1

This question already has an answer here:

On my installation of CentOS 7, SELinux is enabled by default. This is preventing Apache from properly reading PHP files in the standard /var/www/html document root (the browser is blank when displaying web pages containing PHP script). When I disable SELinux the pages display normally.

Is there some way of setting SELinux to allow Apache to access PHP files from the document root? I would rather not disable SELinux entirely given that CentOS clearly believes it is a desirable security addition.

marked as duplicate by user619714, Michael Hampton Nov 7 '14 at 23:23

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Run audit2allow < /var/log/audit/audit.log and inspect the output. – Michael Hampton Nov 6 '14 at 0:29
  • Michael, I get a 'command not found', is some sort of package required? – Grant_Bailey Nov 6 '14 at 0:33
  • It's the policycoreutils-python package. Have you had a chance to read the documentation? You should do that soon. – Michael Hampton Nov 6 '14 at 0:41
  • Michael, the material you linked was valuable and provided me with the solution which I will post as an answer. Thanks again. – Grant_Bailey Nov 6 '14 at 8:43
  • Though it doesn't deal with PHP directly, this answer might help as it surveys a number things related to apache and SELinux : serverfault.com/a/551801/101931 – kbulgrien Jul 20 '18 at 19:40
3

I don't do much SELinux, but you can try

semanage fcontext -a -t httpd_sys_script_exec_t '/var/www/html(/.*)?'

restorecon -R -v /var/www/html/

That allows Apache to execute PHP scripts in that directory, and persists after a reboot.

If you use MySQL, you may have to do the same for that. SELinux: Letting Apache talk to MySQL on CentOS may help

1

Running audit2allow < /var/log/audit/audit.log confirmed that httpd was being blocked by SELinux (see this link). The solution was to create and apply a policy module using the following steps:

  1. As root, run the command audit2allow -a -M my_httpd (replace 'my_httpd' with whatever name you prefer).
  2. Again as root, run the command semodule -i my_httpd.pp to install the module.

After I followed these steps Apache was able to run PHP scripts on my server without difficulty. Restart of the server does not destroy the changes.

Content of module file (my_httpd.te):

module my_httpd 1.0;
require {
    type admin_home_t;
    type httpd_t;
    class file { read getattr open };
}
#============= httpd_t ==============
allow httpd_t admin_home_t:file { read getattr open };
  • Out of curiosity, are you able to share the contents of the module you created? It seems unusual that you would need to build a custom module for php files in the default docroot. Maybe the files were moved into the directory and don't have the proper context, in which case the restorecon command from bhavicp's answer might resolve the issue. – mvermaes Nov 6 '14 at 12:09
  • Yes, it seems very unlikely that you would have needed a custom policy module. More likely a simple boolean, or your files simply had the wrong contexts to begin with. – Michael Hampton Nov 6 '14 at 13:15
  • Yes, the module consists of the two files my_httpd.pp (binary file) and my_httpd.te, the contents of which I will have to post separately. – Grant_Bailey Nov 7 '14 at 8:07
  • ... sorry, module contents appear in my answer which has been edited. – Grant_Bailey Nov 7 '14 at 8:14
  • You're doing development as root ? – user619714 Nov 7 '14 at 8:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.