0

Premise: I have sufficient knowledge on how to install and deploy web application on Ubuntu based on LAMP stack and tomcat. Now I'm trying to use RedHat7 and I have some issue.

I have a web application under /var/www/html/ directory on RHEL7 server. I'm able to reach index page in which there is a login form. This login calls a php page that performs a db call. In this case I have an error in my /var/log/httpd/app1_error.log file:

PHP Fatal error: Uncaught PDOException: SQLSTATE[HY000]: General error: 8 attempt to write a readonly database in /var/www/html/[omiss]loginPortal.php:82\nStack trace:\n#0 /var/www/html/[omiss]/loginPortal.php(82): PDO->exec('DELETE FROM use...')\n#1 {main}\n thrown in /var/www/html/[omiss]/loginPortal.php on line 82, referer:

seems that php page doesn't have sufficient permission on database. Database is a sqllite3 db. I Know that in REHL7 i don't have www-data user an group but instead I use apache user and group, so my web directory has apache group and I give 777 permission (I know it is not secure, I'm just tryng to figure out the problem). Despite 777 permission I still have the same problem. Anyone has hints?

If it helps this is my output for ls -lZ command

drwxrwxrwx. apache apache unconfined_u:object_r:httpd_sys_content_t:s0 myApp

so I think httpd_sys_content_t is the correct SELinux context

Quentin
  • 914,110
  • 126
  • 1,211
  • 1,335
pikimota
  • 241
  • 1
  • 4
  • 15
  • Have you tried setting context to "public_content_rw_t" using semanage? [CentOS wiki](https://wiki.centos.org/HowTos/SELinux#head-bf0af694056e0c6bbe299e80817630346d5401f6) applicable to RHEL. – DannyNiu Aug 28 '19 at 11:03
  • i quote: " public_content_rw_t context i has directories that need to be shared by NFS, Samba and Apache. This context seems to allow this to happen. It's probably also a security hole so beware on security conscious systems" i'm not really sure, I'm trying to understand if it has no side effects – pikimota Aug 28 '19 at 13:37

1 Answers1

0

I finally got this solution that worked for me: basically

setenforce Permissive

Reference: Apache permission on stackoverflow

thanks everybody

Community
  • 1
  • 1
pikimota
  • 241
  • 1
  • 4
  • 15