Bug 468678

This bug was reported at rpmfusion.org:
https://bugzilla.rpmfusion.org/show_bug.cgi?id=90
But it possibly is a bug in the SELinux policy.

Description of problem:
With (a)kmod-nvidia.x86_64 and xorg-x11-drv-nvidia.x86_64 installed in a
current Rawhide system otherwise unsuspicious applications get in trouble with
SELinux. There are no problems when just using Rawhide's
xorg-x11-drv-nv.x86_64.

The denials are execmem and execstack related. I will attach examples with
glxinfo. But it also happens with applications like vinagre or openoffice.org
-- perhaps every application which somehow uses OpenGL.

Version-Release number of selected component (if applicable):
xorg-x11-drv-nvidia-177.80-1.fc10.x86_64
xorg-x11-drv-nvidia-libs-177.80-1.fc10.x86_64
kmod-nvidia-177.80-1.fc10.1.x86_64
kmod-nvidia-2.6.27.3-27.rc1.fc10.x86_64-177.80-1.fc10.1.x86_64
akmod-nvidia-177.80-1.fc10.x86_64
selinux-policy-3.5.13-4.fc10.noarch
selinux-policy-targeted-3.5.13-4.fc10.noarch
glx-utils-7.2-0.13.fc10.x86_64
mesa-libGL-7.2-0.13.fc10.x86_64
mesa-libGLU-7.2-0.13.fc10.x86_64

How reproducible:
In permissive mode it seems that only the first invocation of an affected
application triggers the denials. Subsequent invocations of the same
application seem to work fine. In enforcing mode you always get the denials.

Steps to Reproduce:
1. Activate SELinux
2. Install and activate the xorg-x11-drv-nvidia.x86_64 driver package
3. Run glxinfo in a shell

Actual results:
exexstack and execmem denials by SELinux

Expected results:
Working accelerated OpenGL without warnings by SELinux

Additional Information:
It seems that only applications specifically built for F10 have
problems. While glx-utils-7.2-0.13.fc10.x86_64 causes denials, the OpenGL
application celestia-1.5.0-1.fc9.x86_64 (note the fc9!) works perfectly well
for example. So this could also be related to changes in gcc or default compiler
flags. Though I could not find any notices about such changes.