[F8] (Re)Starting httpd reveals php pdf.so stack permission errors...

[Dan Thurman]

# setenforce 1  (If set to 0, no following errors are generated)
# service httpd restart
<Generates the following errors>

/etc/log/httpd/errors_log:
=================
PHP Warning:  PHP Startup: Unable to load dynamic library
'/usr/lib/php/modules/pdf.so' - libpdf.so.6: cannot enable executable
stack as shared object requires: Permission denied in Unknown on line 0

# ls -lZ /usr/lib/php/modules/pdf.so
-rwxr-xr-x  root root
system_u:object_r:textrel_shlib_t:s0 /usr/lib/php/modules/pdf.so

# find / -xdev -name libpdf.so.6
<does not exist>

/etc/log/audit/audit_log:
===============
type=AVC msg=audit(1203285527.123:3893): avc:  denied  { execstack } for
pid=21241 comm="httpd" scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:system_r:httpd_t:s0 tclass=process
type=SYSCALL msg=audit(1203285527.123:3893): arch=40000003 syscall=125
success=no exit=-13 a0=bfca1000 a1=1000 a2=1000007 a3=fffff000 items=0
ppid=1 pid=21241 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) comm="httpd" exe="/usr/sbin/httpd"
subj=system_u:system_r:httpd_t:s0 key=(null)

SEAlert:
=================================================
Summary
    SELinux is preventing /usr/sbin/httpd (httpd_t) "execstack" to
<Unknown>
    (httpd_t).

Detailed Description
    SELinux denied access requested by /usr/sbin/httpd. It is not
expected that
    this access is required by /usr/sbin/httpd and this access may
signal an
    intrusion attempt. It is also possible that the specific version or
    configuration of the application is causing it to require additional
access.

Allowing Access
    You can generate a local policy module to allow this access - see
    http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can
disable
    SELinux protection altogether. Disabling SELinux protection is not
    recommended. Please file a
http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
    against this package.

Additional Information        

Source Context                system_u:system_r:httpd_t:s0
Target Context                system_u:system_r:httpd_t:s0
Target Objects                None [ process ]
Affected RPM Packages         httpd-2.2.8-1.fc8 [application]
Policy RPM                    selinux-policy-3.0.8-84.fc8
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   plugins.catchall
Host Name                     gold.cdkkt.com
Platform                      Linux gold.cdkkt.com 2.6.23.15-137.fc8 #1
SMP Sun
                              Feb 10 17:48:34 EST 2008 i686 i686
Alert Count                   10
First Seen                    Sun 17 Feb 2008 04:50:41 AM PST
Last Seen                     Sun 17 Feb 2008 01:46:21 PM PST
Local ID                      b2d0de85-f78b-4945-8d01-1ef26660fe47
Line Numbers                  

Raw Audit Messages            

avc: denied { execstack } for comm=httpd egid=0 euid=0
exe=/usr/sbin/httpd
exit=-13 fsgid=0 fsuid=0 gid=0 items=0 pid=20396
scontext=system_u:system_r:httpd_t:s0 sgid=0
subj=system_u:system_r:httpd_t:s0
suid=0 tclass=process tcontext=system_u:system_r:httpd_t:s0 tty=(none)
uid=0

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Daniel B. Thurman wrote:
>  # setenforce 1  (If set to 0, no following errors are generated)
>  # service httpd restart
>  <Generates the following errors>
>  
>  /etc/log/httpd/errors_log:
>  =================
>  PHP Warning:  PHP Startup: Unable to load dynamic library
>  '/usr/lib/php/modules/pdf.so' - libpdf.so.6: cannot enable executable
>  stack as shared object requires: Permission denied in Unknown on line 0
>  
>  # ls -lZ /usr/lib/php/modules/pdf.so
>  -rwxr-xr-x  root root
>  system_u:object_r:textrel_shlib_t:s0 /usr/lib/php/modules/pdf.so
>  
>  # find / -xdev -name libpdf.so.6
>  <does not exist>
>  
>  /etc/log/audit/audit_log:
>  ===============
>  type=AVC msg=audit(1203285527.123:3893): avc:  denied  { execstack } for
>  pid=21241 comm="httpd" scontext=system_u:system_r:httpd_t:s0
>  tcontext=system_u:system_r:httpd_t:s0 tclass=process
>  type=SYSCALL msg=audit(1203285527.123:3893): arch=40000003 syscall=125
>  success=no exit=-13 a0=bfca1000 a1=1000 a2=1000007 a3=fffff000 items=0
>  ppid=1 pid=21241 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
>  sgid=0 fsgid=0 tty=(none) comm="httpd" exe="/usr/sbin/httpd"
>  subj=system_u:system_r:httpd_t:s0 key=(null)
>  
>  SEAlert:
>  =================================================
>  Summary
>      SELinux is preventing /usr/sbin/httpd (httpd_t) "execstack" to
>  <Unknown>
>      (httpd_t).
>  
>  Detailed Description
>      SELinux denied access requested by /usr/sbin/httpd. It is not
>  expected that
>      this access is required by /usr/sbin/httpd and this access may
>  signal an
>      intrusion attempt. It is also possible that the specific version or
>      configuration of the application is causing it to require additional
>  access.
>  
>  Allowing Access
>      You can generate a local policy module to allow this access - see
>      http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can
>  disable
>      SELinux protection altogether. Disabling SELinux protection is not
>      recommended. Please file a
>  http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
>      against this package.
>  
>  Additional Information        
>  
>  Source Context                system_u:system_r:httpd_t:s0
>  Target Context                system_u:system_r:httpd_t:s0
>  Target Objects                None [ process ]
>  Affected RPM Packages         httpd-2.2.8-1.fc8 [application]
>  Policy RPM                    selinux-policy-3.0.8-84.fc8
>  Selinux Enabled               True
>  Policy Type                   targeted
>  MLS Enabled                   True
>  Enforcing Mode                Enforcing
>  Plugin Name                   plugins.catchall
>  Host Name                     gold.cdkkt.com
>  Platform                      Linux gold.cdkkt.com 2.6.23.15-137.fc8 #1
>  SMP Sun
>                                Feb 10 17:48:34 EST 2008 i686 i686
>  Alert Count                   10
>  First Seen                    Sun 17 Feb 2008 04:50:41 AM PST
>  Last Seen                     Sun 17 Feb 2008 01:46:21 PM PST
>  Local ID                      b2d0de85-f78b-4945-8d01-1ef26660fe47
>  Line Numbers                  
>  
>  Raw Audit Messages            
>  
>  avc: denied { execstack } for comm=httpd egid=0 euid=0
>  exe=/usr/sbin/httpd
>  exit=-13 fsgid=0 fsuid=0 gid=0 items=0 pid=20396
>  scontext=system_u:system_r:httpd_t:s0 sgid=0
>  subj=system_u:system_r:httpd_t:s0
>  suid=0 tclass=process tcontext=system_u:system_r:httpd_t:s0 tty=(none)
>  uid=0
>  
>  
>  
>  
>  ------------------------------------------------------------------------
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list 
This should be reported as a bug to whoever supplied
/usr/lib/php/modules/pdf.so


You can try
execstack -c /usr/lib/php/modules/pdf.so

And see if that removes th problem.

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.8 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAke5ltAACgkQrlYvE4MpobMdyACeKMpU5KQQYKxXsuC/6dEflZhh
> N1wAoINBYK6BTSuYC/9Kcg4zuW//9D9w
> =n+th
> -----END PGP SIGNATURE-----

[Dan Thurman]

On Mon, 2008-02-18 at 06:31 -0800, Daniel J Walsh wrote:

>  execstack -c /usr/lib/php/modules/pdf.so 

I tried it.  No change.

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Daniel B. Thurman wrote:
>  On Mon, 2008-02-18 at 06:31 -0800, Daniel J Walsh wrote:
>  
> > execstack -c /usr/lib/php/modules/pdf.so
>  
>  
>  I tried it.  No change.
>  
>   
Ok you can add this rule via audit2allow

# grep execstack /var/log/audit/audit.log | audit2allow -m myphp
# semodule -i myphp.pp

But you should report this as a bug against /usr/lib/php/modules/pdf.so

Attach this link

http://people.redhat.com/~drepper/selinux-mem.html
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.8 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAke562YACgkQrlYvE4MpobNgTgCguCSkIHwux+3o1xWZ8BVKXT81
> NSYAniS2zPG9LDJzKEdtU52SAiibYA5W
> =2rZG
> -----END PGP SIGNATURE-----

[Dan Thurman]

On Mon, 2008-02-18 at 12:32 -0800, Daniel J Walsh wrote:

>  -----BEGIN PGP SIGNED MESSAGE----- 
>  Hash: SHA1
>  
>  Daniel B. Thurman wrote: 
>  > On Mon, 2008-02-18 at 06:31 -0800, Daniel J Walsh wrote: 
>  > 
>  >> execstack -c /usr/lib/php/modules/pdf.so 
>  > 
>  > 
>  > I tried it.  No change. 
>  > 
>  > 
>  Ok you can add this rule via audit2allow
>  
>  # grep execstack /var/log/audit/audit.log | audit2allow -m myphp 
>  # semodule -i myphp.pp
>  
>  But you should report this as a bug
>  against /usr/lib/php/modules/pdf.so
>  
>  Attach this link 

Uh, I did the following steps:

1) execstack -c /usr/lib/php/modules/pdf.so
<nothing>
2) grep execstack /var/log/audit/audit.log | grep audit2allow -m myphp
grep: invalid max count
3) semodule -i myphp.pp
semodule:  Could not read file 'myphp.pp': No such file or directory

Somehow, this is not what you wanted?

[Todd Zullinger]

Daniel B. Thurman wrote:
>  1) execstack -c /usr/lib/php/modules/pdf.so
>  <nothing>
>  2) grep execstack /var/log/audit/audit.log | grep audit2allow -m myphp 
            
                           this > ^^^^

causes this:

>  grep: invalid max count 
You're calling grep rather than audit2allow as intended.  Remove the
grep after the pipe.

-- 
Todd        OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
You can get more with a kind word and a gun than you can with a kind
word alone.
    -- Al Capone (1899-1947)

[Dan Thurman]

On Mon, 2008-02-18 at 16:43 -0800, Todd Zullinger wrote:

>  Daniel B. Thurman wrote: 
>  > 1) execstack -c /usr/lib/php/modules/pdf.so 
>  > <nothing> 
>  > 2) grep execstack /var/log/audit/audit.log | grep audit2allow -m
>  myphp 
>                                          this > ^^^^
>  
>  causes this:
>  
>  > grep: invalid max count
>  
>  You're calling grep rather than audit2allow as intended.  Remove the 
>  grep after the pipe.
>   

Ok....

I tried:

1) grep execstack /var/log/audit/audit.log | audit2allow -m myphp

module myphp 1.0;

2) semodule -i myphp.pp
semodule:  Could not read file 'myphp.pp': No such file or directory

Seems that the myphp.pp file is never created, at least I cannot
find it....

[Todd Zullinger]

Daniel B. Thurman wrote:
>  Ok....
>  
>  I tried:
>  
>  1) grep execstack /var/log/audit/audit.log | audit2allow -m myphp
>  
>  module myphp 1.0;
>  
>  2) semodule -i myphp.pp
>  semodule:  Could not read file 'myphp.pp': No such file or directory
>  
>  Seems that the myphp.pp file is never created, at least I cannot
>  find it.... 
You want -M instead of -m as the argument to audit2allow AFAIK.

-- 
Todd        OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Many people are secretly interested in life.

[Dan Thurman]

On Mon, 2008-02-18 at 17:14 -0800, Todd Zullinger wrote:

>  Daniel B. Thurman wrote: 
>  > Ok.... 
>  > 
>  > I tried: 
>  > 
>  > 1) grep execstack /var/log/audit/audit.log | audit2allow -m myphp 
>  > 
>  > module myphp 1.0; 
>  > 
>  > 2) semodule -i myphp.pp 
>  > semodule:  Could not read file 'myphp.pp': No such file or
>  directory 
>  > 
>  > Seems that the myphp.pp file is never created, at least I cannot 
>  > find it....
>  
>  You want -M instead of -m as the argument to audit2allow AFAIK.
>   

ok... 3rd try:

1) grep execstack /var/log/audit/audit.log | audit2allow -M myphp
compilation failed:
(unknown source)::ERROR 'syntax error' at token '' on line 6:


/usr/bin/checkmodule:  error(s) encountered while parsing configuration
/usr/bin/checkmodule:  loading policy configuration from myphp.te

2) semodule -i myphp.pp
semodule: Could not read file 'myphp.pp': No such file or directory

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Daniel B. Thurman wrote:
>  On Mon, 2008-02-18 at 17:14 -0800, Todd Zullinger wrote:
>  
> > Daniel B. Thurman wrote: 
> >> Ok.... 
> >>
> >> I tried: 
> >>
> >> 1) grep execstack /var/log/audit/audit.log | audit2allow -m myphp 
> >>
> >> module myphp 1.0; 
> >>
> >> 2) semodule -i myphp.pp 
> >> semodule:  Could not read file 'myphp.pp': No such file or
> > directory 
> >> Seems that the myphp.pp file is never created, at least I cannot 
> >> find it....
> > You want -M instead of -m as the argument to audit2allow AFAIK.
> >
>  
>  
>  ok... 3rd try:
>  
>  1) grep execstack /var/log/audit/audit.log | audit2allow -M myphp
>  compilation failed:
>  (unknown source)::ERROR 'syntax error' at token '' on line 6:
>  
>  
>  /usr/bin/checkmodule:  error(s) encountered while parsing configuration
>  /usr/bin/checkmodule:  loading policy configuration from myphp.te
>  
>  2) semodule -i myphp.pp
>  semodule: Could not read file 'myphp.pp': No such file or directory
>  
>  
>  
>  
>  
>  ------------------------------------------------------------------------
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list 
Sorry Daniel, it was
probably my typing that caused the problem.  Could
you attach the myphp.te file that audit2allow created?


> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.8 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAke67UYACgkQrlYvE4MpobMzlwCeMplYAYlckgfU/1sD0zgRn+bg
> WR8AoI8rNbvSSihROKB0INKmZv9p1laH
> =pfEu
> -----END PGP SIGNATURE-----

[Dan Thurman]

On Tue, 2008-02-19 at 06:52 -0800, Daniel J Walsh wrote:

>  -----BEGIN PGP SIGNED MESSAGE----- 
>  Hash: SHA1
>  
>  Daniel B. Thurman wrote: 
>  > On Mon, 2008-02-18 at 17:14 -0800, Todd Zullinger wrote: 
>  > 
>  >> Daniel B. Thurman wrote: 
>  >>> Ok.... 
>  >>> 
>  >>> I tried: 
>  >>> 
>  >>> 1) grep execstack /var/log/audit/audit.log | audit2allow -m myphp 
>  >>> 
>  >>> module myphp 1.0; 
>  >>> 
>  >>> 2) semodule -i myphp.pp 
>  >>> semodule:  Could not read file 'myphp.pp': No such file or 
>  >> directory 
>  >>> Seems that the myphp.pp file is never created, at least I cannot 
>  >>> find it.... 
>  >> You want -M instead of -m as the argument to audit2allow AFAIK. 
>  >> 
>  > 
>  > 
>  > ok... 3rd try: 
>  > 
>  > 1) grep execstack /var/log/audit/audit.log | audit2allow -M myphp 
>  > compilation failed: 
>  > (unknown source)::ERROR 'syntax error' at token '' on line 6: 
>  > 
>  > 
>  > /usr/bin/checkmodule:  error(s) encountered while parsing
>  configuration 
>  > /usr/bin/checkmodule:  loading policy configuration from myphp.te 
>  > 
>  > 2) semodule -i myphp.pp 
>  > semodule: Could not read file 'myphp.pp': No such file or directory 
>  > 
>  >  


>  Sorry Daniel, it was probably my typing that caused the problem.
>  Could 
>  you attach the myphp.te file that audit2allow created? 

OK, not much there but here is the attachment!