but still didn't work.)

ls -Z handle_email_cronjob.php:

-rwxr-xr-x. apache apache unconfined_u:object_r:httpd_sys_script_exec_t:s0 handle_email_cronjob.php

When running in permissive mode, I get following in the audit.log (A bit strange, first time after setting mode to permissive, I get a lot of logs with denied, but second time it looks like this. I double checked):

type=USER_ACCT msg=audit(1337714471.878:4452): user pid=11385 uid=48 auid=0 ses=113 subj=unconfined_u:system_r:httpd_t:s0 msg='op=PAM:accounting acct="apache" exe="/usr/bin/crontab" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1337714471.878:4453): user pid=11385 uid=48 auid=0 ses=113 subj=unconfined_u:system_r:httpd_t:s0 msg='op=PAM:setcred acct="apache" exe="/usr/bin/crontab" hostname=? addr=? terminal=cron res=success'

But when in enforce mode I get:

type=AVC msg=audit(1337714912.294:4458): avc:  denied  { getattr } for  pid=11416 comm="crontab" path="/var/spool/cron" dev=dm-0 ino=262695 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:system_cron_spool_t:s0 tclass=dir
type=SYSCALL msg=audit(1337714912.294:4458): arch=c000003e syscall=4 success=no exit=-13 a0=7f3f120a968f a1=7fff03e9cf40 a2=7fff03e9cf40 a3=7f3f122ac2e0 items=0 ppid=10835 pid=11416 auid=0 uid=48 gid=48 euid=0 suid=0 fsuid=0 egid=48 sgid=48 fsgid=48 tty=(none) ses=113 comm="crontab" exe="/usr/bin/crontab" subj=unconfined_u:system_r:httpd_t:s0 key=(null)

I thought that the errors should be logged, but not stopping, in permissive mode?

I just have a gut feeling that it is related to SELinux, but I can't figure out how to fix it.

What is the problem and how can I fix it? (or is there a better approach for doing this than my?)

share|improve this question
1  
"I just have a gut feeling that it is related to SELinux, but I can't figure out how to fix it." -If you don't understand the basics of selinux, I don't see how you are going to program in an environment where it is a constraint. $setenforce permissive, run your script and then check the auditlogs, then you can make a new rule that allows your script to run. You can't just program around selinux, the server administrator has to set the constraints so that only expected actions take place. that's kindof the point. – foocorpluser just now edit –  foocorpluser May 22 '12 at 18:20
    
Thanks for your comment. I am indeed trying to learn, I have solved other issues related to SELinux but this is not going that well. Now I understand that the tutorials/specifications I've red isn't complete. It works when in permissive mode, I updated my post with the output in audit.log. –  Nicsoft May 22 '12 at 19:24

2 Answers 2

Excuse me posting this as an answer, I just needed the format.

What do you get if you do the following, just to take cron out of the equation, and using something simple like cat. Im also assuming that you are trying to get at apache's crontab. And also assuming that the php is running as apache.

$output = shell_exec('/bin/cat /var/spool/cron/apache');
echo $output;
share|improve this answer
    
Forget my other comment, it gives me: "/bin/cat: /var/spool/cron/apache: Permission denied" in error_log, but nothing is echoed. (Made an update to my post, it should be handle_email_cronjob.php instead of pull_email.php) –  Nicsoft May 22 '12 at 17:40
    
Using shell_exec('ls -l'); instead posts the directory list. –  Nicsoft May 22 '12 at 17:46

After learning how to troubleshoot SELinux I realized that I had to label /var/spool/cron so httpd can read/write to that directory:

chcon -R -t httpd_sys_script_rw_t /var/spool/cron

References:

Understanding audit.log

Troubleshoot SELinux

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.