Bug 514506

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.11) Gecko/2009061613 CentOS/3.0.11-2.el5.centos Firefox/3.0.11

Note: I'm trying to be helpful by reporting this as requested but frankly the system is not really usable for a newbie to enter these bugs. Might be nice for those getting the reports, but it really doesn't provide the help I need to post this back. Would be better if I could just click a button on the error message to send it to somewhere appropriate. If you don't want this, just delete it.

Summary:

SELinux is preventing httpd from loading /usr/lib64/libnnz11.so which requires
text relocation.

Detailed Description:

[SELinux is in permissive mode, the operation would have been denied but was
permitted due to permissive mode.]

The httpd application attempted to load /usr/lib64/libnnz11.so which requires
text relocation. This is a potential security problem. Most libraries do not
need this permission. Libraries are sometimes coded incorrectly and request this
permission. The SELinux Memory Protection Tests
(http://people.redhat.com/drepper/selinux-mem.html) web page explains how to
remove this requirement. You can configure SELinux temporarily to allow
/usr/lib64/libnnz11.so to use relocation as a workaround, until the library is
fixed. Please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package.

Allowing Access:

If you trust /usr/lib64/libnnz11.so to run correctly, you can change the file
context to textrel_shlib_t. "chcon -t textrel_shlib_t '/usr/lib64/libnnz11.so'"
You must also change the default file context files on the system in order to
preserve them even on a full relabel. "semanage fcontext -a -t textrel_shlib_t
'/usr/lib64/libnnz11.so'"

The following command will allow this access:

chcon -t textrel_shlib_t '/usr/lib64/libnnz11.so'

Additional Information:

Source Context                system_u:system_r:httpd_t
Target Context                system_u:object_r:lib_t
Target Objects                /usr/lib64/libnnz11.so [ file ]
Source                        httpd
Source Path                   /usr/sbin/httpd
Port                          <Unknown>
Host                          localhost
Source RPM Packages           httpd-2.2.3-22.el5.centos.2
Target RPM Packages           liboci8-zend-11-1
Policy RPM                    selinux-policy-2.4.6-203.el5
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Permissive
Plugin Name                   allow_execmod
Host Name                     localhost
Platform                      Linux localhost 2.6.18-128.2.1.el5xen #1 SMP Tue
                              Jul 14 07:07:49 EDT 2009 x86_64 x86_64
Alert Count                   1
First Seen                    Wed 29 Jul 2009 08:10:10 AM EDT
Last Seen                     Wed 29 Jul 2009 08:10:10 AM EDT
Local ID                      396d924a-879a-4d86-9882-b7934d68b090
Line Numbers                  

Raw Audit Messages            

host=localhost type=AVC msg=audit(1248869410.482:13): avc:  denied  { execmod } for  pid=3826 comm="httpd" path="/usr/lib64/libnnz11.so" dev=dm-0 ino=3506290 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file

host=localhost type=SYSCALL msg=audit(1248869410.482:13): arch=c000003e syscall=10 success=yes exit=0 a0=2b2686a8c000 a1=2a0000 a2=5 a3=2b2686a8f110 items=0 ppid=1 pid=3826 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)




Reproducible: Always

Steps to Reproduce:
Looks like the library needs to be recompiled/rewritten, or some user documentation provided to noobs like me to help me.