Red Hat Bugzilla – Bug 252227
gcl fails with segmentation fault. selinux prevents gcl from performing a text relocation.
Last modified: 2007-11-30 17:12:13 EST
Description of problem:
gcl fails to start, but instead fails with a segmentation fault. Shortly
thereafter, the setroubleshoot browser signals that it has a new message about
why selinux prevented gcl from running.
Version-Release number of selected component (if applicable):
$ rpm -q gcl selinux-policy selinux-policy-targeted
Always, i.e., every time I enter 'gcl' at the bash shell prompt.
Steps to Reproduce:
1. Enter 'gcl' at the bash shell prompt.
gcl interpreter should start, followed by the interpreter's prompt.
The setroubleshoot browser provides the following detailed description:
"The /usr/lib/gcl-2.6.7/unixport/saved_ansi_gcl application attempted to load
/usr/lib/gcl-2.6.7/unixport/saved_ansi_gcl which requires text relocation. This
is a potential security problem. Most libraries do not need this permission.
Libraries are sometimes coded incorrectly and request this permission. The
SELinux Memory Protection Tests web page explains how to remove this
requirement. You can configure SELinux temporarily to allow
/usr/lib/gcl-2.6.7/unixport/saved_ansi_gcl to use relocation as a workaround,
until the library is fixed. Please file a bug report against this package."
Try "/sbin/restorecon -r /usr/lib/gcl-2.6.7".
I can do that, but should it be necessary? (I'm not too knowledgeable about
selinux -- I use the default Fedora settings.) By comparison, neither sbcl nor
clisp have this problem:
$ rpm -q sbcl clisp
Both start without problems and without my having created special selinux
settings. In addition, sbcl and clisp put their libraries in, respectively,
while 'gcl' puts its libraries in /usr/lib/gcl-2.6.7.
This did not fix the problem. Here is the result (run as 'root'):
# /sbin/restorecon -r /usr/lib/gcl-2.6.7
# echo $?
The post-install script of the gcl package takes care of the selinux business.
I found the problem now, the script uses the wrong path on 64-bit platforms.
I will make a new build ASAP. This will appear in updates-testing. Please try
it from there and report back.
I will attempt to check it today.
gcl-2.6.7-15.fc7 has been pushed to the Fedora 7 testing repository. If problems still persist, please make note of it in this bug report.
I have enabled the 'fedora-updates-testing.repo', but 'gcl' is not appearing as
an available package for download. Is it possible that only the 'i386' version
is available while the 'x86_64' version is not?
It takes a little time for the mirrors to sync, so try again.
I have installed the (x86_64) test version via 'yum install'. gcl no longer
fails with a segmentation fault. I started the interpreter, evaluated several
expressions, and exited the interpreter without any errors, and then repeated
that startup-eval-shutdown sequence several times without seeing any errors.
There were also no error messages displayed in /var/log/messages or
/var/log/secure, and the setroubleshoot program does not have any new reports.
The problem that I reported appears to have been fixed. Thank you!
(Note: The x86_64 gcl library files are still installed in '/usr/lib/' instead
gcl-2.6.7-15.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report.