Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

SELinux & PHP & Ingres

5 views
Skip to first unread message

Mike

unread,
Nov 23, 2006, 5:14:26 AM11/23/06
to
What bizarre incantation do I need to get SELinux & PHP & Ingres to
all work together. When I start apache, I get:

kernel: audit(1164275899.231:60): avc: denied { execstack } for
pid=1119 comm="httpd" scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:system_r:httpd_t:s0 tclass=process

and

PHP Warning: PHP Startup: Unable to load dynamic library
'/usr/lib/php/modules/ingres.so' - libcompat.1.so: cannot enable
executable stack as shared object requires: Permission denied in
Unknown on line 0

I've tried:

chcon -t texrel_shlib_t /usr/lib/php/modules/ingres.so

and even:

echo 'hwcap 0 nosegneg' > /etc/ld.so.conf.d/libc6-xen.conf

Mike

versions:
fedora core 5 (fc6) Linux version 2.6.18-1.2798.fc6xen
Ingres 2006 Linux Version II 9.0.4 (int.lnx/103)NPTL login
php 5.2.0
ingres php extension 1.4.0

Grant Croker

unread,
Nov 23, 2006, 8:36:09 AM11/23/06
to
On 23/11/2006 11:14, Mike wrote:
> What bizarre incantation do I need to get SELinux & PHP & Ingres to
> all work together.

Say "Red Lorry Yellow Lorry" several times very quickly?


> When I start apache, I get:
>
> kernel: audit(1164275899.231:60): avc: denied { execstack } for
> pid=1119 comm="httpd" scontext=system_u:system_r:httpd_t:s0
> tcontext=system_u:system_r:httpd_t:s0 tclass=process
>
> and
>
> PHP Warning: PHP Startup: Unable to load dynamic library
> '/usr/lib/php/modules/ingres.so' - libcompat.1.so: cannot enable
> executable stack as shared object requires: Permission denied in
> Unknown on line 0
>
> I've tried:
>
> chcon -t texrel_shlib_t /usr/lib/php/modules/ingres.so
>

The file causing the violation is libcompat.1.so. The same command
against that file and another should allow Ingres and SELinux to work
together:

chcon -t texrel_shlib_t $II_SYSTEM/ingres/lib/libcompat.1.so
chcon -t texrel_shlib_t $II_SYSTEM/ingres/lib/libbecompat.1.so

I have not tried PHP + Ingres in an SELinux environment so if you see
any other messages let me know. If you think you have found a bug can
you log it via http://pecl.php.net/ingres

regards

grant

--
Grant Croker, gra...@php.net |||
Software Engineer, Ingres Corp d-_-b
http://ingres.com

Mike

unread,
Nov 23, 2006, 4:19:30 PM11/23/06
to
Hi Grant

I had already done the "chcon -t texrel_shlib_t ..." commands:

ls -Z $II_SYSTEM/ingres/lib/lib*compat.1.so
-rwxr-xr-x ingres ingres system_u:object_r:textrel_shlib_t
/opt/Ingres/IngresII/ingres/lib/libbecompat.1.so
-rwxr-xr-x ingres ingres system_u:object_r:textrel_shlib_t
/opt/Ingres/IngresII/ingres/lib/libcompat.1.so

Mike

0 new messages