RE: [PHP] (SOLVED) /etc/php.init changes not honored



All,
The problem turned out to be selinux.

With the newest version of RH, a new security model has been
implemented. Instead of doing Discretionary Access Control (DAC,
conventional rwx permissions) RH implements selinux which uses Mandatory
Access Control (MAC, enhanced permissions using contexts).

The /etc/php.ini file on the development box didn't have correct MAC
permissions. I restored them to the correct context and apache is now
reading the /etc/php.ini file. Steps below:

#To restore the selinux configuration on a file.
1. check the permissions
[ryan@lamp etc]$ sudo getfattr -m . -d php.ini
Password:
# file: php.ini
security.selinux="user_u:object_r:etc_t:s0\000"

2. Create a file with the right permissions / context.
[ryan@lamp etc]$ cat /home/admmadis/setme
# file: php.ini
security.selinux="system_u:object_r:etc_t:s0\000"

3. Restore the context of the file.
[ryan@lamp etc]$ sudo setfattr --restore=/home/ryan/setme

4. look again to test.
[ryan@lamp etc]$ getfattr -m . -d php.ini
# file: php.ini
security.selinux="system_u:object_r:etc_t:s0\000"

5. restart apache...

-Thanks for everyone's help!!


-----Original Message-----
From: Richard Lynch [mailto:ceo@xxxxxxxxx]
Sent: Monday, January 14, 2008 10:43 AM
To: Ryan H. Madison
Cc: php-general@xxxxxxxxxxxxx
Subject: Re: [PHP] /etc/php.init changes not honored

In phpinfo() output, PHP tells you where it is looking for its php.ini
file.

If you aren't changing a php.ini file in that location, then PHP isn't
going to see it...

On Thu, January 10, 2008 4:59 pm, Ryan H. Madison wrote:
Hello,

I am trying to increase upload_max_filesize beyond the 2M
limit. I've set this in my /etc/php.ini file, but every time I look at
the output of phpinfo(); the changes I make in /etc/php.init don't
seem
to be honored. This isn't limited to upload_max_filesize, I've changed
the Engine & safe_mode values, but these don't seem to make any
difference either. I've looked in the /etc/php.d directory, and those
files only reference other libraries. I've even removed the
/etc/php.ini
file which doesn't seem to make a difference.

What am I missing?

-Thanks, RYAN



I'm running a default installation of CentOS 5.



[ryan@lamp etc]$ cat /etc/redhat-release

CentOS release 5 (Final)

[ryan@lamp etc]$ rpm -qa | grep php

php-5.1.6-5.el5

php-pdo-5.1.6-5.el5

php-pear-1.4.9-4

php-common-5.1.6-5.el5

php-cli-5.1.6-5.el5

php-mysql-5.1.6-5.el5

[ryan@lamp etc]$ rpm -qa | grep httpd

httpd-2.2.3-6.el5.centos.1

httpd-manual-2.2.3-6.el5.centos.1

[ryan@lamp etc]$



Ryan Madison

Senior Systems Administrator, UNIX Services

Internet Services and Servers

Department of Information Technology

State of Nevada

p. 775.684.4313

f. 775.684.4324

e. rmadison@xxxxxxxxxxx <mailto:rmadison@xxxxxxxxxxx>

w. http://sug.state.nv.us <http://sug.state.nv.us/>

P Please consider the environment before printing this email.

This communication, including any attachments, may contain
confidential
information and is intended only for the individual or entity to it is
addressed. Any review, dissemination or copying of this communication
by
anyone other than the intended recipient is strictly prohibited. If
you
are not the intended recipient, please contact the sender by reply
e-Mail and delete all copies of the original message.










--
Some people have a "gift" link here.
Know what I want?
I want you to buy a CD from some indie artist.
http://cdbaby.com/from/lynch
Yeah, I get a buck. So?
.



Relevant Pages

  • RE: php apache SELinux problem
    ... It'll have an entry detailing exactly what context failed to do what to ... Subject: php apache SELinux problem ... entities other than the intended recipients is prohibited by AgResearch ...
    (RedHat)
  • Re: Fw: [PATCH 2.6.16-rc1-git4] accessfs: a permission managing filesystem
    ... > Accessfs is a permission managing filesystem. ... based on file permissions. ... The kernel already a mechanism for implementing extended security ... With SELinux we see a lot of these userspace assumptions, ...
    (Linux-Kernel)
  • Re: A great article on why to use SeLinux
    ... a command line tool to do this; I am not sure about a GUI tool. ... Windows converts are complaining about "those stupid permissions thing", ... Old-school Linux people are complaining about "that stupid selinux ... need to do the same for chcon. ...
    (Fedora)
  • Re: [PHP] File Upload Security and chmod
    ... It was never a question of speed for me -- it was a question of being able to change file permissions from within a php script so that I could create and write files safely. ... I am *not* able to use chmodwithin a php script at all regardless of what permissions the file and parent folder have -- even when both are set to 0777. ... So, if you can chmodand mkdirfrom within your php script without establishing an ftp connection, then more power to you, because I can't. ...
    (php.general)
  • Re: whats next for the linux kernel?
    ... >> selinux has already provided an alternative that is similar to NW ... >> file permissions. ... server to write some selinux policy files because POSIX filepermissions ... if i was to agree with you, it would be that the linux filesystem ...
    (Linux-Kernel)