CAS-001 · Question #59
An administrator implements a new PHP application into an existing website and discovers the newly added PHP pages do not work. The rest of the site also uses PHP and is functioning correctly. The…
The correct answer is B. SELinux is preventing HTTP access to home directories. SELinux (Security-Enhanced Linux) enforces mandatory access control policies on RHEL/CentOS/Fedora systems. By default, SELinux restricts the Apache httpd process from accessing files in user home directories (/home/*) even when standard Linux file permissions would allow it…
Question
An administrator implements a new PHP application into an existing website and discovers the newly added PHP pages do not work. The rest of the site also uses PHP and is functioning correctly. The administrator tested the new application on their personal workstation thoroughly before uploading to the server and did not run into any errors. Checking the Apache configuration file, the administrator verifies that the new virtual directory is added as listed:
<VirtualHost *:80> DocumentRoot "/var/www" <Directory "/home/administrator/app"> AllowOveride none Order allow, deny Allow from all </Directory> </VirtualHost> Which of the following is MOST likely occurring so that this application does not run properly?
Options
- APHP is overriding the Apache security settings.
- BSELinux is preventing HTTP access to home directories.
- CPHP has not been restarted since the additions were added.
- DThe directory had an explicit allow statement rather than the implicit deny.
How the community answered
(46 responses)- A4% (2)
- B74% (34)
- C7% (3)
- D15% (7)
Explanation
SELinux (Security-Enhanced Linux) enforces mandatory access control policies on RHEL/CentOS/Fedora systems. By default, SELinux restricts the Apache httpd process from accessing files in user home directories (/home/*) even when standard Linux file permissions would allow it. The Apache configuration may be syntactically correct, but SELinux's httpd_enable_homedirs boolean is off by default, causing a permission denial at the kernel level that appears as an application error rather than an obvious permission error. The developer's local workstation likely does not have SELinux enforcing (or has it disabled), which is why the application worked there. The fix is to enable the SELinux boolean: setsebool -P httpd_enable_homedirs 1 and apply the correct file context. The other options (PHP overriding Apache settings, PHP restart, allow/deny order) do not explain why only the home-directory-hosted pages fail.
Topics
Community Discussion
No community discussion yet for this question.