I installed a minimal CentOS system with Apache, PHP and SELinux in a default configuration:
SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Max kernel policy version: 29
If I want to change the Apache root directory, I must relabel this new directory otherwise SELinux block the access. But I found, with PHP scripts, that it's possible to do a lot more than I expected. For example, I can do the following actions without any alerts:
- display kernel version,
- establish connection with external hosts
However I receive AVC alerts when I try to read attributes of
/etc/shadow or when I try to access home directory.
First of all, is it normal? And how can I tweak SELinux to restrict more PHP actions?
I use CentOS 7 and my selinux-policy version is 3.13.1-23.el7_1.7. (I also tried the same with Fedora and get the same results)