Description of problem:

Cannot enable Desktop Effects.


Version-Release number of selected component (if applicable):


How reproducible:

Very.


Steps to Reproduce:
1. System->Preferences->Look & Feel->Desktop Effects
2. Click "Enable Desktop Effects"

  
Actual results:

Error message and SELinux troubleshooting message.


Expected results:

Desktop effects should have been enabled.


Additional info:

Summary:

SELinux is preventing compiz from changing a writable memory segment executable.

Detailed Description:

The compiz application attempted to change the access protection of memory
(e.g., allocated using malloc). This is a potential security problem.
Applications should not be doing this. Applications are sometimes coded
incorrectly and request this permission. The SELinux Memory Protection Tests
(http://people.redhat.com/drepper/selinux-mem.html) web page explains how to
remove this requirement. If compiz does not work and you need it to work, you
can configure SELinux temporarily to allow this access until the application is
fixed. Please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package.

Allowing Access:

If you trust compiz to run correctly, you can change the context of the
executable to unconfined_execmem_exec_t. "chcon -t unconfined_execmem_exec_t
'/usr/bin/compiz'". You must also change the default file context files on the
system in order to preserve them even on a full relabel. "semanage fcontext -a
-t unconfined_execmem_exec_t '/usr/bin/compiz'"

Fix Command:

chcon -t unconfined_execmem_exec_t '/usr/bin/compiz'

Additional Information:

Source Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Target Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Target Objects                None [ process ]
Source                        nv-tmp-wvbMs2
Source Path                   /tmp/nv-tmp-wvbMs2
Port                          <Unknown>
Host                          noel-fedora10
Source RPM Packages           compiz-0.7.6-17.fc10
Target RPM Packages           
Policy RPM                    selinux-policy-3.5.13-8.fc10
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   allow_execmem
Host Name                     noel-fedora10
Platform                      Linux noel-fedora10 2.6.27.4-58.fc10.x86_64 #1 SMP
                              Mon Oct 27 17:47:43 EDT 2008 x86_64 x86_64
Alert Count                   48
First Seen                    Thu 23 Oct 2008 01:30:43 PM EDT
Last Seen                     Thu 30 Oct 2008 12:02:32 AM EDT
Local ID                      169909a5-c8fe-4bf0-ab2f-2f28b001f0d8
Line Numbers                  

Raw Audit Messages            

node=noel-fedora10 type=AVC msg=audit(1225339352.460:76): avc:  denied  { execmem } for  pid=7269 comm="compiz" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process

node=noel-fedora10 type=SYSCALL msg=audit(1225339352.460:76): arch=c000003e syscall=9 success=no exit=-13 a0=3110397000 a1=34000 a2=7 a3=812 items=0 ppid=1 pid=7269 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="compiz" exe="/usr/bin/compiz" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)