Bug 191054 - ati drivers from livna breaks metacity with kernel 2111
ati drivers from livna breaks metacity with kernel 2111
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Daniel Walsh
Depends On:
  Show dependency treegraph
Reported: 2006-05-08 11:29 EDT by Noa Resare
Modified: 2007-11-30 17:11 EST (History)
3 users (show)

See Also:
Fixed In Version: selinux-policy-2.3.2-1.fc5
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2006-07-11 23:25:05 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Noa Resare 2006-05-08 11:29:29 EDT
Description of problem:

The proprietary ati driver distributed by livna installs it's own libGL that
metacity (among others) links to dynamically. When trying to start metacity i
got the following error

/usr/bin/metacity: error while loading shared libraries:
/usr/lib/ati-fglrx/libGL.so.1: cannot restore segment prot after reloc:
Permission denied

and the following in the syslog

May  8 17:09:17 mandy kernel: audit(1147100957.387:8): avc:  denied  { execmod }
for  pid=2491 comm="metacity" name="libGL.so.1.2" dev=dm-0 ino=3788268
scontext=system_u:system_r:unconfined_t:s0 tcontext=system_u:object_r:lib_t:s0

After calling '/usr/sbin/setenforce 0' metacity works as expected

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. install kmod-fglrx
2. reboot
3. login with filsafe xterm
4. Try to start gnome by running 'gnome-session'
Actual results:
The above error message

Expected results:
Starting metacity (and gnome)

Additional info:
I understand that making FC work with proprietary software is not a top
priority, but I think this is important nevertheless as so many people have
hardware that leaves them no choice but to use the proprietary drivers
Comment 1 Daniel Walsh 2006-05-09 09:07:27 EDT
Fixed in selinux-policy-targeted-2.2.38-1.fc5

Although it would be good to point this bug out to ati, along with this link
to explain the problem.

Comment 2 Noa Resare 2006-05-09 13:41:24 EDT
Thanks for the fix.

By the way, the original coding problem seems to be present in mesa also, and is
reported as https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=191191

In an ideal world the magicians of selinux and mprotect() over at redhat will
provide a patch for the mesa library that is transferred to the ati team in
about ten minutes. Then we can remove this privilege :)
Comment 3 Thorsten Leemhuis 2006-05-10 02:01:25 EDT
(In reply to comment #2)
> Thanks for the fix.

Dito. But it is not yet fully complete -- the file
also needs the context 
to make DRI work properly with the fglrx drivers; otherwise this will show up:

type=AVC msg=audit(1147239914.540:34): avc:  denied  { execmod } for  pid=3103
comm="fgl_glxgears" name="fglrx_dri.so" dev=hda5 ino=262940
scontext=user_u:system_r:unconfined_t:s0 tcontext=system_u:object_r:lib_t:s0
Comment 4 Thorsten Leemhuis 2006-05-10 02:34:12 EDT
Ohh, just tested on a diffenrent machine with a fresh install with updated
selinux policy -- the driver itself


also needs the context 


to let X start on that machine -- that was not neccessary on the other machine I
tested. Otherwise this will show up

audit(1147242608.396:6): avc:  denied  { execmod } for  pid=2519 comm="Xorg"
name="fglrx_drv.so" dev=sda6 ino=1047789
tcontext=system_u:object_r:lib_t:s0 tclass=file

and X will complain with

(II) Loading /usr/lib/xorg/modules/drivers/fglrx_drv.so
dlopen: /usr/lib/xorg/modules/drivers/fglrx_drv.so: cannot restore segment prot
after reloc: Permission denied
(EE) Failed to load /usr/lib/xorg/modules/drivers/fglrx_drv.so
(EE) No drivers available.
Comment 5 Daniel Walsh 2006-06-15 22:41:49 EDT
Fixed in selinux-policy-2.2.47-3
Comment 6 Eric Bair 2006-07-10 18:48:08 EDT
I'm using selinx-policy-2.2.47-3, and I'm still having this problem.  Moreover,
I do not have the livna kmod-fglrx package installed.  Basically, when I try to
log into gnome, the system hangs on the splash screen, and I have to hit
ctl-atl-backspace to return to the login screen.  I can log into KDE normally,
and when I try to run metacity from the command line, I get the following message:

$ metacity
metacity: error while loading shared libraries: /usr/lib/libGL.so.1: cannot
restore segment prot after reloc: Permission denied

The only way I can log into gnome is to do a setenforce 0.

Thus, I'm almost certain that I'm experiencing the same bug, and it does not
seem to be fixed in selinux-policy-2.2.47-3 on my system.
Comment 7 Daniel Walsh 2006-07-11 09:00:36 EDT
Check the file context

ls -lZ /usr/lib/libGL.so.1*
lrwxrwxrwx  root root system_u:object_r:lib_t          /usr/lib/libGL.so.1 ->
-rwxr-xr-x  root root system_u:object_r:textrel_shlib_t /usr/lib/libGL.so.1.2

To fix 
restorecon -R -v /usr/lib
Comment 8 Eric Bair 2006-07-11 18:23:58 EDT
That fixed the problem.  Thanks.

Note You need to log in before you can comment on or make changes to this bug.