Centos/SELINUX and installing/upgrading whmcs

[sactobob]

I keep running into this issue off/on and noticed there seems to be very little information on how to install/upgrade Whmcs with a server running  Selinux and permissions issues related to that.  The generic help information doesn't cover Selinux either. So hopefully, someone searching will find this thread and what I've done to solve the issue.  First, DO NOT disable Selinux. This is a sledgehammer approach and will make your installation considerably less secure!

Initial Install. Whmcs needs several files to be writable by your web server's PHP process. Installing files and giving them permissions by the  httpd/PHP owner isn't enough, you need to give them a Selinux policy as well. From the command line:

semanage fcontext -a -t httpd_sys_rw_content_t "/path_to_whmcs_install/configuration.php"
semanage fcontext -a -t httpd_sys_rw_content_t "/path_to_whmcs_install/attachments"
semanage fcontext -a -t httpd_sys_rw_content_t "/path_to_whmcs_install/downloads"
semanage fcontext -a -t httpd_sys_rw_content_t "/path_to_whmcs_install/templates_c"

You can confirm the current policy by using:

ls -Z

Example of returned info:

-r--------. whmcs whmcs unconfined_u:object_r:httpd_sys_rw_content_t:s0 configuration.php
 

This should get you past the initial install permission's requirement.

Updating/Upgrading. If you're going to use the auto-updater from the admin dashboard, you'll run into additional security issues since you're now replacing a host of files depending on the update. You'll need to temporarily change permissions on your Whmcs folder and files, run the updater, then change permissions back. Here are the commands used to do this:

chcon -R unconfined_u:object_r:httpd_sys_rw_content_t:s0 whmcs_install_directory (assign Selinux httpd policy of RW access to all folders/files)
(Now back to your dashboard and auto-updater, don't forget to reset permissions back to original settings in the next step)
restorecon -R whmcs_install_directory (revert back to original Selinux permissions)

That's it, it worked for me! 

-Bob