Bug #71532 [Opn]: Child terminates when SELinux denies access to library

Edit report at https://bugs.php.net/bug.php?id=71532&edit=1 ID: 71532 Updated by: bukka@php.net Reported by: david at davidsteinsland dot net Summary: Child terminates when SELinux denies access to library Status: Open Type: Bug -Package: FPM related +Package: Dynamic loading Operating System: CentOS 7 64-bit PHP Version: 5.6.18 Block user comment: N Private report: N New Comment: This is not really FPM issue as it cannot handle this case. From the FPM point of view the child crashed which is probably because loading of extension failed. I think the actual library path is already configurable so this part seems to me more like configuration issue possibly but it still shouldn't probably crash. It would be useful to get the child backtrace and see if anything can be done during loading and possibly better error reported. Previous Comments: ------------------------------------------------------------------------ [2016-02-05 10:17:40] david at davidsteinsland dot net Description: ------------ When I was setting up a PHP extension I compiled it by providing an absolute path to the library it needed. After installing, I copied the library to /usr/lib64. The directory in which I compiled the extension, was /root/. All seemed fine, running php -m showed the extension loaded. However, php-fpm filled the log with: [05-Feb-2016 10:57:05] NOTICE: Terminating ... [05-Feb-2016 10:57:05] ALERT: oops, unknown child (16001) exited with code 0. Please open a bug report (https://bugs.php.net). [05-Feb-2016 10:57:05] NOTICE: exiting, bye-bye! [05-Feb-2016 10:57:05] NOTICE: fpm is running, pid 16137 [05-Feb-2016 10:57:05] NOTICE: ready to handle connections [05-Feb-2016 10:57:05] NOTICE: systemd monitor interval set to 10000ms When viewing the audit log, I noticed that PHP was trying to load the library (that the extension needed), from /root/: type=AVC msg=audit(1454666387.325:13883): avc: denied { read } for pid=16285 comm="php-fpm" name="libxl.so" dev="dm-0" ino=17751008 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file Note the "admin_home_t" security context of the target. I recompiled the extension, but this time I provided the absolute path to the library as /usr/lib64/libxl.so Not a bug per sè, but it seems that php-fpm doesn't handles denial of access that SELinux causes. The log output doesn't tell anything about SELinux, only that the child terminated. Expected result: ---------------- Library should be loaded from /usr/lib64/ in the first place. Log should be more clear. Actual result: -------------- Library tried loaded from /root/. Log not clear about this. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=71532&edit=1