centos , linux , apache permission issue

Question

I have a php file which executes a shell script

$ip_access = $_GET['ip_access'];
// run knock app
exec("/home/knock.sh ".$ip_access);

however when I access it I receive the following error in the logs "sh: /home/knock.sh: Permission denied" I created a new user and added it in the apache httpd.conf file but is still not working . Any advice how to set the permissions or how can I grant more access to the user to make it work would be highly appreciated .

Answer 1

If you are running the script as the appropriate user, you may need to add the execute permission +x to the file. You can do it using:

chmod +x /home/knock.sh

As an alternative, you can use the following command (no need to add execute permission):

exec("bash /home/knock.sh ".$ip_access);

Answer 2

Check what mode you're running SELinux in.

getenforce

If you're running in Enforcing mode, you can troubleshoot SELinux problems by disabling SELinux temporarily:

setenforce 0

If the script runs, re-enable SELinux with setenforce 1 and start looking for where the problem is with your configuration versus the system's SELinux security policy.

If you're running in Enforcing mode, which is the default, you'll need to change the context of that file, because Apache can only execute files with the httpd_script_exec_t label by default. You'll want to run:

semanage fcontext -a -t httpd_script_exec_t /home/knock.sh
fixfiles restore /home/knock.sh

Afterwards, verify the script's SELinux context:

ls -lZ /home/knock.sh

If you're running in Enforcing mode and this still doesn't work, check your audit logs at /var/log/audit/audit.log.