0

I am using a Server with Centos 7 and nginx, PHP5.4. I host Magento and everthing works well. And now I just remove the PHP5.4 which is installed and I install PHP7 and I also change everything what is needed

listen = /var/run/php-fpm/php-fpm.sock
listen.owner = nginx 
listen.group = nginx
user = nginx 
group = nginx

I also set the SELINUX with setenforce 0 to permissive. I have to note that when I install the PHP5.4 I have to follow that Tutorial https://www.cloudinsidr.com/content/troubleshooting-php-7-tcp-sockets-with-selinux-on-centos-7-rhelfedora/ to get php-fpm work otherwise I got a forbidden error.

Now after installing PHP7 and change everything what is needed I get an error if I run

sudo cat /var/log/nginx/error.log

2016/08/10 13:15:54 [alert] 2118#2118: setrlimit(RLIMIT_NOFILE, 100000) failed (1: Operation not permitted)

on Frontend is a 502 Bad Gateway. So I thought that it could be the same problem like PHP5.4 so I do that Tutorial again. and nothing still the same problem.

Note

I don't changed any folder or file permissions. So where is the problem?

Thanks

6
  • setenforce only sets the SELinux policy for the current runtime. After reboot, the default SELinux policy is active again. Did you change the SELinux policy in /etc/sysconfig/selinux? Aug 10, 2016 at 11:55
  • @DirkTrilsbeek I know but I do not reboot the server so it should work I also tried it out with editing the conf file and reboot to get active
    – vTillmann
    Aug 10, 2016 at 13:33
  • did you check with getenforce which SELinux policy is active? If the permissive policy is active, your problem is likely not related to SELinux. Aug 10, 2016 at 13:48
  • @DirkTrilsbeek do you have any idea what it could be? I ask because everthing is the same I only remove the PHP5.4 and install PHP7 nothing more
    – vTillmann
    Aug 10, 2016 at 13:54
  • I'm not a PHP expert, but if that's the one major configuration change, I'd start investigating there. See if PHP works at all, see if a simple app works, go on from there. Aug 10, 2016 at 13:58

2 Answers 2

-1

SELinux sucks hugely.

But unless you know exactly what you are doing I would not recommend disabling it / running as non-enforcing for any length of time.

where is the problem?

While you could take a few months out to learn how SELinux and the Redhat type enforcement policy is supposed to work (we'll skip over the fact it doesn't always work that way) I expect you're looking for a quicker solution.

Instead:

  • offer up a small blood sacrifice to the NSA and Redhat's SELinux maintainers
  • relabel everything (touch /.autorelabel ; reboot)
  • Set it to non-enforcing via the command line (setenforcing 0)
  • try to regression test all the functionality of your system
  • create a policy for the exceptions with audit2allow
  • enable the policy
  • sent enforcing on again
  • repeat steps above at regular intervals

Or reformat your server, install OpenSuse or Ubuntu and use Apparmor instead.

4
  • Hi, thanks for your roadmap :) but I do not understand why everthing works perfekt if I use php5.4 an if I install php7 nothing works ? Now I thought to downgrad to check if something on the system is crazy and.. no after downgrading everthing is fine
    – vTillmann
    Aug 10, 2016 at 13:31
  • So you mean that there is not similar problem with ubuntu or opensuse
    – vTillmann
    Aug 10, 2016 at 13:34
  • As long as you don't install SELinux on them :) In theory you can un-install SELinux from Centos and install Apparmor there - but it'd be almost as much of a pain as trying to fix SELinux
    – symcbean
    Aug 10, 2016 at 14:11
  • Trying to understand Linux is like trying to shift the moon's orbit. Technically possible, but life's too short.
    – symcbean
    Aug 10, 2016 at 14:15
-1

Try This :

cat /etc/security/limits.d/nofile.conf

  • soft nofile 10000
  • hard nofile 1000000

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .