How can I use SELinux to confine PHP scripts?

Solution 1:

The best way to acheive this level of seperation is to not use type transitions but category / MCS transitions. This acts a little like the svirt implementation in the libvirt KVM stuff.

OK, the first thing you're going to need to do is download a httpd module called mod_selinux. Its been floating around in the fedora repos for quite some time, but has never really made it into the EL6 systems unfortunately.

In any case, you can rebuild the package from fedora sources. I did this on a fedora machine but you can just download the same package from a mirror. I used F16 as a base as it runs httpd-2.2.

yumdownloader --source mod_selinux --releaserver=16
...
mod_selinux-2.2.2454-3.fc15.src.rpm                        |  23 kB   00:00

Then when downloaded, rebuild on your EL6 box.

rpmbuild --rebuild mod_selinux-2.2.2454-3.fc15.src.rpm
...
Wrote: /home/build/rpmbuild/RPMS/x86_64/mod_selinux-2.2.2454-3.el6.x86_64.rpm

Finally install the module.

rpm -i /home/build/rpmbuild/RPMS/x86_64/mod_selinux-2.2.2454-3.el6.x86_64.rpm

The RPM installs a module for httpd which you'll need and also a policy for httpd which is also necessary for this to run.

The file for this module is installed in /etc/httpd/conf.d/mod_selinux.conf.

The first stage in this process is to increase the number of categories that the main httpd process runs as, so that it can produce child threads that span the correct range. In the file change:

selinuxServerDomain     *:s0

To

selinuxServerDomain     *:s0-s0:c0.c1023

Now, you must assign each virtual host in apache a category. This is done by adding a line such as in the example below called selinuxDomainVal.

<VirtualHost *:80>
    DocumentRoot /var/www/vhosts/host1
    ServerName host1.virtual
    selinuxDomainVal *:s0:c0
</VirtualHost>

<VirtualHost *:80>
    DocumentRoot /var/www/vhosts/host2
    ServerName host2.virtual
    selinuxDomainVal *:s0:c1
</VirtualHost>

Next, in the document root for each host, relabel their document roots to the same category as the ones labelled in the httpd config.

chcon -R -l s0:c0 /var/www/vhosts/host1
chcon -R -l s0:c1 /var/www/vhosts/host2

If you want to make the labelling get honoured if you do a system relabel, you'd better update the local policy too!

semanage fcontext -a -t httpd_sys_content_t -r s0-s0:c0 '/var/www/vhosts/host1(/.*)?'
semanage fcontext -a -t httpd_sys_content_t -r s0-s0:c1 '/var/www/vhosts/host2(/.*)?'

And thats it! Its impossible to leave your document root and go exploring in others now.

Solution 2:

I know this question is 7yrs old, however the answer to it by @MatthewIfe above was instrumental but required a few extra steps. We're using CentOS8 which still doesn't include mod_selinux out of the box, so the answer above was perfect in getting it installed.

However post-install, and after a correct setup, apache was failing AVC tests and would not start up. The errors available in the /var/log/httpd/error.log, /var/log/messages, and /var/log/audit/audit.log were not very helpful.

In the end, I had to install two additional utilities that allowed me to troubleshoot the selinux AVC errors, which indicated I had to create a custom policy to allow the httpd service access to the setcurrent command in selinux.

You can find the solution here: Apache vhost privilege separation using SELinux contexts on CentOS8

Hope that helps anyone else stumbling across this.