Bug 765591 - SELinux is preventing /usr/bin/php from using the 'execstack' accesses on a process.
Summary: SELinux is preventing /usr/bin/php from using the 'execstack' accesses on a p...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 14
Hardware: i386
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:05e04021ebf...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-12-08 21:51 UTC by Bill Thielman
Modified: 2011-12-09 11:04 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-12-09 11:04:00 UTC
Type: ---


Attachments (Terms of Use)

Description Bill Thielman 2011-12-08 21:51:05 UTC
SELinux is preventing /usr/bin/php from using the 'execstack' accesses on a process.

*****  Plugin catchall_boolean (89.3 confidence) suggests  *******************

If you want to allow unconfined executables to make their stack executable.  This should never, ever be necessary. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla
Then you must tell SELinux about this by enabling the 'allow_execstack' boolean.
Do
setsebool -P allow_execstack 1

*****  Plugin catchall (11.6 confidence) suggests  ***************************

If you believe that php should be allowed execstack access on processes labeled system_cronjob_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep php /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:system_cronjob_t:s0-s0:c0.c1023
Target Context                system_u:system_r:system_cronjob_t:s0-s0:c0.c1023
Target Objects                Unknown [ process ]
Source                        php
Source Path                   /usr/bin/php
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           php-cli-5.3.8-3.fc14
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.7-46.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     (removed)
Platform                      Linux (removed) 2.6.35.14-106.fc14.i686 #1 SMP
                              Wed Nov 23 13:57:33 UTC 2011 i686 i686
Alert Count                   3
First Seen                    Thu 08 Dec 2011 02:28:00 PM EST
Last Seen                     Thu 08 Dec 2011 02:36:00 PM EST
Local ID                      9324a144-4c46-472f-935d-af0b1f064a9c

Raw Audit Messages
type=AVC msg=audit(1323372960.293:48016): avc:  denied  { execstack } for  pid=7678 comm="php" scontext=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 tclass=process


type=SYSCALL msg=audit(1323372960.293:48016): arch=i386 syscall=mprotect success=yes exit=0 a0=bfd42000 a1=1000 a2=1000007 a3=bfd41794 items=0 ppid=7676 pid=7678 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=1 comm=php exe=/usr/bin/php subj=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 key=(null)

Hash: php,system_cronjob_t,system_cronjob_t,process,execstack

audit2allow

#============= system_cronjob_t ==============
#!!!! This avc is allowed in the current policy

allow system_cronjob_t self:process execstack;

audit2allow -R

#============= system_cronjob_t ==============
#!!!! This avc is allowed in the current policy

allow system_cronjob_t self:process execstack;

Comment 1 Miroslav Grepl 2011-12-09 11:04:00 UTC
You will need to turn on the boolean. 

Do you know which cronjob causes this? Is this your own cronjob?


Note You need to log in before you can comment on or make changes to this bug.