Bug 627055
| Summary: | SELinux is preventing /usr/sbin/squid from loading /usr/sbin/squid which requires text relocation. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Gabriel Sfestarof <ronin3510> |
| Component: | squid | Assignee: | Jiri Skala <jskala> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 12 | CC: | aglotov, drepper, dwalsh, henrik, jonathansteffan, jskala, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:777c85243d7e3633339ddd0582a1293f26489bb3c03cd8e142ed9060c2fc78b2 | ||
| Fixed In Version: | squid-3.1.8-1.fc12 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2010-09-15 07:11:01 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Gabriel Sfestarof
2010-08-24 23:56:08 UTC
Did you install a different version of squid? This is very strange access. (In reply to comment #1) > Did you install a different version of squid? This is very strange access. Actually no. I've had this behaviour using the last two koji available packages. Here's the log: grep squid /var/log/yum.log May 27 13:41:27 Installed: 7:squid-3.1.3-2.fc12.x86_64 May 27 13:41:32 Installed: squidGuard-1.4-8.fc12.x86_64 Jun 01 03:33:32 Updated: 7:squid-3.1.4-1.fc12.x86_64 Jun 02 08:00:15 Updated: 7:squid-3.1.4-2.fc12.x86_64 Aug 24 11:02:54 Updated: 7:squid-3.1.6-1.fc12.x86_64 Aug 25 02:50:09 Updated: 7:squid-3.1.7-1.fc12.x86_64 Reverting to 4-2 and all works as expected. What I don't get is how simple bugfixes trigger textrell issues. one of the changes is to use system provided libtool instead of bundled version. libtool.autoconf integration also updated from libtool-1.x style to libtool-2.x The F13 update to same version do not show this problem. Looking closely what is more odd is why this complaint were not seen before on F12. The F12 and F13 packages differ slightly in how they set the compiler flags which may be the reason. I've observed same behaviour. Selinux-policy don't complain same version of squid in F13. Dan what's the difference between selinux-policy in F12 & F13? What exactly is complained by selinux-policy? Nothing as far as this denial. execmod on an executable is very rare. I think this is a build issue. f13 srpm rebuilt on f12 seems to work. Great, you are right Henrik. Exporting flags before building affects build that it produces this issue. Commenting this part of spec fixes the issue. Unfortunately I think f13 settings should be 'tuned' too. you know these much better. please fix up. i did not backport the changes as it seems in conflict with earlier changelog entries for ppc. Well, the issue is generated when -fPIE option is used. I don't think this is correct. Dan, I suppose selinux-policy should be updated. Then I'll correct spec files for F13+. There is incorrect placing flags exportation. Therefore the issue is currently only generated by F12. I suppose Henrik's comment #4 is also important. This is probably a trigger. Huh, what selinux-policy change is necessary? We are not going to allow execmod of an executable. Is GCC flags -fPIC / -fPIE / -pic / -pie related to execmod requirement somehow? Not sure what would trigger a execmod requirement. http://www.akkadia.org/drepper/textrelocs.html explains the issue quite well. Thanks Michal Schmidt for the pointer. Do we need to force these flags in the spec file? > Do we need to force these flags in the spec file?
Usage of these flags is better but not necessary. Well, I'll remove these flags.
Have removed the flags from F12 in squid-3.1.7-1.fc12.1 Will be removed from F13+ in next update. Have no effect there. squid-3.1.7-1.fc12.1 has been submitted as an update for Fedora 12. https://admin.fedoraproject.org/updates/squid-3.1.7-1.fc12.1 squid-3.1.7-1.fc12.1 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update squid'. You can provide feedback for this update here: https://admin.fedoraproject.org/updates/squid-3.1.7-1.fc12.1 Confirming the new build works fine. No more AVC denials. Thank you Have figured out why the -PIE flags failed. Is libtool that strips them from the compile line by default. squid-3.1.8-1.fc13 has been submitted as an update for Fedora 13. https://admin.fedoraproject.org/updates/squid-3.1.8-1.fc13 squid-3.1.8-1.fc14 has been submitted as an update for Fedora 14. https://admin.fedoraproject.org/updates/squid-3.1.8-1.fc14 squid-3.1.8-1.fc12 has been submitted as an update for Fedora 12. https://admin.fedoraproject.org/updates/squid-3.1.8-1.fc12 squid-3.1.8-1.fc14 has been pushed to the Fedora 14 stable repository. If problems still persist, please make note of it in this bug report. squid-3.1.8-1.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report. squid-3.1.8-1.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report. |