doushou6480 2016-04-04 16:30
浏览 62

SELinux阻止php的exec('kill pid')在日志中没有任何错误

I'm trying to get a process PID and kill it with this code:

ini_set('display_errors', '1');

$_script_path = "/path/to/scriptname.php";

$cmd_find_process = "ps aux | grep '[p]hp -f ".$_script_path."'";

echo $cmd_find_process.PHP_EOL;
echo exec($cmd_find_process);

$cmd = "kill $(".$cmd_find_process." | awk '{print $2}')";
echo $cmd;
echo exec($cmd);

Initially I couldn't list processes, which I fixed by compiling a custom SELinux module, selinux-httpd-allow-ps-aux.te:


    type httpd_t;


I've already disabled dontaudit statements with:

semodule -DB

But I can't kill any process which I've previously started by the same user: apache. No errors logged in the /var/log/audit/audit.log file.

For a complete understanding, the PHP script which I'm trying to kill is executed with this command:

su -s /bin/sh apache -c php -f /path/to/scriptname.php

I know it's SELinux because turning off SELinux with

echo 0 > /selinux/enforce

will make it work.

  • 写回答

1条回答 默认 最新

  • dongmu5246 2016-04-04 17:38

    Apparently I had to restart auditd for the errors to show up.

    service auditd restart

    This is the error:

    type=AVC msg=audit(1459790992.546:15889813): avc:  denied  { signal } for  pid=25478 comm="sh" scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=process
        Was caused by:
            Missing type enforcement (TE) allow rule.
            You can use audit2allow to generate a loadable module to allow this access.

    I was able to solve the issue through the audit2allow tool. This is the generated custom module that fixed the issue.

    module selinux-httpd-allow-signal 1.0;
    require {
            type httpd_t;
            type initrc_t;
            class process signal;
    #============= httpd_t ==============
    allow httpd_t initrc_t:process signal;
    本回答被题主选为最佳回答 , 对您是否有帮助呢?



  • ¥50 求写,批处理调用分区助手分区脚本
  • ¥15 求购HI3519AV100开发板
  • ¥15 请问1553 RT怎么测试,没有BC有方法吗
  • ¥100 业务编程如何选择学习方向和内容?
  • ¥15 wamp3.3.5安装完成后图标正常显示绿色,鼠标左右键点击图标均无反应。求解决方法。
  • ¥15 鼠标点击的这条记录了什么?
  • ¥15 在写pid调速的程序时,电机始终维持最大速度
  • ¥15 【有偿】调用DXGI截图初始化失败,提示0xf 887a0004
  • ¥15 请问如何查看手机root记录?
  • ¥15 商城小程序订单号重复