Attachment 260251 Details for Bug 385291 – SE linux alert

SE linux alert

selinux_alert_java_text_relocate.txt (text/plain), 2.34 KB, created by Will Shackleford on 2007-11-15 19:13:00 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Will Shackleford

Created: 2007-11-15 19:13:00 UTC

Size: 2.34 KB

patch

obsolete

>Summary
>    SELinux is preventing java from loading /tmp/nbi-20168.tmp which requires
>    text relocation.
>
>Detailed Description
>    The java application attempted to load /tmp/nbi-20168.tmp which requires
>    text relocation.  This is a potential security problem. Most libraries do
>    not need this permission. Libraries are sometimes coded incorrectly and
>    request this permission.  The http://people.redhat.com/drepper/selinux-
>    mem.html web page explains how to remove this requirement.  You can
>    configure SELinux temporarily to allow /tmp/nbi-20168.tmp to use relocation
>    as a workaround, until the library is fixed. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
>
>Allowing Access
>    If you trust /tmp/nbi-20168.tmp to run correctly, you can change the file
>    context to textrel_shlib_t. "chcon -t textrel_shlib_t /tmp/nbi-20168.tmp"
>    You must also change the default file context files on the system in order
>    to preserve them even on a full relabel.  "semanage fcontext -a -t
>    textrel_shlib_t /tmp/nbi-20168.tmp"
>
>    The following command will allow this access:
>    chcon -t textrel_shlib_t /tmp/nbi-20168.tmp
>
>Additional Information        
>
>Source Context                system_u:system_r:java_t:s0
>Target Context                system_u:object_r:tmp_t:s0
>Target Objects                /tmp/nbi-20168.tmp [ file ]
>Affected RPM Packages         
>Policy RPM                    selinux-policy-3.0.8-47.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.allow_execmod
>Host Name                     galactica-220.mxnet.mel.nist.gov
>Platform                      Linux galactica-220.mxnet.mel.nist.gov
>                              2.6.23.1-49.fc8 #1 SMP Thu Nov 8 21:41:26 EST 2007
>                              i686 i686
>Alert Count                   1
>First Seen                    Thu 15 Nov 2007 01:31:59 PM EST
>Last Seen                     Thu 15 Nov 2007 01:31:59 PM EST
>Local ID                      fedb8dda-c4dc-46d5-93c6-a177034990e3
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { execmod } for comm=java dev=dm-0 path=/tmp/nbi-20168.tmp pid=13386
>scontext=system_u:system_r:java_t:s0 tclass=file
>tcontext=system_u:object_r:tmp_t:s0
>

Actions: View

Attachments on bug 385291: 260251