Show a SELinux hint when Java execution is blocked #3227

Problem

LibreSign detects when Java exists but cannot be executed from the web-server/PHP process.

Currently, JavaSetupCheck returns a generic error when java -version produces no output.

This problem was originally investigated in #2327 on AlmaLinux, where Java worked from the CLI but failed in the Apache/PHP-FPM context due to SELinux restrictions.

Upstream status

SELinux detection is already implemented in LibreSign/whatosami.

• LibreSign/whatosami#2 — completed.
• LibreSign/whatosami#3 — merged.
• WhatOSAmI v0.1.0 — GitHub release published.

The library provides OperatingSystem::getSELinuxStatus() with four possible states:

• SELINUX_ENFORCING
• SELINUX_PERMISSIVE
• SELINUX_UNAVAILABLE
• SELINUX_UNKNOWN

Remaining integration prerequisite: LibreSign still bundles an older WhatOSAmI version through LibreSign/3rdparty.

Maintainers will handle making the updated dependency available in LibreSign. This packaging work is not part of the contributor's implementation scope.

Goal

Provide a helpful SELinux-specific diagnostic when Java cannot execute in the web-server context and SELinux is enforcing.

SELinux should be presented as a possible cause, not a confirmed diagnosis.

What to change

Update lib/SetupCheck/JavaSetupCheck.php to:

1. Detect Java execution failures using the existing execution check.
2. Query SELinux status through the WhatOSAmI API.
3. When SELinux is enforcing, display a troubleshooting tip about checking SELinux audit logs.
4. For other SELinux states, preserve generic Java execution diagnostics.
5. Preserve existing behavior for successful execution, missing binaries, incompatible versions, and integrity validation failures.

Consider both empty execution output and non-zero exit codes while keeping the existing error handling consistent.

Suggested message

Error:

Failed to execute Java.

Tip when SELinux is enforcing:

SELinux is enforcing and may be blocking Java execution by the web server. Check the SELinux audit logs for relevant denied operations.

Do not recommend disabling SELinux or automatically changing security policies.

Acceptance criteria

• The upstream SELinux status API is implemented in WhatOSAmI.
• The upstream GitHub release containing the API has been published.
• The updated WhatOSAmI dependency is available in LibreSign's bundled dependencies.
• JavaSetupCheck consumes the SELinux status API.
• Java execution failures produce a SELinux-specific troubleshooting tip when SELinux is enforcing.
• Permissive, unavailable, and unknown SELinux states preserve generic diagnostics.
• Unrelated Java setup checks retain their existing behavior.
• LibreSign does not read SELinux system files directly.
• LibreSign does not execute SELinux detection commands or modify SELinux policies.
• Unit tests cover enforcing and non-enforcing cases, including relevant Java execution failure paths.
• New translatable messages use IL10N::t() with appropriate TRANSLATORS comments.
• Focused unit tests pass.

The upstream release and dependency packaging criteria are maintained separately from the contributor's implementation work.

Good first issue

This is a focused PHP backend contribution.

Starting points:

• lib/SetupCheck/JavaSetupCheck.php
• tests/php/Unit/SetupCheck/JavaSetupCheckTest.php

The existing tests already provide mocks for Java execution and filesystem behavior.

Add focused tests using controlled SELinux states. Tests should not depend on the host operating system or require an SELinux-enabled environment.

Suggested validation:

composer test:unit -- --filter JavaSetupCheckTest

Out of scope:

• Updating or repackaging third-party dependencies.
• Changing installers or dependency providers.
• Modifying SELinux configuration or policies.
• Modifying the PHP Native or JSignPdf signing engines.
• Refactoring unrelated setup checks.

Target branch: main.

Related issues

• [fixed] LibreSign v8.0.0-rc5 fails configuration check on settings page #2327 — Original Java execution investigation on AlmaLinux.
• Support managed and system-provided dependencies #8493 — Broader support for managed and system-provided dependencies.

Additional context

• If you have questions, feel free to ask in this issue.
• See our development workflow.
• Give a ⭐️ star to this repository if you find LibreSign useful and would like to support the project.
• You can also join our community: https://t.me/LibreSign