Bug 480189

Summary: tanukiwrapper generates execmod AVC denial
Product: [Fedora] Fedora Reporter: Jan Pazdziora (Red Hat) <jpazdziora>
Component: tanukiwrapperAssignee: Deepak Bhole <dbhole>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: 10CC: dbhole, devrim, jesusr
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: 3.2.3-2.4.fc10 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 471218 Environment:
Last Closed: 2009-08-17 21:58:20 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 514558    

Description Jan Pazdziora (Red Hat) 2009-01-15 16:57:41 UTC
+++ This bug was initially created as a clone of Bug #471218 +++

Description of problem:

When starting Spacewalk 0.3, an execmod AVC denial is logged:

type=AVC msg=audit(1226431153.819:93): avc:  denied  { execmod } for  pid=3364 comm="java" path="/usr/lib/libwrapper.so" dev=dm-0 ino=883661 scontext=root:system_r:java_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file

Version-Release number of selected component (if applicable):

Spacewalk 0.3 with tanukiwrapper-3.2.1-2jpp.ep1.1.el5.

How reproducible:

Deterministic.

Steps to Reproduce:
1. eu-findtextrel /usr/lib/libwrapper.so
  
Actual results:

the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeGetUser' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeGetInteractiveUser' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeSetConsoleTitle' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeRequestThreadDump' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeInit' is not compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeGetJavaPID' is not compiled with -fpic/-fPIC
the file containing the function 'handleInterrupt' is not compiled with -fpic/-fPIC
the file containing the function 'handleTermination' is not compiled with -fpic/-fPIC
the file containing the function 'wrapperJNIHandleSignal' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeGetControlEvent' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeGetLibraryVersion' is not compiled with -fpic/-fPIC
the file containing the function 'getLastErrorText' is not compiled with -fpic/-fPIC

Expected results:

eu-findtextrel: no text relocations reported in '/usr/lib/libwrapper.so'


[...]

--- Additional comment from jpazdziora on 2008-11-12 09:33:57 EDT ---

Jesus says:

jmrodri adelton, one thing that is different is the makefile patches for tanukiwrapper
jmrodri adelton, 3.2.1 has this for the compile
jmrodri $(COMPILE) -pthread $(wrapper_SOURCE) -o $(BIN)/wrapper -lm
jmrodri while 3.1.2 has this
jmrodri $(COMPILE) -lm $(wrapper_SOURCE) -o $(BIN)/wrapper
jmrodri diff is -pthread

--- Additional comment from jesusr on 2008-11-12 09:37:34 EDT ---

3.1.2 rpm also patch the %.o: %.c section of the Makefile.linux

3.1.2 orig
$(COMPILE) $(DEFS) -Wp,-MD,.deps/$(*F).pp -c $<

3.1.2 patch
$(COMPILE) $(DEFS) -fPIC -Wp,-MD,.deps/$(*F).pp -c $<

3.2.1 orig
$(COMPILE) $(DEFS) -Wp,-MD,.deps/$(*F).pp -c $<

I'm not sure if -fPIC makes a difference here or not.

--- Additional comment from jpazdziora on 2008-11-12 09:47:08 EDT ---

Please rebuild tanukiwrapper with -fPIC. Thank you.

Comment 1 Jan Pazdziora (Red Hat) 2009-01-15 16:59:39 UTC
For the record, it's tanukiwrapper-3.2.3-2.3.fc10.i386.rpm in Fedora 10 which has the problem:

$ eu-findtextrel ./libwrapper.so 
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeGetUser' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeGetInteractiveUser' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeSetConsoleTitle' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeRequestThreadDump' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeInit' is not compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeGetJavaPID' is not compiled with -fpic/-fPIC
the file containing the function 'handleInterrupt' is not compiled with -fpic/-fPIC
the file containing the function 'handleHangup' is not compiled with -fpic/-fPIC
the file containing the function 'handleTermination' is not compiled with -fpic/-fPIC
the file containing the function 'wrapperJNIHandleSignal' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeGetControlEvent' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeGetLibraryVersion' is not compiled with -fpic/-fPIC
the file containing the function 'getLastErrorText' is not compiled with -fpic/-fPIC

Comment 2 Jan Pazdziora (Red Hat) 2009-07-31 15:20:41 UTC
Deepak, the tanukiwrapper problem is blocking Spacewalk 0.6 with SELinux Enforcing release both for Fedora 10 and for Fedora 11. Will you be able to release newly built package with the -fpic/-fPIC fix? Thank you.

Comment 3 Fedora Update System 2009-07-31 19:17:14 UTC
tanukiwrapper-3.2.3-2.4.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/tanukiwrapper-3.2.3-2.4.fc10

Comment 4 Deepak Bhole 2009-07-31 19:19:31 UTC
Jan, please try the above build and let me know if it fixes the issue. I have patched the make files to compile with -fPIC:

# eu-findtextrel /usr/lib/libgmp.so
eu-findtextrel: no text relocations reported in '/usr/lib/libgmp.so'

Comment 5 Deepak Bhole 2009-07-31 19:46:22 UTC
Er, posted wrong example in Comment #4. Meant to display this:

# eu-findtextrel /usr/lib/libwrapper.so 
eu-findtextrel: no text relocations reported in '/usr/lib/libwrapper.so'

Comment 6 Fedora Update System 2009-08-01 23:54:51 UTC
tanukiwrapper-3.2.3-2.4.fc10 has been pushed to the Fedora 10 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update tanukiwrapper'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F10/FEDORA-2009-8193

Comment 7 Jan Pazdziora (Red Hat) 2009-08-03 08:01:29 UTC
Thank you, eu-findtextrel /usr/lib/libwrapper.so is indeed clean.

Could you do similar rebuild for Fedora 11?

Comment 8 Deepak Bhole 2009-08-03 20:03:48 UTC
Yep. I built for 10, 11 and rawhide at the same time. Just wanted to make sure it works before pushing for f11. Pushed for updates-testing on F11:

https://admin.fedoraproject.org/updates/tanukiwrapper-3.2.3-3.4.fc11

Comment 9 Jan Pazdziora (Red Hat) 2009-08-04 06:22:16 UTC
Oh, great. Tested on F11, it looks good. Marking as VERIFIED.

Thank you, Jan

Comment 10 Fedora Update System 2009-08-17 21:58:15 UTC
tanukiwrapper-3.2.3-2.4.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.