[gentoo-hardened] problems with mod_php again

[Pedro Venda]

hi everyone,

sorry to insist on this matter but I can't find help anywhere else and people 
seem quite helpful here.

I'm having problems with apache2+mod_php in an hardened environment. I'm 
restricting mprotect() and disallowing ELF relocations. of course mysql 
didn't start and apache2 didn't load the php module.

mysql's problem was quickly fixed with a paxctl -m on 2 binaries.

mod_php's problem still lies unfixable. paxctl -m on libphp4.so doesn't fix 
the problem and none of the libraries upon which libphp4.so depends on needs 
to relocate ELF segments. (individually checked with scanelf -a).

apache2 refuses to start with the following error message:
gw root # /etc/init.d/apache2 restart
 * Apache2 has detected a syntax error in your configuration files:
Syntax error on line 6 of /usr/lib/apache2/conf/modules.d/70_mod_php.conf:
Cannot load /usr/lib/apache2/extramodules/libphp4.so into 
server: /usr/lib/apache2/extramodules/libphp4.so: cannot make segment 
writable for relocation: Permission denied
gw root #

Since I'm running gentoo linux and there's an interesting hardenedphp flag 
affecting the mod_php ebuild, I decided to try it out, but with no luck.

Where should I carry on debugging and what could be the problem here, since it 
doesn't seem to be libphp4.so?

regards,
pedro venda.
-- 

Pedro João Lopes Venda
email: pjvenda < at > arrakis.dhis.org
http://arrakis.dhis.org