PHP function is_executable returns false even though the file is definitely executable

Question

I'm using PHP 5.3.

Using getfacl the files permissions are:

user::rwx
group::r-x
other::r-x

I also am having problems using PHP's Program execution Functions, http://www.php.net/manual/en/ref.exec.php

The program in question is wkhtmltopdf and I have it in my /usr/bin directory.

I have the convert program in my /usr/bin directory with the exact same permissions and the is_executable function returns true.

Answer 1

For me the answer was to create a policy module to allow wkhtmltopdf to run without disabling SELinux:

1. sudo su - (run as root to make the next steps simpler)
2. tail -F /var/log/audit.log | grep wkhtml > wkhtml.audit (leave this running and continue to next step)
3. try to load your web page that attempts to create a pdf, it will fail as before but now we are logging.
4. CTRL+C to stop the process from step 2 (can skip to 7 if in a hurry, but it's strongly suggested you use these review steps before making selinux exceptions permanent!)
5. cat wkhtml.audit | audit2allow -m wkhtmltopdf > wkhtmltopdf.te
6. review the wkhtmltopdf.te file to make sure new rules will be sensible. you will probably see "allow httpd_t self:process execmem" and possibly "allow httpd_t var_t:file read" depending on your setup
7. cat wkhtml.audit | audit2allow -M wkhtmltopdf
8. semodule -i wkhtmltopdf.pp (might take a minute, be patient)

You should now be able to load the pdf-creating page without error. If not, we have likely fixed one problem and arrived at another--might need to repeat steps. Tail to wkhtml.audit2 this time and cat it with the original when making a new module (or else you'll be undoing first fix!):

tail -F ... > wkhtml.audit2

if audit2 is empty, there is a non-selinux problem. otherwise:

cat wkhtml.audit wkhtml.audit2 | audit2allow ...