[RESOLVED] passthru command unable to access a file? selinux?

waldow

Hi,

I have some legacy code where I use passthru to execute a line which creates a graph using gnuplot and it saves it in a place my php can access. I recently moved from RH enterprise version 3 to 4 and the new server uses selinux policies. After the upgrade my passthru code has broken. The error I get seems to suggest that the command I send thru passthru is unable to access a file in '/tmp'.

I send a command like
passthru("echo 'misc gnuplot parameters; plot "/tmp/tempdata/in.234513' | gnuplot > /var/www/html/tempdata/temp.png")...

and when it is executed, I get the following error in /var/log/httpd/error_log

gnuplot> plot "/tmp/tempdata/in.716311" with lines 1, "/tmp/tempdata/out.716311" with lines 3
^
can't read data file "/tmp/tempdata/in.716311"
line 0: util.c: Permission denied

Now that file is in /tmp and its permissions are:

76 -rw-r--r-- 1 apache apache 68652 Sep 20 00:40 out.716311

and should be able to be read by 'u,g, or o'.

I am wondering if it might be selinux related. Its settings are

-rw-r--r-- apache apache root:object_r:httpd_tmp_t out.716311

Also, I can run the command by hand from a shell and it works nicely.

Any ideas where I can learn about how passthru and/or exec interact / function with selinux?

Redhat ES 4, Apache 2.0.52, php 4.3.9, kernel 2.6.9-11

I have been trying google with no luck.

Thanks,

Dean W.

waldow

the file names I mentioned are different in my text above but for an actual situation they are indeed the same file name. Sorry for the typo.

kakki

plenty of things:
- have you checked the permissions on /tmp ( chmod 777 /tmp ),
so that you can access the directory(x-permission) ???
- there's no chroot-enviroment on your apache-user ???

what happens if you send "ls /tmp" through your system-command???

waldow

kakki wrote:
plenty of things:
- have you checked the permissions on /tmp ( chmod 777 /tmp ),
so that you can access the directory(x-permission) ???
- there's no chroot-enviroment on your apache-user ???

what happens if you send "ls /tmp" through your system-command???

Hi Kakki...

Permissions on tmp look normal from my read:
drwxrwxrwt 27 root root 4096 Sep 21 04:02 tmp

the directory inside tmp that I read is tempdata and it permissions are
drwxr-xr-x 2 apache apache 4096 Sep 21 10:54 /tmp/tempdata
(I chmod'ed it to 777 with no change in the behavior)

the selinux context is
drwxrwxrwx apache apache root:object_r:httpd_tmp_t /tmp/tempdata

for a normal tmp file is seems to be:
drwx------ root root root:object_r:tmp_t /tmp/misc_file

I added /bin/bash to /etc/passwd to allow running the same command from a shell. I don't know if that is a chroot environment as you describe...

I can run an ls -adl /tmp/ from the php passthru but it seems to fail when I run an ls -adl /tmp/tempdata/ from passthru.

This seems to make me think it is a selinux question since the only difference I can find is the selinux context.

Thoughts?

Dean

waldow

After some nice help from redhat, I was able to get the script running again. Here is what helped me. This is a feature of selinux not a bug as I was told.

If you get permission errors (in /var/log/httpd/error_log) which seem to be from selinux (and not standard chmod or chown issues), make sure that the folder you are using is not in /tmp and has the selinux context of httpd_sys_script_rw_t as can be set as follows:

chcon -t httpd_sys_script_rw_t folder_name

Hope this helps someone...