1

Hi I am using nginx server which is hosting a web application in RHEL OS with selinux in enforcing mode.

On accessing the application I am getting the 502 bad gateway error and on checking the audit and php error logs I found this what is happening and since I am new to selinxu concepts I have not clue what is happening.

On disabling the selinux i.e setting the mode to permmissive I am able to access the application.

audit.log output

type=anom_abend msg=audit(1631601740.012:8181): auid=4294967295 uid=48 gid=48 ses=4294967295 subj=system_u:system_r:httpd_t:s0 pid=13287 comm="php-fpm" reason="memory violation" sig=11

/var/log/php-fpm/error.log output

[14-Sep-2021 02:58:54] WARNING: [pool www] child 14636 exited on signal 11 (SIGSEGV) after 644.841338 seconds from start
[14-Sep-2021 02:58:54] NOTICE: [pool www] child 16740 started

Nginx Version

[user@redhat7 html]$ nginx -v
nginx version: nginx/1.20.1

php-fpm version

[user@redhat7 html]$ php-fpm --version
PHP 7.3.29 (fpm-fcgi) (built: Jun 29 2021 09:30:31)
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.3.29, Copyright (c) 1998-2018 Zend Technologies

strange issue:-

I am using a custom library which reads shared memory and this library is loaded with php-fpm. Turned out that after printing the data structure either doing std out or wrtiting it to the file then only it's causing this memory voilations.

strange this is if I just access the data member which has been read from the shared memory like bleow not voilation is seen. Eg;-

ptr->member1; // no issue
ptr->member2; // no issue

cout<<ptr->member1; // memory voilation , oh no!!!!!
9
  • There aren’t enough logs to be able to diagnose the issue. We’re there no other AVCs in the audit log?
    – jsbillings
    Commented Sep 15, 2021 at 22:46
  • There are avc logs but this only come when I try to access the application hosted by nginx and that's it, if I again access same log message Commented Sep 16, 2021 at 10:38
  • It's exciting problem. Dirty hack :: setsebool -P httpd_execmem 1 :: from here: bugzilla.redhat.com/show_bug.cgi?id=1507287 Please read the discussion.
    – K-attila-
    Commented Oct 27, 2021 at 7:42
  • @K-att- still the same audi log even after setting the bool you mentioned. Commented Oct 28, 2021 at 7:59
  • You use php-opcache? Hint: bugzilla.redhat.com/show_bug.cgi?id=1722502 "2 possible fix: 1/ runtime - change default provided configuration to opcache.huge_code_pages=0 (whichh may allow user to enable it....) 2/ buldtime - add --disable-huge-code-pages build option - clean configuration file In both case, a configuration change is needed" bugzilla.redhat.com/show_bug.cgi?id=1670386
    – K-attila-
    Commented Oct 28, 2021 at 8:56

1 Answer 1

0

The problem seems to be that the fpm process is not allowed to access the shared memory of another process.

By putting selinux in permissive mode, you should be able to get audit to show you which rule you need to add to the appropriate selinux policy file to allow the process to run, using the audit2allow utility.

The explanation for the "strange" behaviour of the library is a bit convoluted. The library you have has to be compiled, and the compiler is smart enough to understand that this instruction

ptr->member1;

does nothing. So, chances are that the instruction is edited out of the compiler stream unless you explicitly turn off all compiler optimizations (and, maybe, even if you do). The SIG11 abend on access is a side effect the compiler can't be, and isn't, aware of.

The compiler is also smart enough to understand that this, too, does nothing, unless you later use a for something:

int a = ptr->member1 + ptr->member2;

But if you write something to stdout, well then that is an effect that can't be bypassed, and that code gets executed - triggering the signal 11.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .