Bug 675558

Summary: SELinux is preventing /usr/bin/mono from using the 'execmem' accesses on a process.
Product: [Fedora] Fedora Reporter: Vinayak Kumbhakern <kvinayaks>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED NOTABUG QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 14CC: dwalsh, jcmj, kvinayaks, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard: setroubleshoot_trace_hash:a3f45331f720778f464a62700c39bc6d28a6dab4937994aa50ac99a1dd9e8925
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-02-07 11:40:59 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Vinayak Kumbhakern 2011-02-06 16:08:05 UTC
SELinux is preventing /usr/bin/mono from using the 'execmem' accesses on a process.

*****  Plugin catchall_boolean (89.3 confidence) suggests  *******************

If you want to allow httpd scripts and modules execmem/execstack
Then you must tell SELinux about this by enabling the 'httpd_execmem' boolean.
Do
setsebool -P httpd_execmem 1

*****  Plugin catchall (11.6 confidence) suggests  ***************************

If you believe that mono should be allowed execmem access on processes labeled httpd_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep mono /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:system_r:httpd_t:s0
Target Context                unconfined_u:system_r:httpd_t:s0
Target Objects                Unknown [ process ]
Source                        mono
Source Path                   /usr/bin/mono
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           mono-core-2.6.7-3.fc14
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.7-28.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 2.6.35.10-74.fc14.i686 #1 SMP
                              Thu Dec 23 16:17:40 UTC 2010 i686 i686
Alert Count                   2
First Seen                    Sun 06 Feb 2011 11:01:09 AM EST
Last Seen                     Sun 06 Feb 2011 11:01:09 AM EST
Local ID                      1d6bada3-4fd3-4f65-acf4-7b96eb271699

Raw Audit Messages
type=AVC msg=audit(1297008069.642:23940): avc:  denied  { execmem } for  pid=23845 comm="mono" scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:system_r:httpd_t:s0 tclass=process


type=SYSCALL msg=audit(1297008069.642:23940): arch=i386 syscall=mmap2 per=400000 success=no exit=EACCES a0=0 a1=10000 a2=7 a3=22 items=0 ppid=1 pid=23845 auid=500 uid=48 gid=488 euid=48 suid=48 fsuid=48 egid=488 sgid=488 fsgid=488 tty=(none) ses=5 comm=mono exe=/usr/bin/mono subj=unconfined_u:system_r:httpd_t:s0 key=(null)

Hash: mono,httpd_t,httpd_t,process,execmem

audit2allow

#============= httpd_t ==============
#!!!! This avc can be allowed using the boolean 'httpd_execmem'

allow httpd_t self:process execmem;

audit2allow -R

#============= httpd_t ==============
#!!!! This avc can be allowed using the boolean 'httpd_execmem'

allow httpd_t self:process execmem;

Comment 1 Miroslav Grepl 2011-02-07 11:40:59 UTC
Are you using mod_mono?

If no, you can you remove it.

If yes, just turn on the 'httpd_execmem' boolean.

setsebool -P httpd_execmem 1

Comment 2 Daniel Walsh 2011-02-07 16:11:51 UTC
Vinayak Did you read the alert?  It told you the solution to your problem?

Comment 3 Vinayak Kumbhakern 2011-02-07 17:15:42 UTC
(In reply to comment #2)
> Vinayak Did you read the alert?  It told you the solution to your problem?

Yes Daniel.. That seems to work.. Thanks!