Bug 468678 - NVIDIA driver causes confusing SELinux denials
NVIDIA driver causes confusing SELinux denials
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
x86_64 Linux
medium Severity medium
: ---
: ---
Assigned To: Daniel Walsh
Ben Levenson
: 515625 (view as bug list)
Depends On:
  Show dependency treegraph
Reported: 2008-10-27 08:33 EDT by Torsten Rausche
Modified: 2009-10-16 23:08 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2008-10-29 13:51:06 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
glxinfo gets an execmem denial (2.76 KB, text/plain)
2008-10-27 08:35 EDT, Torsten Rausche
no flags Details
glxinfo gets an execstack denial (2.80 KB, text/plain)
2008-10-27 08:37 EDT, Torsten Rausche
no flags Details

  None (edit)
Description Torsten Rausche 2008-10-27 08:33:01 EDT
This bug was reported at rpmfusion.org:
But it possibly is a bug in the SELinux policy.

Description of problem:
With (a)kmod-nvidia.x86_64 and xorg-x11-drv-nvidia.x86_64 installed in a
current Rawhide system otherwise unsuspicious applications get in trouble with
SELinux. There are no problems when just using Rawhide's

The denials are execmem and execstack related. I will attach examples with
glxinfo. But it also happens with applications like vinagre or openoffice.org
-- perhaps every application which somehow uses OpenGL.

Version-Release number of selected component (if applicable):

How reproducible:
In permissive mode it seems that only the first invocation of an affected
application triggers the denials. Subsequent invocations of the same
application seem to work fine. In enforcing mode you always get the denials.

Steps to Reproduce:
1. Activate SELinux
2. Install and activate the xorg-x11-drv-nvidia.x86_64 driver package
3. Run glxinfo in a shell

Actual results:
exexstack and execmem denials by SELinux

Expected results:
Working accelerated OpenGL without warnings by SELinux

Additional Information:
It seems that only applications specifically built for F10 have
problems. While glx-utils-7.2-0.13.fc10.x86_64 causes denials, the OpenGL
application celestia-1.5.0-1.fc9.x86_64 (note the fc9!) works perfectly well
for example. So this could also be related to changes in gcc or default compiler
flags. Though I could not find any notices about such changes.
Comment 1 Torsten Rausche 2008-10-27 08:35:57 EDT
Created attachment 321607 [details]
glxinfo gets an execmem denial
Comment 2 Torsten Rausche 2008-10-27 08:37:01 EDT
Created attachment 321608 [details]
glxinfo gets an execstack denial
Comment 3 Daniel Walsh 2008-10-29 13:51:06 EDT
There is not much we can do about this other then turn the allow_execstack boolean on.  Have you opened up a bug with nvidia?

We don't have access to there closed source drivers or libraries.  So please report it to them.

For now you can turn off the check by executing

setsebool -P allow_execstack 1
Comment 4 sangu 2009-10-16 23:08:35 EDT
*** Bug 515625 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.