I want to compartmentalize different PHP applications on my SL6.4 (RHEL 6.4 rebuild) web server so that they cannot access each others' data. It seems that SELinux might be able to do this, but I am not sure on the details. My question has two parts:
- How does SElinux manage PHP scripts running in the Apache process with mod_php? Does the process somehow enter the script context when running the PHP script, or does that only work when scripts are run out-of-process via CGI or FastCGI? If it transitions to a script context to run the PHP script, what keeps a PHP bug from triggering a transition back to the main httpd context? If I need an alternate PHP deployment method, that would be good to know.
- How can I separate scripts/applications so that e.g. TinyTinyRSS cannot access things owned by OpenCloud? It looks like I should be able to do this by turning off
httpd_unifiedand providing separate
httpd_opencloud_*sets of contexts, parallel to
httpd_sys_foo. It might even be sufficient for me to use the sys/user distinction without new contexts, given the number of apps I can use. But I haven't found much documentation on exactly what the implications of turning off
httpd_unifiedare, or how to set up different HTTP contexts. Particularly with PHP scripts run via
I am fine with creating new SELinux policy modules, but would like some documentation pointing to what I need to make the new policy do and how to make it integrate nicely with the SELinux targeted policy.
If it is a lost cause to try to do this separation just with SELinux and I need to spin up separate httpds in different contexts, or possibly even LXC containers, that would be a useful answer as well.