Bug 844811

Description of problem:
sealert -l c505d9af-9dfb-4a6b-928d-bc685f393e29

Summary:

SELinux is preventing clnaddrd from loading
/u01/app/oracle/product/11.2.0/client_1/lib/libclntsh.so.11.1 which requires
text relocation.

Detailed Description:

[SELinux is in permissive mode, the operation would have been denied but was
permitted due to permissive mode.]

The clnaddrd application attempted to load
/u01/app/oracle/product/11.2.0/client_1/lib/libclntsh.so.11.1 which requires
text relocation. This is a potential security problem. Most libraries do not
need this permission. Libraries are sometimes coded incorrectly and request this
permission. The SELinux Memory Protection Tests
(http://people.redhat.com/drepper/selinux-mem.html) web page explains how to
remove this requirement. You can configure SELinux temporarily to allow
/u01/app/oracle/product/11.2.0/client_1/lib/libclntsh.so.11.1 to use relocation
as a workaround, until the library is fixed. Please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package.

Allowing Access:

If you trust /u01/app/oracle/product/11.2.0/client_1/lib/libclntsh.so.11.1 to
run correctly, you can change the file context to textrel_shlib_t. "chcon -t
textrel_shlib_t '/u01/app/oracle/product/11.2.0/client_1/lib/libclntsh.so.11.1'"
You must also change the default file context files on the system in order to
preserve them even on a full relabel. "semanage fcontext -a -t textrel_shlib_t
'/u01/app/oracle/product/11.2.0/client_1/lib/libclntsh.so.11.1'"

The following command will allow this access:

chcon -t textrel_shlib_t '/u01/app/oracle/product/11.2.0/client_1/lib/libclntsh.so.11.1'

Additional Information:

Source Context                user_u:system_r:unconfined_t
Target Context                system_u:object_r:default_t
Target Objects                /u01/app/oracle/product/11.2.0/client_1/lib/libcln
                              tsh.so.11.1 [ file ]
Source                        sqlplus
Source Path                   /u01/app/oracle/product/11.2.0/client_1/bin/sqlplu
                              s
Port                          <Unknown>
Host                          WITB07
Source RPM Packages
Target RPM Packages
Policy RPM                    selinux-policy-2.4.6-327.el5
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Permissive
Plugin Name                   allow_execmod
Host Name                     WITB07
Platform                      Linux WITB07 2.6.18-308.1.1.el5 #1 SMP Fri Feb 17
                              16:51:01 EST 2012 x86_64 x86_64
Alert Count                   24
First Seen                    Fri Jul 13 09:23:54 2012
Last Seen                     Mon Jul 30 09:28:41 2012
Local ID                      c505d9af-9dfb-4a6b-928d-bc685f393e29
Line Numbers

Raw Audit Messages

host=WITB07 type=AVC msg=audit(1343654921.310:4292): avc:  denied  { execmod } for  pid=23716 comm="clnaddrd" path="/u01/app/     oracle/product/11.2.0/client_1/lib/libclntsh.so.11.1" dev=dm-8 ino=3375455 scontext=user_u:system_r:unconfined_t:s0 tcontext=     system_u:object_r:default_t:s0 tclass=file

host=WITB07 type=SYSCALL msg=audit(1343654921.310:4292): arch=c000003e syscall=10 success=yes exit=0 a0=2ad2161a7000 a1=228a0     00 a2=5 a3=2ad216243578 items=0 ppid=23680 pid=23716 auid=505 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505 sgid=505 f     sgid=505 tty=pts1 ses=692 comm="clnaddrd" exe="/u02/app/clnaddr/clean_address_linux/bin/clnaddrd" subj=user_u:system_r:unconf     ined_t:s0 key=(null)



Version-Release number of selected component (if applicable):

uname -a
Linux WITB07 2.6.18-308.1.1.el5 #1 SMP Fri Feb 17 16:51:01 EST 2012 x86_64 x86_64 x86_64 GNU/Linux


How reproducible:
Re-boot host for /etc/init.d to autostart clean_address daemon

Steps to Reproduce:
1. re-boot
2. attempt a connection from host to oracle database using sqlplus 11gr2
3.
  
Actual results:
SELinux in /var/log/messages

Expected results:

no SELinix message
Additional info:

Clean Address is product from vendor runner technologies:

http://www.runnertechnologies.com/cln_addr_faqs.html