Attachment 262451 Details for Bug 388671 – selinux alert executable stack

selinux alert executable stack

selinux_alert.txt (text/plain), 3.21 KB, created by Peter Harmsen on 2007-11-17 18:56:20 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Peter Harmsen

Created: 2007-11-17 18:56:20 UTC

Size: 3.21 KB

patch

obsolete

>Summary
>    SELinux is preventing /usr/lib/firefox-2.0.0.9/firefox-bin from making the
>    program stack executable.
>
>Detailed Description
>    The /usr/lib/firefox-2.0.0.9/firefox-bin application attempted to make its
>    stack executable.  This is a potential security problem.  This should never
>    ever be necessary. Stack memory is not executable on most OSes these days
>    and this will not change. Executable stack memory is one of the biggest
>    security problems. An execstack error might in fact be most likely raised by
>    malicious code. Applications are sometimes coded incorrectly and request
>    this permission.  The http://people.redhat.com/drepper/selinux-mem.html web
>    page explains how to remove this requirement.  If /usr/lib/firefox-2.0.0.9
>    /firefox-bin does not work and you need it to work, you can configure
>    SELinux temporarily to allow this access until the application is fixed.
>    Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this
>    package.
>
>Allowing Access
>    Sometimes a library is accidentally marked with the execstack flag, if you
>    find a library with this flag you can clear it with the execstack -c
>    LIBRARY_PATH.  Then retry your application.  If the app continues to not
>    work, you can turn the flag back on with execstack -s LIBRARY_PATH.
>    Otherwise, if you trust /usr/lib/firefox-2.0.0.9/firefox-bin to run
>    correctly, you can change the context of the executable to
>    unconfined_execmem_exec_t. "chcon -t unconfined_execmem_exec_t
>    /usr/lib/firefox-2.0.0.9/firefox-bin" You must also change the default file
>    context files on the system in order to preserve them even on a full
>    relabel.  "semanage fcontext -a -t unconfined_execmem_exec_t
>    /usr/lib/firefox-2.0.0.9/firefox-bin"
>
>    The following command will allow this access:
>    chcon -t unconfined_execmem_exec_t /usr/lib/firefox-2.0.0.9/firefox-bin
>
>Additional Information        
>
>Source Context                system_u:system_r:unconfined_t:s0
>Target Context                system_u:system_r:unconfined_t:s0
>Target Objects                None [ process ]
>Affected RPM Packages         firefox-2.0.0.9-1.fc9 [application]
>Policy RPM                    selinux-policy-3.0.8-53.fc8
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.allow_execstack
>Host Name                     localhost.localdomain
>Platform                      Linux localhost.localdomain 2.6.23.1-49.fc8PAE #1
>                              SMP Thu Nov 8 21:33:13 EST 2007 i686 athlon
>Alert Count                   18
>First Seen                    Sat 17 Nov 2007 09:13:07 AM CET
>Last Seen                     Sat 17 Nov 2007 07:44:28 PM CET
>Local ID                      75ead45e-9269-4b29-a53c-95c58e5c4274
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { execstack } for comm=firefox-bin egid=500 euid=500
>exe=/usr/lib/firefox-2.0.0.9/firefox-bin exit=-13 fsgid=500 fsuid=500 gid=500
>items=0 pid=13905 scontext=system_u:system_r:unconfined_t:s0 sgid=500
>subj=system_u:system_r:unconfined_t:s0 suid=500 tclass=process
>tcontext=system_u:system_r:unconfined_t:s0 tty=(none) uid=500
>

Actions: View

Attachments on bug 388671: 262451