Bug 191054

Fixed in selinux-policy-targeted-2.2.38-1.fc5

Although it would be good to point this bug out to ati, along with this link
to explain the problem.

http://people.redhat.com/~drepper/selinux-mem.html

Thanks for the fix.

By the way, the original coding problem seems to be present in mesa also, and is
reported as https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=191191

In an ideal world the magicians of selinux and mprotect() over at redhat will
provide a patch for the mesa library that is transferred to the ati team in
about ten minutes. Then we can remove this privilege :)

(In reply to comment #2)
> Thanks for the fix.

Dito. But it is not yet fully complete -- the file
/usr/lib(64)?/xorg/modules/dri/fglrx_dri\.so
also needs the context 
system_u:object_r:textrel_shlib_t:s0
to make DRI work properly with the fglrx drivers; otherwise this will show up:

type=AVC msg=audit(1147239914.540:34): avc:  denied  { execmod } for  pid=3103
comm="fgl_glxgears" name="fglrx_dri.so" dev=hda5 ino=262940
scontext=user_u:system_r:unconfined_t:s0 tcontext=system_u:object_r:lib_t:s0
tclass=file

Ohh, just tested on a diffenrent machine with a fresh install with updated
selinux policy -- the driver itself

/usr/lib(64)?/xorg/modules/drivers/fglrx_drv\.so

also needs the context 

system_u:object_r:textrel_shlib_t:s0

to let X start on that machine -- that was not neccessary on the other machine I
tested. Otherwise this will show up

audit(1147242608.396:6): avc:  denied  { execmod } for  pid=2519 comm="Xorg"
name="fglrx_drv.so" dev=sda6 ino=1047789
scontext=system_u:system_r:xdm_t:s0-s0:c0.c255
tcontext=system_u:object_r:lib_t:s0 tclass=file

and X will complain with

(II) Loading /usr/lib/xorg/modules/drivers/fglrx_drv.so
dlopen: /usr/lib/xorg/modules/drivers/fglrx_drv.so: cannot restore segment prot
after reloc: Permission denied
(EE) Failed to load /usr/lib/xorg/modules/drivers/fglrx_drv.so
(EE) No drivers available.

Fixed in selinux-policy-2.2.47-3

I'm using selinx-policy-2.2.47-3, and I'm still having this problem.  Moreover,
I do not have the livna kmod-fglrx package installed.  Basically, when I try to
log into gnome, the system hangs on the splash screen, and I have to hit
ctl-atl-backspace to return to the login screen.  I can log into KDE normally,
and when I try to run metacity from the command line, I get the following message:

$ metacity
metacity: error while loading shared libraries: /usr/lib/libGL.so.1: cannot
restore segment prot after reloc: Permission denied

The only way I can log into gnome is to do a setenforce 0.

Thus, I'm almost certain that I'm experiencing the same bug, and it does not
seem to be fixed in selinux-policy-2.2.47-3 on my system.

Check the file context

ls -lZ /usr/lib/libGL.so.1*
lrwxrwxrwx  root root system_u:object_r:lib_t          /usr/lib/libGL.so.1 ->
libGL.so.1.2
-rwxr-xr-x  root root system_u:object_r:textrel_shlib_t /usr/lib/libGL.so.1.2

To fix 
restorecon -R -v /usr/lib

That fixed the problem.  Thanks.