| 00:03.48 | *** part/#uphpu swb (n=designsi@box324.bluehost.com) |
| 00:19.25 | mgeary | dangitall |
| 00:19.28 | mgeary | who's still around? |
| 00:27.18 | mgeary | so, check this out:: |
| 00:27.19 | mgeary | http://new.weblessons.com/in.php |
| 00:27.42 | mgeary | those test1..3 files were done on the CLI using "sudo -u apache touch test1" |
| 00:27.53 | mgeary | but php just won't write to that dir |
| 00:27.54 | mgeary | grrrrr |
| 00:31.08 | mindjuju | could it be rights that you have invoked through the cli that php doesn't have? |
| 00:31.24 | mindjuju | i know on a winders box, you have to giet it rights and permissions on directories |
| 00:31.49 | mindjuju | oh wait, you mention rights above, my bad |
| 00:37.19 | *** join/#uphpu nvrpunk (n=root@81.90.21.227) |
| 00:39.29 | PoeticIntensity | that's funky, mgeary |
| 00:40.46 | mgeary | driving me crazy |
| 00:43.47 | mgeary | aahhhhh |
| 00:43.57 | mgeary | http://bugs.php.net/bug.php?id=30931:: |
| 00:44.02 | mgeary | Symptom: modphp cannot write to files even if they are `chmod 777`, if |
| 00:44.03 | mgeary | there is an acl for apache on the file. |
| 00:44.10 | mgeary | anyone know anything about acls? |
| 00:47.18 | mindjuju | fungus might |
| 00:48.24 | fungus | What OS? |
| 00:48.40 | mgeary | looks like the cause might be selinux |
| 00:48.43 | mgeary | Fedora |
| 00:49.59 | fungus | use getfacl to display ACLs |
| 00:50.32 | mgeary | http://www.pastebin.ca/932938 |
| 00:50.33 | *** join/#uphpu burnin (n=burnin@204-228-142-194.ip.xmission.com) |
| 00:50.33 | *** mode/#UPHPU [+v burnin] by ChanServ |
| 00:51.08 | mgeary | does this help: http://www.pastebin.ca/932940 |
| 00:52.52 | fungus | I don't know selinux that well at all. |
| 00:53.14 | mgeary | from my experience selinux == Beelzebub |
| 00:54.20 | PoeticIntensity | heh.... |
| 00:54.23 | PoeticIntensity | it's supposed to lock stuff down... |
| 00:54.25 | PoeticIntensity | apparently it does. :) |
| 00:54.42 | fungus | That's usually the problem. it locks stuff down too much. |
| 00:54.47 | fungus | Is this your server? |
| 00:55.22 | *** part/#uphpu mrkrow (n=Chad@166.70.178.114) |
| 00:55.29 | mgeary | essentially |
| 00:56.28 | mgeary | bingo |
| 00:56.36 | fungus | bingo? |
| 00:56.41 | fungus | disabled selinux? :) |
| 00:56.53 | mgeary | heheheh. well, set it to permissive :D |
| 00:57.02 | mgeary | and poof, my problems are gone |
| 00:57.03 | fungus | lol |
| 00:57.12 | burnin | hmm |
| 00:57.25 | burnin | what were you trying to do that selinux was stopping you? |
| 00:57.27 | fungus | At least you now know the exact cause, and can do the research to tweak the selinux rules to allow that. |
| 00:57.28 | burnin | selinux is a good thing. |
| 00:57.32 | mgeary | right |
| 00:57.39 | mgeary | burnin: write to a directory |
| 00:57.45 | mgeary | from mod_php |
| 00:58.16 | burnin | if there is an selinux boolean for that it will be an easy fix. |
| 00:58.32 | SunSparc | Night guys. |
| 00:58.36 | burnin | other wise it will require creating a module, but even that isn't too hard, just requires some additional work. |
| 00:59.21 | burnin | mgeary, fedoar/centos/redhat box? |
| 00:59.26 | mgeary | yup |
| 00:59.43 | mgeary | here's what now gets logged (in permissive mode): |
| 00:59.48 | mgeary | Mar 7 08:51:24 216-55-154-167 kernel: audit(1204908684.968:92): avc: denied { setattr } for pid=8167 comm="httpd" name="%%15^157^15767158%%master.tpl.php" dev=sda3 ino=15664203 scontext=root:system_r:httpd_t:s0 tcontext=root:object_r:root_t:s0 tclass=file |
| 00:59.49 | burnin | not sure if its the one, but there is an allow_httpd_anon_write boolean |
| 01:00.20 | burnin | there is also a allow_httpd_sys_script_anon_write |
| 01:01.03 | burnin | setsebool -P allow_httpd_anon_write on |
| 01:01.13 | burnin | then rerun the script |
| 01:01.30 | burnin | well, guess should check the state of the bool first :) |
| 01:01.35 | burnin | getsebool -a | grep http |
| 01:01.57 | mgeary | allow_httpd_anon_write --> off |
| 01:02.17 | mgeary | allow_httpd_sys_script_anon_write --> off |
| 01:02.28 | burnin | k, that's normal |
| 01:02.32 | mgeary | what's the diff there? apache alone versus mod_php? |
| 01:04.10 | burnin | http://fedoraproject.org/wiki/SELinux/apache |
| 01:04.40 | mgeary | cool |
| 01:04.48 | mgeary | i'll leave that up for reading on Mon |
| 01:04.49 | mgeary | later all |
| 01:04.49 | burnin | depends on where its writing, how the policy is setup, and what the context is set to on the directory. |
| 01:04.55 | burnin | cya |
| 01:04.57 | *** part/#uphpu mgeary (n=mgeary@166.70.44.49) |
| 01:07.41 | RedHeron | synic: ping |
| 01:12.01 | synic | RedHeron: yo |
| 01:12.09 | RedHeron | May I PM? |
| 01:12.15 | synic | yeah |
| 01:12.27 | synic | crap, brb |
| 01:13.08 | RedHeron | ok |
| 01:21.32 | RedHeron | And... no wps. |
| 03:50.57 | nvrpunk | hey synic |
| 03:51.00 | nvrpunk | and RedHeron ! |