Bug 1917099

Hi,

The execmem permission is required for mapping a memory region as executable which is not common and is possibly insecure so it is disabled by default. For more information about the execmem permission, refer to the following articles:

 * https://akkadia.org/drepper/selinux-mem.html
 * https://danwalsh.livejournal.com/6117.html

Changing the component for the maintainer to assess if this permission is required. Please switch it back to selinux-policy if  further action is required.

----
type=PROCTITLE msg=audit(01/18/2021 04:20:32.984:707) : proctitle=/usr/sbin/privoxy --pidfile /run/privoxy.pid --user privoxy /etc/privoxy/config 
type=SYSCALL msg=audit(01/18/2021 04:20:32.984:707) : arch=x86_64 syscall=mmap success=no exit=EACCES(Permission denied) a0=0x0 a1=0x10000 a2=PROT_READ|PROT_WRITE|PROT_EXEC a3=MAP_PRIVATE|MAP_ANONYMOUS items=0 ppid=1377 pid=1378 auid=unset uid=privoxy gid=privoxy euid=privoxy suid=privoxy fsuid=privoxy egid=privoxy sgid=privoxy fsgid=privoxy tty=(none) ses=unset comm=privoxy exe=/usr/sbin/privoxy subj=system_u:system_r:privoxy_t:s0 key=(null) 
type=AVC msg=audit(01/18/2021 04:20:32.984:707) : avc:  denied  { execmem } for  pid=1378 comm=privoxy scontext=system_u:system_r:privoxy_t:s0 tcontext=system_u:system_r:privoxy_t:s0 tclass=process permissive=0 
----

The same SELinux denial appeared in permissive mode:
----
type=PROCTITLE msg=audit(01/18/2021 04:24:57.144:716) : proctitle=/usr/sbin/privoxy --pidfile /run/privoxy.pid --user privoxy /etc/privoxy/config 
type=SYSCALL msg=audit(01/18/2021 04:24:57.144:716) : arch=x86_64 syscall=mmap success=yes exit=140399402266624 a0=0x0 a1=0x10000 a2=PROT_READ|PROT_WRITE|PROT_EXEC a3=MAP_PRIVATE|MAP_ANONYMOUS items=0 ppid=1394 pid=1395 auid=unset uid=privoxy gid=privoxy euid=privoxy suid=privoxy fsuid=privoxy egid=privoxy sgid=privoxy fsgid=privoxy tty=(none) ses=unset comm=privoxy exe=/usr/sbin/privoxy subj=system_u:system_r:privoxy_t:s0 key=(null) 
type=AVC msg=audit(01/18/2021 04:24:57.144:716) : avc:  denied  { execmem } for  pid=1395 comm=privoxy scontext=system_u:system_r:privoxy_t:s0 tcontext=system_u:system_r:privoxy_t:s0 tclass=process permissive=1 
----

Hi! 

I've used tor and privoxy with the same configuration as now for about 5 years, with several Fedora releases. 
All this time I've used SELinux running in enforcing mode and I had no issues with privoxy. 
This error started happening about 2 or 3 days ago. 

I hope this will be helpful for finding and fixing the error.

*** Bug 1917021 has been marked as a duplicate of this bug. ***

Asking upstream: https://sourceforge.net/p/ijbswa/bugs/924/

Upstream says this is likely caused by JIT pcre filter compilation. I can either rebuild with it disabled, or we can update the SELinux policy. I vote the latter.

If the feature is necessary for you project, we surely can add it to policy, but document properly - can you make sure what is the reason?

Yes, it's for a new feature, JIT filter compilation.

https://www.privoxy.org/announce.txt

*** Bug 1927329 has been marked as a duplicate of this bug. ***

*** Bug 1932676 has been marked as a duplicate of this bug. ***

I've submitted a Fedora PR to address the issue:
https://github.com/fedora-selinux/selinux-policy/pull/728

FEDORA-2021-e2de9e9e55 has been submitted as an update to Fedora 33. https://bodhi.fedoraproject.org/updates/FEDORA-2021-e2de9e9e55

FEDORA-2021-e2de9e9e55 has been pushed to the Fedora 33 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-e2de9e9e55`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-e2de9e9e55

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

FEDORA-2021-e2de9e9e55 has been pushed to the Fedora 33 stable repository.
If problem still persists, please make note of it in this bug report.