Bug 524258

The following was filed automatically by setroubleshoot:

Summary:

SELinux is preventing /usr/bin/mplayer from loading /usr/lib/libxvidcore.so.4.2
which requires text relocation.

Detailed Description:

The mplayer application attempted to load /usr/lib/libxvidcore.so.4.2 which
requires text relocation. This is a potential security problem. Most libraries
do not need this permission. Libraries are sometimes coded incorrectly and
request this permission. The SELinux Memory Protection Tests
(http://people.redhat.com/drepper/selinux-mem.html) web page explains how to
remove this requirement. You can configure SELinux temporarily to allow
/usr/lib/libxvidcore.so.4.2 to use relocation as a workaround, until the library
is fixed. Please file a bug report.

Allowing Access:

If you trust /usr/lib/libxvidcore.so.4.2 to run correctly, you can change the
file context to textrel_shlib_t. "chcon -t textrel_shlib_t
'/usr/lib/libxvidcore.so.4.2'" You must also change the default file context
files on the system in order to preserve them even on a full relabel. "semanage
fcontext -a -t textrel_shlib_t '/usr/lib/libxvidcore.so.4.2'"

Fix Command:

chcon -t textrel_shlib_t '/usr/lib/libxvidcore.so.4.2'

Additional Information:

Source Context                unconfined_u:unconfined_r:unconfined_execmem_t:s0-
                              s0:c0.c1023
Target Context                system_u:object_r:lib_t:s0
Target Objects                /usr/lib/libxvidcore.so.4.2 [ file ]
Source                        vlc
Source Path                   /usr/bin/vlc
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           mplayer-1.0-0.109.20090329svn.fc11
Target RPM Packages           xvidcore-1.2.1-2.fc11
Policy RPM                    selinux-policy-3.6.32-1.fc12
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   allow_execmod
Host Name                     (removed)
Platform                      Linux (removed)
                              2.6.31-0.125.4.2.rc5.git2.fc12.i686.PAE #1 SMP Tue
                              Aug 11 21:01:03 EDT 2009 i686 i686
Alert Count                   5
First Seen                    Fri 18 Sep 2009 09:35:59 AM BST
Last Seen                     Fri 18 Sep 2009 09:41:58 AM BST
Local ID                      a38fe742-48d4-4447-a77e-e0e1a17ccaba
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1253263318.885:2147): avc:  denied  { execmod } for  pid=13978 comm="mplayer" path="/usr/lib/libxvidcore.so.4.2" dev=sda2 ino=171426 scontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lib_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1253263318.885:2147): arch=40000003 syscall=125 success=no exit=-13 a0=c80000 a1=9d000 a2=5 a3=bfab0c90 items=0 ppid=13954 pid=13978 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=7 comm="mplayer" exe="/usr/bin/mplayer" subj=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 key=(null)


audit2allow suggests:

#============= unconfined_execmem_t ==============
allow unconfined_execmem_t lib_t:file execmod;