https://wiki.ixheim.de/index.php?action=history&feed=atom&title=Create_SELinux_Modul 2026-06-28T19:47:54Z Versionsgeschichte dieser Seite in Xinux Wiki MediaWiki 1.35.1 https://wiki.ixheim.de/index.php?title=Create_SELinux_Modul&diff=38476&oldid=prev 2022-11-22T07:27:16Z

<p>Die Seite wurde neu angelegt: „ =Create file my-httpd-php-ping.te and put this in it= *cat my-httpd-php-ping.te &lt;pre&gt; module my-httpd-php-ping 1.0; require { type httpd_t; c…“</p> <p><b>Neue Seite</b></p><div><br /> =Create file my-httpd-php-ping.te and put this in it=<br /> *cat my-httpd-php-ping.te<br /> &lt;pre&gt;<br /> module my-httpd-php-ping 1.0;<br /> <br /> require {<br /> type httpd_t;<br /> class capability { net_admin net_raw };<br /> class icmp_socket create;<br /> class rawip_socket { create getopt read setopt write };<br /> }<br /> <br /> #============= httpd_t ==============<br /> allow httpd_t self:capability { net_admin net_raw };<br /> allow httpd_t self:icmp_socket create;<br /> allow httpd_t self:rawip_socket { create getopt read setopt write };<br /> &lt;/pre&gt;<br /> =Compile it to a SELinux module like so=<br /> *checkmodule -M -m -o my-httpd-php-ping.mod my-httpd-php-ping.te<br /> *semodule_package -o my-httpd-php-ping.pp -m my-httpd-php-ping.mod<br /> =And install it:=<br /> *semodule -i my-httpd-php-ping.pp<br /> =Afterwards, enable SELinux again=<br /> *setenforce 1<br /> =Links=<br /> *https://unix.stackexchange.com/questions/675203/selinux-blocks-ping-from-php-exec<br /> *https://forums.centos.org/viewtopic.php?t=49172<br /> *https://phpipam.net/news/selinux-policy-for-icmp-checks/</div>

Thomas.will