fedora core 3, httpd and PHP exec()

fedora core 3, httpd and PHP exec()

[Zia Syed]

Hi,
I'm running PHP in safe mode, and trying to run system command (uptime) 
in exec() statement. When i turn off the selinux (via firewall settings 
in KDE), the script works fine, but when its enabled, i get the 
following error in /var/log/messages

Dec 25 04:15:26 melville kernel: audit(1103948126.072:0): avc:  denied  
{ read }
 for  pid=5926 exe=/usr/sbin/httpd name=sh dev=hda2 ino=670441 
scontext=root:sys
tem_r:httpd_t tcontext=system_u:object_r:bin_t tclass=lnk_file
Dec 25 04:17:46 melville kernel: audit(1103948266.882:0): avc:  denied  
{ read }
 for  pid=5944 exe=/usr/sbin/httpd name=sh dev=hda2 ino=670441 
scontext=root:sys
tem_r:httpd_t tcontext=system_u:object_r:bin_t tclass=lnk_file

I tried using chcon (chcon -R -t httpd_sys_script_exec_t .) , but of no 
use as i dont know how to set permissions for binary files.

Please advise!

BR. Zia

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: fedora core 3, httpd and PHP exec()

[Russell Coker]

On Saturday 25 December 2004 15:38, Zia Syed <zia.chacho@gmail.com> wrote:
> I'm running PHP in safe mode, and trying to run system command (uptime)
> in exec() statement. When i turn off the selinux (via firewall settings
> in KDE), the script works fine, but when its enabled, i get the
> following error in /var/log/messages
>
> Dec 25 04:15:26 melville kernel: audit(1103948126.072:0): avc:  denied
> { read }
>  for  pid=5926 exe=/usr/sbin/httpd name=sh dev=hda2 ino=670441
> scontext=root:sys
> tem_r:httpd_t tcontext=system_u:object_r:bin_t tclass=lnk_file
> Dec 25 04:17:46 melville kernel: audit(1103948266.882:0): avc:  denied
> { read }
>  for  pid=5944 exe=/usr/sbin/httpd name=sh dev=hda2 ino=670441
> scontext=root:sys
> tem_r:httpd_t tcontext=system_u:object_r:bin_t tclass=lnk_file

We should allow it to read such sym-links.

Probably the best thing to do for executing programs via system(3) (as it 
seems PHP is doing) is to have a domain_auto_trans() rule.

Maybe domain_auto_trans(httpd_t, shell_exec_t, httpd_sys_script_t)?

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: fedora core 3, httpd and PHP exec()

[Russell Coker]

On Saturday 25 December 2004 23:18, Zia Syed <zia.chacho@gmail.com> wrote:
> Thanks for your reply. Where should I write this rule? I search for
> documentation on selinux and according to them i need to put them in a
> .te file. However, I dont have any .te file on my system.

You need to install the package selinux-policy-X-sources where "X" is either 
"targeted" or "strict" depending on what you installed (most likely 
targeted).

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: fedora core 3, httpd and PHP exec()

[Daniel J Walsh]

Russell Coker wrote:

>On Saturday 25 December 2004 15:38, Zia Syed <zia.chacho@gmail.com> wrote:
>  
>
>>I'm running PHP in safe mode, and trying to run system command (uptime)
>>in exec() statement. When i turn off the selinux (via firewall settings
>>in KDE), the script works fine, but when its enabled, i get the
>>following error in /var/log/messages
>>
>>Dec 25 04:15:26 melville kernel: audit(1103948126.072:0): avc:  denied
>>{ read }
>> for  pid=5926 exe=/usr/sbin/httpd name=sh dev=hda2 ino=670441
>>scontext=root:sys
>>tem_r:httpd_t tcontext=system_u:object_r:bin_t tclass=lnk_file
>>Dec 25 04:17:46 melville kernel: audit(1103948266.882:0): avc:  denied
>>{ read }
>> for  pid=5944 exe=/usr/sbin/httpd name=sh dev=hda2 ino=670441
>>scontext=root:sys
>>tem_r:httpd_t tcontext=system_u:object_r:bin_t tclass=lnk_file
>>    
>>
>
>We should allow it to read such sym-links.
>
>Probably the best thing to do for executing programs via system(3) (as it 
>seems PHP is doing) is to have a domain_auto_trans() rule.
>
>Maybe domain_auto_trans(httpd_t, shell_exec_t, httpd_sys_script_t)?
>
>  
>
Reading the policy, it looks like if you set the boolean httpd_ssi_exec 
you get this rule.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.