Bug 1045875

Description of problem:
I was attempting to call an HTML/PHP page on my local box (using a local httpd server), because I've just modified the PHP script and I wanted to test/debug it. PHP is a module to the HTTP server (Apache).
The /var/log/php_errors.log is labeled "system_u:object_r:var_log_t:s0", as are many files in the same directory.
Is it a label conflict with those expected by httpd (i.e. should this log file be labelled something like "system_u:object_r:httpd_log_t:s0") ? Are they specific labels for HTTP or for PHP ? And in that case why did this file come with a "generic" "var_log_t" label, instead of the correct one?



Additional info:
reporter:       libreport-2.1.10
hashmarkername: setroubleshoot
kernel:         3.12.5-200.fc19.i686.PAE
type:           libreport

Currently we don't know anything about /var/log/php_errors.log in policy?  Is this something you created or a standard location for this?

You can change the label to httpd_log_t.  If it is standard we need to add this by default.

(In reply to Daniel Walsh from comment #2)
> Currently we don't know anything about /var/log/php_errors.log in policy? 
> Is this something you created or a standard location for this?

(Sorry for the delay, but I had to track down everything I did, to try to give the best possible answer).

The location where PHP expects to find "php_error.log" is defined in an option of php.ini (usually located itself in /etc). The comments in /etc/php.ini about this option are copied here below :

; Log errors to specified file. PHP's default behavior is to leave this value
; empty.
; http://php.net/error-log
; Example:
;error_log = php_errors.log

This could explain why it is not foreseen in a standard SE policy, but at some point in the debugging process the need for such a specific log file could arise, and it was my situation so I needed to activate this option.

I first tried with the relative path shown in the example, but could not find where the error file were created (relative path to "what" is unclear in the comment above).

So I eventually set an absolute path to make it appear in the directory that seemed to me the best suitable for this kind of file (/var/log), setting the above option to :
error_log = /var/log/php_errors.log

Obviously the above comment does not indicate which SE labels should be used for it, so I left the default labels for that directory (e.g. var_log_t).

I don't really understand how labels are managed, but I guess that if PHP is used as an Apache module, it "inherits" the labels attached to Apache (i.e. httpd_log_t), so the php_errors.log file should be labelled the same (and maybe a better location for it should be /var/log/httpd rather than /var/log) ?

Unfortunately in the meantime my PHP script is debugged so I no longer generate errors to populate the error file.

HTH, but if additional info is required, please ask.

Yes, 

httpd_log_t 

is the right label for it. I added


 /var/log/suphp\.log.*  --      gen_context(system_u:object_r:httpd_log_t,s0)
+/var/log/php_errors\.log.*     --      gen_context(system_u:object_r:httpd_log_t,s0)

The best solution would be have 

/var/log/php 

directory.

selinux-policy-3.12.1-74.18.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-74.18.fc19

Package selinux-policy-3.12.1-74.18.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-74.18.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-2409/selinux-policy-3.12.1-74.18.fc19
then log in and leave karma (feedback).

selinux-policy-3.12.1-74.18.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.