Attachment 160463 Details for Bug 250487 – selinux_alert.txt

selinux_alert.txt

selinux_alert.txt (text/plain), 2.29 KB, created by Martin Jürgens on 2007-08-01 20:54:34 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Jürgens

Created: 2007-08-01 20:54:34 UTC

Size: 2.29 KB

patch

obsolete

>Summary
>    SELinux is preventing /usr/bin/totem from changing the access protection of
>    memory on the heap.
>
>Detailed Description
>    The /usr/bin/totem application attempted to change the access protection of
>    memory on the heap (e,g., allocated using malloc).  This is a potential
>    security problem.  Applications should not be doing this. Applications are
>    sometimes coded incorrectly and request this permission.  The
>    http://people.redhat.com/drepper/selinux-mem.html web page explains how to
>    remove this requirement.  If /usr/bin/totem does not work and you need it to
>    work, you can configure SELinux temporarily to allow this access until the
>    application is fixed. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
>
>Allowing Access
>    If you want /usr/bin/totem to continue, you must turn on the allow_execheap
>    boolean.  Note: This boolean will affect all applications on the system.
>
>    The following command will allow this access:
>    setsebool -P allow_execheap=1
>
>Additional Information        
>
>Source Context                user_u:system_r:unconfined_t
>Target Context                user_u:system_r:unconfined_t
>Target Objects                None [ process ]
>Affected RPM Packages         totem-2.18.1-3.fc7 [application]
>Policy RPM                    selinux-policy-2.6.4-29.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.allow_execheap
>Host Name                     medora-desktop
>Platform                      Linux medora-desktop 2.6.22.1-41.fc7 #1 SMP Fri
>                              Jul 27 18:10:34 EDT 2007 i686 athlon
>Alert Count                   4
>First Seen                    Mi 01 Aug 2007 22:48:49 CEST
>Last Seen                     Mi 01 Aug 2007 22:48:49 CEST
>Local ID                      5a44a0ba-5d58-405c-9020-8b9f307fdbce
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { execheap } for comm="totem" egid=502 euid=502 exe="/usr/bin/totem"
>exit=-13 fsgid=502 fsuid=502 gid=502 items=0 pid=6273
>scontext=user_u:system_r:unconfined_t:s0 sgid=502
>subj=user_u:system_r:unconfined_t:s0 suid=502 tclass=process
>tcontext=user_u:system_r:unconfined_t:s0 tty=(none) uid=502
>

Actions: View

Attachments on bug 250487: 160463