Bug 469139 - Cannot enable Desktop Effects due to SELInux policy (execmem)
Cannot enable Desktop Effects due to SELInux policy (execmem)
Product: Fedora
Classification: Fedora
Component: compiz (Show other bugs)
x86_64 Linux
medium Severity medium
: ---
: ---
Assigned To: Kristian Høgsberg
Fedora Extras Quality Assurance
: SELinux
Depends On:
  Show dependency treegraph
Reported: 2008-10-30 00:08 EDT by Noel J. Bergman
Modified: 2008-12-09 12:50 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2008-10-30 16:37:25 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Noel J. Bergman 2008-10-30 00:08:00 EDT
Description of problem:

Cannot enable Desktop Effects.

Version-Release number of selected component (if applicable):

How reproducible:


Steps to Reproduce:
1. System->Preferences->Look & Feel->Desktop Effects
2. Click "Enable Desktop Effects"

Actual results:

Error message and SELinux troubleshooting message.

Expected results:

Desktop effects should have been enabled.

Additional info:


SELinux is preventing compiz from changing a writable memory segment executable.

Detailed Description:

The compiz application attempted to change the access protection of memory
(e.g., allocated using malloc). This is a potential security problem.
Applications should not be doing this. Applications are sometimes coded
incorrectly and request this permission. The SELinux Memory Protection Tests
(http://people.redhat.com/drepper/selinux-mem.html) web page explains how to
remove this requirement. If compiz does not work and you need it to work, you
can configure SELinux temporarily to allow this access until the application is
fixed. Please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package.

Allowing Access:

If you trust compiz to run correctly, you can change the context of the
executable to unconfined_execmem_exec_t. "chcon -t unconfined_execmem_exec_t
'/usr/bin/compiz'". You must also change the default file context files on the
system in order to preserve them even on a full relabel. "semanage fcontext -a
-t unconfined_execmem_exec_t '/usr/bin/compiz'"

Fix Command:

chcon -t unconfined_execmem_exec_t '/usr/bin/compiz'

Additional Information:

Source Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
Target Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
Target Objects                None [ process ]
Source                        nv-tmp-wvbMs2
Source Path                   /tmp/nv-tmp-wvbMs2
Port                          <Unknown>
Host                          noel-fedora10
Source RPM Packages           compiz-0.7.6-17.fc10
Target RPM Packages           
Policy RPM                    selinux-policy-3.5.13-8.fc10
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   allow_execmem
Host Name                     noel-fedora10
Platform                      Linux noel-fedora10 #1 SMP
                              Mon Oct 27 17:47:43 EDT 2008 x86_64 x86_64
Alert Count                   48
First Seen                    Thu 23 Oct 2008 01:30:43 PM EDT
Last Seen                     Thu 30 Oct 2008 12:02:32 AM EDT
Local ID                      169909a5-c8fe-4bf0-ab2f-2f28b001f0d8
Line Numbers                  

Raw Audit Messages            

node=noel-fedora10 type=AVC msg=audit(1225339352.460:76): avc:  denied  { execmem } for  pid=7269 comm="compiz" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process

node=noel-fedora10 type=SYSCALL msg=audit(1225339352.460:76): arch=c000003e syscall=9 success=no exit=-13 a0=3110397000 a1=34000 a2=7 a3=812 items=0 ppid=1 pid=7269 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="compiz" exe="/usr/bin/compiz" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
Comment 1 Noel J. Bergman 2008-10-30 12:43:22 EDT
See also https://bugzilla.redhat.com/show_bug.cgi?id=469135 where Bastien conjectures that the nvidia driver may play a role in that particular bug.  I will re-test both of these with the Fedora provided driver as soon as I can (either later tonight or sometime tomorrow).
Comment 2 Noel J. Bergman 2008-10-30 15:48:01 EDT
I uninstalled the nvidia driver, restarted X, ensured that I was not using any nvidia code.  Desktop Effects changed behavior.  I no longer get the SELinux violation, but it still doesn't work.  I get a totally blank, WHITE, screen.  Rebooted and retried.  Same effect.  If I hit <escape> the screen reappears, the dialog is still there, the effects are not enabled.  If I move the mouse while the screen is white, I can see that there must be some controls under it because the mouse shape changes from a pointer to an I-bar over some invisible text field.
Comment 3 Daniel Walsh 2008-10-30 16:37:25 EDT
Yes I don't believe compiz will work with nvidia without the nvidia drivers.  So if you want compiz, you need to install the drivers and turn on execstack checking.

setsebool -P allow_execstack 1
Comment 4 Noel J. Bergman 2008-12-09 12:49:48 EST
It took a bit, but Desktop Effects are working now with the nvidia driver.

Note You need to log in before you can comment on or make changes to this bug.