Daniel Paul wrote:
Hello again,
execstack -c /usr/lib/modules/interbase.so does not solve the problem,
execstack -s and -c show the same behaviour (same error message, see below).
Maybe some more information:
ls -Z for interbase shows:
-rwxr-xr-x root root system_u:object_r:lib_t interbase.so
BTW: /usr/lib/httpd/libphp5.so has the same context data:
-rwxr-xr-x root root system_u:object_r:lib_t libphp5.so
(shouldn't it be -> t=httpd_modules_t ?)
Tell me if you need more input to solve the problem...
Daniel
Daniel Paul wrote:
Hello there,
because I need interbase (firebird) support in php, I recompiled the
actual php-5.0.4-10.5 package with interbase support
(--with-interbase=shared). When I start httpd there is the following
message in error_log:
PHP Warning: PHP Startup: Unable to load dynamic library
'/usr/lib/php/modules/interbase.so' - object requires: cannot enable
executable stack as shared object requires: Permission denied in Unknown
on line 0
try
execstack -c /usr/lib/php/modules/interbase.so
execstack is a security problem
http://people.redhat.com/drepper/selinux-mem.html
phpinfo() shows that php has read the interbase.ini file which contains a
reference to the interbase.so module, but interbase support is disabled
(nothing shows up regarding interbase). With selinux set to permissive
mode (instead of enforcing), there is no such message and phpinfo() shows
me, that interbase support is enabled.
audit.log shows the following:
type=AVC msg=audit(1138630853.033:10): avc: denied { execstack } for
pid=1886 comm="httpd" scontext=root:system_r:httpd_t
tcontext=root:system_r:httpd_t tclass=process
type=SYSCALL msg=audit(1138630853.033:10): arch=40000003 syscall=125
success=no exit=-13 a0=bf8a3000 a1=1000 a2=1000007 a3=d5a000 items=0
pid=1886 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
comm="httpd" exe="/usr/sbin/httpd"
Any help would be truly appreciated.
After you execute
execstack -c /usr/lib/modules/interbase.so
Are you still seeing avc messages?
Dan
Thanks in advance,
Daniel
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
