Bug 668162

Summary: Gimp's help browser needs execmem
Product: [Fedora] Fedora Reporter: Göran Uddeborg <goeran>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 14CC: dwalsh, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: selinux-policy-3.7.19-89.fc13 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-03-17 18:48:58 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Backtrace at the crash
none
I think this might be a solution to fix this issue (untested) none

Description Göran Uddeborg 2011-01-08 15:44:10 UTC 
Created attachment 472356 [details]
Backtrace at the crash

Description of problem:
When using the help function in gimp, a window flashes briefly but disappears, and the message
  /usr/lib64/gimp/2.0/plug-ins/help-browser: fatal error: Segmenteringsfel
is written on the console.

Version-Release number of selected component (if applicable):
selinux-policy-3.9.7-1.fc14.noarch
gimp-2.6.11-1.fc14.x86_64
webkitgtk-1.3.6-1.fc14.x86_64

How reproducible:
Every time

Steps to Reproduce:
1. Make sure neither allow_execmem nor allow_execstack is enabled.
2. Start gimp.
3. Use the Help->Help menu.

Actual results:
A window briefly flash and disappears.

Expected results:
A window with help documentation.

Additional info:
Setting EITHER allow_execstack OR allow_execmem makes the help function work.  (I don't quite understand why both of them work.)  Setting the type of /usr/lib64/gimp/2.0/plug-ins/help-browser to execmem_exec_t also fixes the problem, which might be the best solution according to this thread:
http://lists.fedoraproject.org/pipermail/selinux/2011-January/013408.html

The crash happens when the application tries to mmap anonymous pages:

    17020 gettimeofday( <unfinished ...>
    17020 <... gettimeofday resumed> {1294488756, 742289}, NULL) = 0
    17020 mmap(NULL, 2147483648, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
    17020 <... mmap resumed> )              = -1 EACCES (Permission denied)
    17020 --- SIGSEGV (Segmentation fault) @ 0 (0) ---

The code doing this is in the webkitgtk library, a stack trace is attached.
Comment 1 Dominick Grift 2011-01-08 15:59:55 UTC 
Created attachment 472358 [details]
I think this might be a solution to fix this issue (untested)

I think this might be a solution to fix this issue (untested)
Comment 2 Miroslav Grepl 2011-01-10 12:59:20 UTC 
> Expected results:
> A window with help documentation.

Göran, 
you mean the alert does not help you?
Comment 3 Göran Uddeborg 2011-01-10 14:24:43 UTC 
> you mean the alert does not help you?

No, that is not what I mean.  There is nothing wrong with the alert from SELinux.  What I meant was simply that when I click on "help" in Gimp, I expect to see a window with help information about Gimp.  I.e. the window help-browser shows when it works correctly.
Comment 4 Daniel Walsh 2011-01-10 16:02:59 UTC 
I think we need to label it execmem_exec_t, as dgrift suggested.
Comment 5 Miroslav Grepl 2011-01-10 17:10:32 UTC 
Yes, I agree.
Comment 6 Miroslav Grepl 2011-01-25 15:29:29 UTC 
Fixed in selinux-policy-3.7.19-87.fc13
Comment 7 Fedora Update System 2011-02-04 10:31:30 UTC 
selinux-policy-3.7.19-89.fc13 has been submitted as an update for Fedora 13.
https://admin.fedoraproject.org/updates/selinux-policy-3.7.19-89.fc13
Comment 8 Fedora Update System 2011-02-04 19:48:37 UTC 
selinux-policy-3.7.19-89.fc13 has been pushed to the Fedora 13 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update selinux-policy'.  You can provide feedback for this update here: https://admin.fedoraproject.org/updates/selinux-policy-3.7.19-89.fc13
Comment 9 Fedora Update System 2011-03-17 18:48:16 UTC 
selinux-policy-3.7.19-89.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.