Home / server / Questions / 314336
Accepted
Alexander Farber
Asked: 2011-09-23 04:24:21 +0800 CST

CentOS 6: PHP can not load gdchart.so and oci8.so compiled by me

  • 772

I have been trying to add 2 PHP extensions to a freshly installed CentOS 6.0 Linux server, but get the error messages in /var/log/httpd/error_log:

[notice] SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0
PHP Warning:  PHP Startup: Unable to load dynamic library '/usr/lib64/php/modules/gdchart.so' - /usr/lib64/php/modules/gdchart.so: undefined symbol: php_gd_gdFontMediumBold in Unknown on line 0
PHP Warning:  PHP Startup: Unable to load dynamic library '/usr/lib64/php/modules/oci8.so' - libnnz11.so: cannot enable executable stack as shared object requires: Permission denied in Unknown on line 0
[notice] Apache/2.2.15 (Unix) DAV/2 PHP/5.3.2 mod_ssl/2.2.15 OpenSSL/1.0.0-fips mod_wsgi/3.2 Python/2.6.5 mod_perl/2.0.4 Perl/v5.10.1 configured -- resuming normal operations

I did run

# chcon system_u:object_r:lib_t:s0 /usr/lib64/php/modules/oci8.so
# chcon system_u:object_r:lib_t:s0 /usr/lib64/php/modules/gdchart.so
# ls -alZ /usr/lib64/php/modules/

-rwxr-xr-x. root root system_u:object_r:lib_t:s0       curl.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       dom.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       fileinfo.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       gdchart.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       gd.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       json.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       oci8.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       pdo_pgsql.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       pdo.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       pdo_sqlite.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       pgsql.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       phar.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       sqlite3.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       wddx.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       xmlreader.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       xmlwriter.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       xsl.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       zip.so

Here is how I compiled both modules:

1) For oci8.so - setup /etc/tnsnames.ora and then:

# rpm -Uvh oracle-instantclient11.2-basic-11.2.0.2.0.x86_64.rpm
# rpm -Uvh oracle-instantclient11.2-devel-11.2.0.2.0.x86_64.rpm
# pecl install oci8 (entered: instantclient,/usr/lib/oracle/11.2/client64/lib there)

2) For gdchart.so:

# yum install gd-devel php-devel gcc
# wget http://pecl.php.net/get/gdchart-0.2.0.tgz
# tar xvfz $!
# cd $!
# ./phpize
# ./configure
# make && make install

Does anybody please have an idea, what am I missing?

Using both libs (Oracle instant clicent and GDChart) from commandline works ok.

UPDATE:

When I switch SELinux off by putting SELINUX=permissive into /etc/selinux/config and reboot, the oci8.so loads, but gdchart.so still has a bug.

So I guess my question is: how to enable SELinux back and still being able to use oci8.so? Please share your experience here - if you already struggle with Oracle + PHP + CentOS/RHEL 6.

UPDATE 2:

When starting Apache, I see in /var/log/audit/audit.log:

type=AVC msg=audit(1316698464.300:51213): avc:  denied  { execstack } for  pid=2833 comm="httpd" scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:system_r:httpd_t:s0 tclass=process
type=SYSCALL msg=audit(1316698464.300:51213): arch=c000003e syscall=10 success=yes exit=0 a0=7fff95f4b000 a1=1000 a2=1000007 a3=7f5e22611000 items=0 ppid=1 pid=2833 auid=10116 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=34 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
centos php selinux centos6

3 Answers

  1. Best Answer

    Run the following command as root and try again:

    # setsebool -P allow_execstack 1

    You also can enable executable stack for only oci8.so with:

    # execstack -c /usr/lib64/php/modules/oci8.so
    • 4

  2. Perhaps this is old news, but I got PHP/5.3.3 with OCI8 (Oracle instant client 10.2.0.5) working on RHEL6.3 with SELinux enabled by doing this:

    chcon system_u:object_r:lib_t:s0 /usr/lib64/php/modules/oci8.so
execstack -c /usr/lib/oracle/<VERSION>/client64/lib/*.so
chcon -t texrel_shlib_t /usr/lib/oracle/<VERSION>/client64/lib/*.so
setsebool -P httpd_can_network_connect_db 1

    I used a combination of audit2allow -w -a and hints from this article to get to this successful conclusion.

    • 3

  3. On CentosOS release 6.4 (Final), similar problems. Our solution seemed to be boolean 'httpd_execmem'

    After applying without any success all your useful recommendations, keep failing the oci8 load on Apache. So, we got to "audit2allow" to the rescue!

    $> echo "type=AVC msg=audit(1384944299.002:75458): avc: denied { execstack } for pid=6356 comm="httpd" scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:system_r:httpd_t:s0 tclass=process" | audit2allow

    Obtaining the output: "This avc can be allowed using the boolean 'httpd_execmem'"

    Finally the solution so far: $> setsebool httpd_execmem 1

    • 1