Bug 187629 - SElinux preventing Gizmo VoIP application from using its libsipphone shared library
SElinux preventing Gizmo VoIP application from using its libsipphone shared l...
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Russell Coker
Depends On:
  Show dependency treegraph
Reported: 2006-04-01 20:33 EST by Michael Wiktowy
Modified: 2007-11-30 17:11 EST (History)
1 user (show)

See Also:
Fixed In Version: 2.2.29-2.fc5
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2006-04-13 23:12:25 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Michael Wiktowy 2006-04-01 20:33:40 EST
Description of problem:
The Gizmo third-party application does not run since SELinux tragetted policy is
denying the use of the libsipphoneapi library.

[mwiktowy@localhost ~]$ gizmo
gizmo: error while loading shared libraries: /usr/lib/libsipphoneapi.so: cannot
restore segment prot after reloc: Permission denied

Looking at the /var/log/messages:

Apr  1 20:11:49 localhost kernel: audit(1143940309.555:15): avc:  denied  {
execmod } for  pid=2228 comm="gizmo" name="libsipphoneapi.so.0.78.20060211"
dev=hda2 ino=3713363 scontext=user_u:system_r:unconfined_t:s0
tcontext=system_u:object_r:lib_t:s0 tclass=file

Looking at the permissions and contexts:

[root@localhost ~]# ls -la /usr/lib/libsipphoneapi.so.0.78.20060211
-rw-r--r-- 1 root root 33064270 Feb 11 15:08

[root@localhost ~]# ls -laZ /usr/lib/libsipphoneapi.so.0.78.20060211 -rw-r--r--
 root     root     system_u:object_r:lib_t         

If I use the boot switch enforcing=0, Gizmo will run fine.

Research at in the execmod section of
http://fedora.redhat.com/docs/selinux-faq-fc5/ suggested assigning the context
chcon -t testrel_shlib_t LIBRARY
where I replaced LIBRARY with /usr/lib/libsipphoneapi.so.0.78.20060211

and reporting to bugzilla.

However, that did not work as I would assume that context was enabled only for
test releases.

The libsipphone library is obtained here:
Comment 1 Daniel Walsh 2006-04-03 11:47:55 EDT
Fixed in selinux-policy-2.2.29-2.fc5
Comment 2 Michael Wiktowy 2006-04-13 22:35:39 EDT
I can confirm that after the update to selinux-policy-2.2.29-3.fc5, a "fixfiles
relabel" sets the context of the libsipphoneapi library to textrel_shlib_t and
Gizmo works fine. Thanks.

Note You need to log in before you can comment on or make changes to this bug.