Bug 355291 - RFE: Allow fluendo codecs to work with SELinux enabled
RFE: Allow fluendo codecs to work with SELinux enabled
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
8
All Linux
low Severity low
: ---
: ---
Assigned To: Daniel Walsh
Fedora Extras Quality Assurance
: Reopened
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2007-10-27 11:01 EDT by Valent Turkovic
Modified: 2013-01-13 06:53 EST (History)
4 users (show)

See Also:
Fixed In Version: Current
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-03-05 17:17:10 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
avc denial message (2.33 KB, application/octet-stream)
2007-11-26 05:34 EST, Valent Turkovic
no flags Details

  None (edit)
Description Valent Turkovic 2007-10-27 11:01:50 EDT
Description of problem:
Fluendo codecs don't work on Fedora 8 test 3 (and probably not on any other
fedora version) with selinux enabled.

This is the error I get when starting totem with fluendo megacodecs installed:

I first tried coping them to /usr/lib/gstreamer-0.10 when that failed
I copied them to $HOME/.gstreamer-0.10/plugins. Now I have them on
both places.


$ gst-inspect-0.10 | grep flu
fluac3dec: audio/ac3: no extensions
fluac3dec:  fluac3dec: AC3 decoder
flumpeg4vdec:  flumpeg4vdec: Fluendo MPEG-4 ASP Video Decoder
flumpeg2vdec:  flumpeg2vdec: Fluendo MPEG-2 Video Decoder
fluwmvdec:  fluwmvdec: Fluendo WMV Decoder
fluisodemux:  fluisodemux: ISODemux Demuxer
flumpegdemux:  flupsdemux: MPEG Program Demuxer
flumpegdemux:  flutsdemux: MPEG Transport stream demuxer
fluasf:  fluasfdemux: Fluendo ASF Demuxer
fluasf:  fluasfcmdparse: Fluendo ASF Command Parser
flumms:  flummssrc: Fluendo MMS source
fluwmadec:  fluwmadec: Fluendo WMA Decoder
flump3dec:  flump3dec: Fluendo MP3 Decoder (IPP build)


I copied fluendo codec files to $HOME/.gstreamer-0.10/plugins in
openSuse 10.3 and it worked with some videos that previously it
didn't. Namely it worked with one mpeg1 file named bespring.mpg the
same file under same player on Fedora 8 test 3 gives this error:


$ totem /data/bedspring.mpg

(totem:3725): GStreamer-WARNING **: Failed to load plugin
'/home/fedora8test3/.gstreamer-0.10/plugins/libgstfluac3dec.so':
/home/fedora8test3/.gstreamer-0.10/plugins/libgstfluac3dec.so: cannot
restore segment prot after reloc: Permission denied

(totem:3725): GStreamer-WARNING **: Failed to load plugin
'/home/fedora8test3/.gstreamer-0.10/plugins/libgstflumpeg2vdec.so':
/home/fedora8test3/.gstreamer-0.10/plugins/libgstflumpeg2vdec.so:
cannot restore segment prot after reloc: Permission denied
** Message: don't know how to handle video/mpeg, mpegversion=(int)1,
systemstream=(boolean)false
** Message: Missing plugin: gstreamer|0.10|totem|MPEG-1 Video
decoder|decoder-video/mpeg, mpegversion=(int)1,
systemstream=(boolean)false (MPEG-1 Video decoder)
XID: 77594627


This is what fluendo support replied to my request:

Yes we know about that problem and we are pushing Intel everyday to
provide us with a version of IPP that does not do text relocation.
Sorry for the frustration that it creates.

Version-Release number of selected component (if applicable):


How reproducible:
Evey time selinux is enabled.

Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:
to enable codecs to be loaded I needed to do this:
chcon -t textrel_shlib_t ~/.gstreamer-0.10/plugins/*

Can this be exclusion is selinux policy so that codecs work?

here is the link to fluendo bugzilla:
https://core.fluendo.com/gstreamer/trac/ticket/24
Comment 1 Daniel Walsh 2007-10-29 22:58:05 EDT
restorecon -R -v /usr/lib/gstreamer-0.10

Should fix the labeling.

selinux-policy-3.0.8-40
Comment 2 Valent Turkovic 2007-10-30 04:33:15 EDT
I'm really not selinux proficient... can you please explain a bit. Are you
adding the exclusion to selinux policy?
Comment 3 Daniel Walsh 2007-10-30 06:29:55 EDT
The libraries are built incorrectly,  They require the execmod privs which
selinux is denying.  You can label the files textrel_shlib_t and SELinux will
allow the execmod priv.  In selinux-policy-3.0.8-38 and probably before, the
context for the se files was textrel_shlib_t.  rpm install of these files would
label them correctly, if you installed them by some other means they might not
have the right context.

So executing restorecon on them will set them to the system defaults.  In -40 I
am adding the context for these files in the homedirectories.
Comment 4 David Nielsen 2007-11-04 13:28:04 EST
adding Will Woods to CC.

This definitely needs a known issues comment, we are willfully breaking one of
our F8 features out of the box.
Comment 5 Will Woods 2007-11-05 16:06:11 EST
Works for me. Tested on x86_64 installed from DVD and i386 installed from Live
image. ls -lZ ~/.gstreamer-0.10/plugins confirms that the installed object is
textrel_shlib_t. 
Comment 6 Valent Turkovic 2007-11-11 14:20:18 EST
I have Fedora 8 with all updates and I still see this bug!

look here:

$ totem clip1.wmv 

(totem:14560): GStreamer-WARNING **: Failed to load plugin
'/home/valentt/.gstreamer-0.10/plugins/libgstflumpeg2vdec.so':
/home/valentt/.gstreamer-0.10/plugins/libgstflumpeg2vdec.so: cannot restore
segment prot after reloc: Permission denied

(totem:14560): GStreamer-WARNING **: Failed to load plugin
'/home/valentt/.gstreamer-0.10/plugins/libgstflumpeg4videodec.so':
/home/valentt/.gstreamer-0.10/plugins/libgstflumpeg4videodec.so: cannot restore
segment prot after reloc: Permission denied

(totem:14560): GStreamer-WARNING **: Failed to load plugin
'/home/valentt/.gstreamer-0.10/plugins/libgstfluac3dec.so':
/home/valentt/.gstreamer-0.10/plugins/libgstfluac3dec.so: cannot restore segment
prot after reloc: Permission denied

(totem:14560): GStreamer-WARNING **: Failed to load plugin
'/home/valentt/.gstreamer-0.10/plugins/libgstfluwmvdec.so':
/home/valentt/.gstreamer-0.10/plugins/libgstfluwmvdec.so: cannot restore segment
prot after reloc: Permission denied

(totem:14560): GStreamer-WARNING **: Failed to load plugin
'/home/valentt/.gstreamer-0.10/plugins/libgstflump3dec.so':
/home/valentt/.gstreamer-0.10/plugins/libgstflump3dec.so: cannot restore segment
prot after reloc: Permission denied
** Message: don't know how to handle video/x-wmv, wmvversion=(int)3,
framerate=(fraction)10000000/333333, width=(int)720, height=(int)480,
format=(fourcc)WMV3, pixel-aspect-ratio=(fraction)1/1,
codec_data=(buffer)4e611a01, bitrate=(int)455725
** Message: Error: Failed to connect stream: Invalid argument
pulsesink.c(399): gst_pulsesink_prepare ():
/play/visbin/abin/audiosinkbin/audio-sink/bin6/autoaudiosink1/autoaudiosink1-actual-sink-pulse
Comment 7 Valent Turkovic 2007-11-11 14:22:33 EST
after:
chcon -t textrel_shlib_t /home/valentt/.gstreamer-0.10/plugins/*

it works...
Comment 8 Valent Turkovic 2007-11-11 14:26:17 EST
ps. I testing full fluendo codec pack not only mp3 plugin...

$ ls -a .gstreamer-0.10/plugins/
.   libgstfluac3dec.so    libgstfluisodemux.so  libgstflump3dec.so    
libgstflumpeg4videodec.so  libgstfluwmadec.so
..  libgstfluasfdemux.so  libgstflumms.so       libgstflumpeg2vdec.so 
libgstflumpegdemux.so      libgstfluwmvdec.so
Comment 9 Bastien Nocera 2007-11-11 21:23:37 EST
Daniel can only change the defaults for the system filepaths, not for the user
ones. There's no way to fix the problem for the user part without manual
changes, other than getting Fluendo to actually fix the bugs in their code.
Comment 10 Valent Turkovic 2007-11-12 02:28:16 EST
thank you for explaining.
Comment 11 Valent Turkovic 2007-11-15 15:47:58 EST
I still see this bug.

I installed a fluendo codecs to a new machine with fresh fedora 8 in folder
'/usr/lib/gstreamer-0.10/' and after trying to play one file that I know fluedo
codecs play I get AVC message saying that it is forbidden.

look:
$ totem bedspring.mpg 

(totem:3079): GStreamer-WARNING **: Failed to load plugin
'/usr/lib/gstreamer-0.10/libgstflumpeg4videodec.so':
/usr/lib/gstreamer-0.10/libgstflumpeg4videodec.so: cannot restore segment prot
after reloc: Permission denied

(totem:3079): GStreamer-WARNING **: Failed to load plugin
'/usr/lib/gstreamer-0.10/libgstflump3dec.so':
/usr/lib/gstreamer-0.10/libgstflump3dec.so: cannot restore segment prot after
reloc: Permission denied

(totem:3079): GStreamer-WARNING **: Failed to load plugin
'/usr/lib/gstreamer-0.10/libgstflumpeg2vdec.so':
/usr/lib/gstreamer-0.10/libgstflumpeg2vdec.so: cannot restore segment prot after
reloc: Permission denied

(totem:3079): GStreamer-WARNING **: Failed to load plugin
'/usr/lib/gstreamer-0.10/libgstfluwmvdec.so':
/usr/lib/gstreamer-0.10/libgstfluwmvdec.so: cannot restore segment prot after
reloc: Permission denied

(totem:3079): GStreamer-WARNING **: Failed to load plugin
'/usr/lib/gstreamer-0.10/libgstfluac3dec.so':
/usr/lib/gstreamer-0.10/libgstfluac3dec.so: cannot restore segment prot after
reloc: Permission denied
** Message: don't know how to handle video/mpeg, mpegversion=(int)1,
systemstream=(boolean)false
** Message: don't know how to handle audio/mpeg, mpegversion=(int)1


after doing this as a root:
chcon -t textrel_shlib_t /usr/lib/gstreamer-0.10/*

Now I can play bedspring.mpg without any problems.
Comment 12 Will Woods 2007-11-15 17:01:09 EST
Okay - selinux-policy-3.0.8-56.fc8 has been built, which should automatically
label gstreamer plugins textrel_shlib_t when they are created. This will *not*
fix files that have already been created in ~/.gstreamer*/plugins

Could you test the policy from here:
http://koji.fedoraproject.org/koji/buildinfo?buildID=24504

Probably you could test by removing the plugins, installing the policy, then
reinstalling the plugins.
Comment 13 Valent Turkovic 2007-11-21 01:56:51 EST
I tried all this and I still have this issue.
Comment 14 Daniel Walsh 2007-11-21 09:13:21 EST
Please attach the AVC messages you are having.

You can just set the boolean allow_execmod

setsebool -P allow_execmod=1

Comment 15 Valent Turkovic 2007-11-26 05:34:50 EST
Created attachment 268781 [details]
avc denial message

avc denial message
Comment 16 Daniel Walsh 2007-11-26 12:41:34 EST
restorecon -R -v /usr/lib 

should fix the /usr/lib/gstreamer-0.10/libgstflumpeg4videodec.so
Comment 17 Valent Turkovic 2008-01-16 14:34:57 EST
new version of fluendo codecs is out and I got it for testing. Looks like they
behave ok with SELinux.

I'll test them on one other machine and report back.
Comment 18 Valent Turkovic 2008-01-16 16:01:55 EST
nope - latest version of fluendo codecs still has this error (AVC Denial).

I tried "restorecon -R -v /usr/lib" and after that it's ok.

Should this be added to SELinux or some fedora script?
Comment 19 Daniel Walsh 2008-01-16 16:27:55 EST
No, the codecs should be fixed.  If the codecs come in a rpm, they will be
labeled correctly.

Comment 20 Valent Turkovic 2008-01-17 05:48:26 EST
fluendo codecs are distributed in tar.bz2 archives
Comment 21 David Nielsen 2008-01-19 14:03:24 EST
I just bought the lastest codec pack and it works just fine with an updated F8
system (x86_64 relabeled with the lastest selinux-policy-targeted). I'm a
Fluendo beta tester so I'll make sure to keep an eye on future SELinux issues.

WORKSFORME
Comment 22 Daniel Walsh 2008-03-05 17:17:10 EST
Bugs have been in modified for over one month.  Closing as fixed in current
release please reopen if the problem still persists.

Note You need to log in before you can comment on or make changes to this bug.