I am configuring Apache\PHP and noticed Apache complaining about permissions with the php shared object.

Starting httpd: 
httpd: Syntax error on line 206 of /etc/httpd/conf/httpd.conf: 
Cannot load /usr/lib/httpd/modules/libphp5.so into server: 
/usr/lib/httpd/modules/libphp5.so: cannot restore segment prot after reloc: 
Permission denied

I looked at the context (started fine with enforcement off) and found:

# ls --context /usr/lib/httpd/modules/libphp5.so
-rwxr-xr-x root root root:object_r:httpd_modules_t /usr/lib/httpd/modules/libphp5.so

Shouldn't httpd (apache) be able to access files with a context of httpd_modules_t? I got it fixed by applying

chcon -t textrel_shlib_t '/usr/lib/httpd/modules/libphp5.so'

But I would think the httpd version would work before this one. Can someone explain this to me?


Under SELinux each item is required to have a context. Text relocation can be described as an error. Changing the context creates an exception coaxing SELinux into allowing it to load even though it in essence is b0rken. Way better text relocation explanation: http://www.akkadia.org/drepper/textrelocs.html. BTW using chcon isn't permanent: relabelling will reset the context. Use

# semanage fcontext -a -t textrel_shlib_t /usr/lib/httpd/modules/libphp5.so

to make it stick (see /etc/selinux/targeted/contexts/files/file_contexts.local).


| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.