PHP cannot exec ping

By | 2012-11-07

In httpd error_log, it got
icmp open socket: Permission denied

It is because the seLinux blocking the httpd for security reason.
Two solutions:
1. Disable seLinux (high risk)
2. Build a custom policy to unblock partial permission for httpd

To build custom policy, use audit2allow command (may require install)
Ref.: http://wiki.centos.org/HowTos/SELinux

1. install audit2allow module
yum install policycoreutils-python

2. generate preview policy
grep httpd /var/log/audit/audit.log | audit2allow -m httpdcommandlocal > ~/httpdcommandlocal.te
cat ~/httpdcommandlocal.te

3. generate real policy
grep httpd /var/log/audit/audit.log | audit2allow -M httpdcommandlocal

4. apply real policy
semodule -i httpdcommandlocal.pp

Leave a Reply

Your email address will not be published. Required fields are marked *