Bug 527132

Summary: squeezebox problem
Product: [Fedora] Fedora Reporter: Rob <robjukes>
Component: selinux-policyAssignee: Daniel Walsh <dwalsh>
Status: CLOSED CANTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 11CC: dwalsh, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-10-20 21:27:04 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Rob 2009-10-04 20:41:45 UTC
trying to install logitech squeezeboxserver on linux :
service will not start, i do not understand what to do, I'm a new Linux user
Do you need more info than underneed , please react:


Summary:

SELinux is preventing squeezeboxserve from loading
/usr/share/squeezeboxserver/CPAN/arch/5.10/i386-linux-thread-multi/auto/DBD/mysql/mysql.so
which requires text relocation.

Detailed Description:

The squeezeboxserve application attempted to load
/usr/share/squeezeboxserver/CPAN/arch/5.10/i386-linux-thread-multi/auto/DBD/mysql/mysql.so
which requires text relocation. This is a potential security problem. Most
libraries do not need this permission. Libraries are sometimes coded incorrectly
and request this permission. The SELinux Memory Protection Tests
(http://people.redhat.com/drepper/selinux-mem.html) web page explains how to
remove this requirement. You can configure SELinux temporarily to allow
/usr/share/squeezeboxserver/CPAN/arch/5.10/i386-linux-thread-multi/auto/DBD/mysql/mysql.so
to use relocation as a workaround, until the library is fixed. Please file a bug
report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package.

Allowing Access:

If you trust
/usr/share/squeezeboxserver/CPAN/arch/5.10/i386-linux-thread-multi/auto/DBD/mysql/mysql.so
to run correctly, you can change the file context to textrel_shlib_t. "chcon -t
textrel_shlib_t
'/usr/share/squeezeboxserver/CPAN/arch/5.10/i386-linux-thread-multi/auto/DBD/mysql/mysql.so'"
You must also change the default file context files on the system in order to
preserve them even on a full relabel. "semanage fcontext -a -t textrel_shlib_t
'/usr/share/squeezeboxserver/CPAN/arch/5.10/i386-linux-thread-multi/auto/DBD/mysql/mysql.so'"

Fix Command:

chcon -t textrel_shlib_t
'/usr/share/squeezeboxserver/CPAN/arch/5.10/i386-linux-thread-multi/auto/DBD/mysql/mysql.so'

Additional Information:

Source Context                system_u:system_r:initrc_t:s0
Target Context                system_u:object_r:lib_t:s0
Target Objects                /usr/share/squeezeboxserver/CPAN/arch/5.10/i386
                              -linux-thread-multi/auto/DBD/mysql/mysql.so [ file
                              ]
Source                        squeezeboxserve
Source Path                   /usr/bin/perl
Port                          <Unknown>
Host                          Linuxserver
Source RPM Packages           perl-5.10.0-73.fc11
Target RPM Packages           squeezeboxserver-7.4.0-1
Policy RPM                    selinux-policy-3.6.12-83.fc11
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   allow_execmod
Host Name                     Linuxserver
Platform                      Linux Linuxserver 2.6.30.8-64.fc11.i586 #1 SMP Fri
                              Sep 25 04:30:19 EDT 2009 i686 i686
Alert Count                   28
First Seen                    Sat 03 Oct 2009 07:31:06 PM CEST
Last Seen                     Sun 04 Oct 2009 10:30:21 PM CEST
Local ID                      b0c713a6-a66b-40bf-bee6-a39fd6af968a
Line Numbers                  

Raw Audit Messages            

node=Linuxserver type=AVC msg=audit(1254688221.796:23): avc:  denied  { execmod } for  pid=2841 comm="squeezeboxserve" path="/usr/share/squeezeboxserver/CPAN/arch/5.10/i386-linux-thread-multi/auto/DBD/mysql/mysql.so" dev=dm-0 ino=136049 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file

node=Linuxserver type=SYSCALL msg=audit(1254688221.796:23): arch=40000003 syscall=125 success=no exit=-13 a0=48a000 a1=19a000 a2=5 a3=bfa6b610 items=0 ppid=2822 pid=2841 auid=4294967295 uid=494 gid=491 euid=494 suid=494 fsuid=494 egid=491 sgid=491 fsgid=491 tty=(none) ses=4294967295 comm="squeezeboxserve" exe="/usr/bin/perl" subj=system_u:system_r:initrc_t:s0 key=(null)

Comment 1 Miroslav Grepl 2009-10-05 11:28:01 UTC
The problem is the libraries are built incorrectly at squeezeboxserver.
 
Try to run the command what setroubleshoot suggests:

chcon -t textrel_shlib_t
'/usr/share/squeezeboxserver/CPAN/arch/5.10/i386-linux-thread-multi/auto/DBD/mysql/mysql.so'



You can look at the following link. There are useful information about SELinux.

http://docs.fedoraproject.org/selinux-user-guide/f11/en-US/