• Welcome to Overclockers Forums! Join us to reply in threads, receive reduced ads, and to customize your site experience!

SELinux, apache and PHP oracle extensions: catch-22

Overclockers is supported by our readers. When you click a link to make a purchase, we may earn a commission. Learn More.

magellan

Member
Joined
Jul 20, 2002
For PHP to initially load the oracle extensions libraries it needs the files to have SElinux type textrel_shlib_t. But when apache
runs a PHP script it needs these same oracle extension files to be of type httpd_t otherwise the libraries can't be
loaded.

Does anyone know what userid PHP runs under when it first loads (i.e. before any scripts are run from apache)?

I'm thinking I could add whatever userid PHP runs under to the apache group and then it would be able to access
the files under the httpd_t SELinux context.
 
I don't think php is a service that runs in the background as a particular user. When your webserver has a request for a php asset, I think that's when it gets called.. probably as whatever user your webserver is running as.

IMO, disable SELinux. :)
 
I tried doing a custom SELinux policy module for the exceptions being thrown by SELinux for these oracle shared object libraries and it didn't work. Instead I had to execute execstack and clear the executable stack flag from the oracle shared object libraries that were problematic:

execstack -c ./libclntsh.so
execstack -c ./libclntsh.so.12.1

which fixes the following issue:
PHP Warning: PHP Startup: Unable to load dynamic library '/usr/lib64/php/modules/oci8.so' - libclntsh.so.12.1:
cannot enable executable stack as shared object requires: Permission denied in Unknown on line 0

a. see http://www.cdatazone.org/index.php?/archives/37-PHP,-Oracle-and-SELinux.html
 
Back