Attachment 224211 Details for Bug 327511 – Execstack selinux alert about geomview.

Execstack selinux alert about geomview.

selinux_alert_geomview_execstack.txt (text/plain), 3.09 KB, created by Laurent Rineau on 2007-10-11 11:41:03 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Laurent Rineau

Created: 2007-10-11 11:41:03 UTC

Size: 3.09 KB

patch

obsolete

>Summary
>    SELinux is preventing /usr/libexec/geomview/gvx from making the program
>    stack executable.
>
>Detailed Description
>    The /usr/libexec/geomview/gvx application attempted to make its stack
>    executable.  This is a potential security problem.  This should never ever
>    be necessary. Stack memory is not executable on most OSes these days and
>    this will not change. Executable stack memory is one of the biggest security
>    problems. An execstack error might in fact be most likely raised by
>    malicious code. Applications are sometimes coded incorrectly and request
>    this permission.  The http://people.redhat.com/drepper/selinux-mem.html web
>    page explains how to remove this requirement.  If /usr/libexec/geomview/gvx
>    does not work and you need it to work, you can configure SELinux temporarily
>    to allow this access until the application is fixed. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
>
>Allowing Access
>    Sometimes a library is accidentally marked with the execstack flag, if you
>    find a library with this flag you can clear it with the execstack -c
>    LIBRARY_PATH.  Then retry your application.  If the app continues to not
>    work, you can turn the flag back on with execstack -s LIBRARY_PATH.
>    Otherwise, if you trust /usr/libexec/geomview/gvx to run correctly, you can
>    change the context of the executable to unconfined_execmem_exec_t. "chcon -t
>    unconfined_execmem_exec_t /usr/libexec/geomview/gvx" You must also change
>    the default file context files on the system in order to preserve them even
>    on a full relabel.  "semanage fcontext -a -t unconfined_execmem_exec_t
>    /usr/libexec/geomview/gvx"
>
>    The following command will allow this access:
>    chcon -t unconfined_execmem_exec_t /usr/libexec/geomview/gvx
>
>Additional Information        
>
>Source Context                system_u:system_r:unconfined_t:s0
>Target Context                system_u:system_r:unconfined_t:s0
>Target Objects                None [ process ]
>Affected RPM Packages         geomview-1.9.4-4.fc8 [application]
>Policy RPM                    selinux-policy-3.0.8-18.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   plugins.allow_execstack
>Host Name                     schtroumpf
>Platform                      Linux schtroumpf 2.6.23-0.214.rc8.git2.fc8 #1 SMP
>                              Fri Sep 28 17:38:00 EDT 2007 i686 i686
>Alert Count                   59
>First Seen                    Sun 30 Sep 2007 10:33:32 PM CEST
>Last Seen                     Thu 11 Oct 2007 01:27:56 PM CEST
>Local ID                      c1732fbe-66e9-4006-9ead-443e3c9197be
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { execstack } for comm=gvx egid=500 euid=500
>exe=/usr/libexec/geomview/gvx exit=0 fsgid=500 fsuid=500 gid=500 items=0
>pid=3660 scontext=system_u:system_r:unconfined_t:s0 sgid=500
>subj=system_u:system_r:unconfined_t:s0 suid=500 tclass=process
>tcontext=system_u:system_r:unconfined_t:s0 tty=pts5 uid=500
>

Actions: View

Attachments on bug 327511: 224211 | 224221