1

We are developing an admin UI for our product in PHP. It is hosted on Centos 7 and Apache web server. User should be able to ping an IP address using this UI. So we need to call exec(IPAddress) in PHP code and get the result and show to the user. The problem is it raises an error message. This is the error:

ping: socket: Permission denied

When I execute setenforce 0 in shell Centos lets us to execute ping command from PHP. How can I tell Centos let php execute ping command permanently?

Update: By using audit2why I got this message:

type=AVC msg=audit(1502697341.249:11426): avc:  denied  { create } for
pid=28530 comm="ping" scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:system_r:httpd_t:s0 tclass=rawip_socket

    Was caused by:
    Missing type enforcement (TE) allow rule.

    You can use audit2allow to generate a loadable module to allow this access.
  • 1
    Have you tried to troubleshoot using audit2why? – sebasth Aug 14 '17 at 7:45
1

You might try the following.

Put the that code in a local_httpd.te file:

policy_module(local_httpd, 0.0.1)

gen_require(`
    type httpd_t;
')

netutils_domtrans_ping(httpd_t)

Check that you have the selinux-policy-devel RPM installed and then do:

make -f /usr/share/selinux/devel/Makefile local_httpd.pp and semodule -i local_httpd.pp

This should allow apache (httpd_t) to transition to the context of the ping executable

  • where should local_httpd.te be located? – Beginner Aug 24 '17 at 6:50
  • Anywhere, just keep it afterwards as a reference – Bigon Aug 24 '17 at 15:55
0

SELinux is blocking PHP from executing ping. You need to attribute the correct context to your PHP scripts.

Assuming that they are located in /var/www/html/, you need to do:

semanage fcontext -a -t httpd_sys_script_exec_t '/var/www/html(/.*)?'
restorecon -R -v /var/www/html/

This, however, must be done by the root user on the server.

Note: The ping worked after you type setenforce 0 because this command disables SELinux. To disable SELinux permanently (not recommended as this turns off security checks), edit /etc/sysconfig/selinux and specify SELINUX=disabled.

  • Still getting error ping: socket: Permission denied. I did it by the root. – Beginner Aug 14 '17 at 8:24
-3

The best advice I can give you is to turn off SELinux and spend your time making your system more secure instead of jumping through mysterious and arbitrary hoops.

....unfortunately we don't live in a perfect world - so the "recommended" solution is to set the policy to permissive, run the script invoking ping, restore enforcing mode then run audit2allow against the the audit logs generated in the test (see linked document for some pointers to the detail of this).

Sadly this doesn't work in every case.

  • Oh fear - downvoted without a comment. But then its very SELInuxy to undermine something without explaining why. – symcbean Aug 21 '17 at 16:02
  • 1
    The complete goal of SELinux (and MAC in general) is to require an exhaustive list of the actions that are permitted by an executable. SELinux does not undermine something, it's doing its job. – Bigon Aug 22 '17 at 10:02
  • If it blocks an action without reporting the fact, its doing its job? If it doesn't provide a means for defining exception to a default policy, its doing its job? If it has no documentation explaining the policy, its doing its job? If the default configuration allows the vendor to override the changes applied by a system administrator it is doing its job? If the policy explicitly disallows something explicitly allowed allowed in a different package from the same vendor, it is doing its job? I have nothing against MAC - its just SELinux which continues to horrify me. – symcbean Aug 22 '17 at 12:34
  • SELinux reports all the denials in the audit framework. It does allow you to load your own custom policy. If a vendor is modifying the policy without the admin consent, how is that SELinux fault? – Bigon Aug 22 '17 at 13:52
  • Regarding the documentation of the policy: bfy.tw/DVZI – Bigon Aug 22 '17 at 14:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.