Bug 466940
Summary: | fglrx to start because of an AVC denial (libGL text relocations) | ||
---|---|---|---|
Product: | [Fedora] Fedora | Reporter: | Viktor Erdelyi <verdelyi> |
Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> |
Status: | CLOSED RAWHIDE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
Severity: | high | Docs Contact: | |
Priority: | medium | ||
Version: | rawhide | CC: | dwalsh, jkubin, mgrepl |
Target Milestone: | --- | ||
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2008-10-15 13:01:48 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Viktor Erdelyi
2008-10-14 16:49:08 UTC
Where is /usr/lib/xorg/libGL.so.1.2 coming from? (I suspect some non-fedora binary driver is at play here) Maybe it's the fglrx driver, BUT: I now use radeonhd because fglrx doesn't work with xserver 1.4. I mean fglrx is installed but I changed the driver in xorg.conf to radeonhd. Anyway, I think fglrx will need that relocation even when it will actually work. adjusting summary to closer match reality. In the meantime, I'd suggest you also report this to the distributor of said fglrx driver. Well, that's the official binary, there's no distributor (afaik). For now, I used the given two commands to allow that operation. Then tell ATI/AMD. Ok, but I think I'll wait until FC10 is released, because I see no point in writing them a mail and complaining that fglrx doesn't work on my beta version of Fedora (which is far from a "clean install") with an unsupported version of X server and conflicts with an under-development selinux policy. Well the point is that most likely /usr/lib/xorg/libGL.so.1.2 is built incorrectly. We can fix SELinux to allow it this access, but unless they hear about the bug, they will never fix the problem. Seems this library not only gets built incorrectly, it moves around a lot. current selinux policy has it labeled. /usr/lib(64)?/(nvidia/)?libGL(core)?\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib(64)?/fglrx/libGL\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib(64)?/libGLU\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) Now it seems the library is in /usr/lib/xorg/libGL.so.1.2 This is why my life sucks... :^( Fixed in selinux-policy-3.5.12-2.fc10 Thanks. I posted the link to ATI at the "Linux Crew Feedback" page. |