Bug 480189 - tanukiwrapper generates execmod AVC denial
Summary: tanukiwrapper generates execmod AVC denial
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: tanukiwrapper
Version: 10
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Deepak Bhole
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 514558
TreeView+ depends on / blocked
 
Reported: 2009-01-15 16:57 UTC by Jan Pazdziora (Red Hat)
Modified: 2009-08-17 21:58 UTC (History)
3 users (show)

Fixed In Version: 3.2.3-2.4.fc10
Clone Of: 471218
Environment:
Last Closed: 2009-08-17 21:58:20 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Jan Pazdziora (Red Hat) 2009-01-15 16:57:41 UTC
+++ This bug was initially created as a clone of Bug #471218 +++

Description of problem:

When starting Spacewalk 0.3, an execmod AVC denial is logged:

type=AVC msg=audit(1226431153.819:93): avc:  denied  { execmod } for  pid=3364 comm="java" path="/usr/lib/libwrapper.so" dev=dm-0 ino=883661 scontext=root:system_r:java_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file

Version-Release number of selected component (if applicable):

Spacewalk 0.3 with tanukiwrapper-3.2.1-2jpp.ep1.1.el5.

How reproducible:

Deterministic.

Steps to Reproduce:
1. eu-findtextrel /usr/lib/libwrapper.so
  
Actual results:

the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeGetUser' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeGetInteractiveUser' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeSetConsoleTitle' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeRequestThreadDump' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeInit' is not compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeGetJavaPID' is not compiled with -fpic/-fPIC
the file containing the function 'handleInterrupt' is not compiled with -fpic/-fPIC
the file containing the function 'handleTermination' is not compiled with -fpic/-fPIC
the file containing the function 'wrapperJNIHandleSignal' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeGetControlEvent' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeGetLibraryVersion' is not compiled with -fpic/-fPIC
the file containing the function 'getLastErrorText' is not compiled with -fpic/-fPIC

Expected results:

eu-findtextrel: no text relocations reported in '/usr/lib/libwrapper.so'


[...]

--- Additional comment from jpazdziora on 2008-11-12 09:33:57 EDT ---

Jesus says:

jmrodri adelton, one thing that is different is the makefile patches for tanukiwrapper
jmrodri adelton, 3.2.1 has this for the compile
jmrodri $(COMPILE) -pthread $(wrapper_SOURCE) -o $(BIN)/wrapper -lm
jmrodri while 3.1.2 has this
jmrodri $(COMPILE) -lm $(wrapper_SOURCE) -o $(BIN)/wrapper
jmrodri diff is -pthread

--- Additional comment from jesusr on 2008-11-12 09:37:34 EDT ---

3.1.2 rpm also patch the %.o: %.c section of the Makefile.linux

3.1.2 orig
$(COMPILE) $(DEFS) -Wp,-MD,.deps/$(*F).pp -c $<

3.1.2 patch
$(COMPILE) $(DEFS) -fPIC -Wp,-MD,.deps/$(*F).pp -c $<

3.2.1 orig
$(COMPILE) $(DEFS) -Wp,-MD,.deps/$(*F).pp -c $<

I'm not sure if -fPIC makes a difference here or not.

--- Additional comment from jpazdziora on 2008-11-12 09:47:08 EDT ---

Please rebuild tanukiwrapper with -fPIC. Thank you.

Comment 1 Jan Pazdziora (Red Hat) 2009-01-15 16:59:39 UTC
For the record, it's tanukiwrapper-3.2.3-2.3.fc10.i386.rpm in Fedora 10 which has the problem:

$ eu-findtextrel ./libwrapper.so 
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeGetUser' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeGetInteractiveUser' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeSetConsoleTitle' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeRequestThreadDump' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeInit' is not compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function '_init' might not be compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeGetJavaPID' is not compiled with -fpic/-fPIC
the file containing the function 'handleInterrupt' is not compiled with -fpic/-fPIC
the file containing the function 'handleHangup' is not compiled with -fpic/-fPIC
the file containing the function 'handleTermination' is not compiled with -fpic/-fPIC
the file containing the function 'wrapperJNIHandleSignal' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeGetControlEvent' is not compiled with -fpic/-fPIC
the file containing the function 'Java_org_tanukisoftware_wrapper_WrapperManager_nativeGetLibraryVersion' is not compiled with -fpic/-fPIC
the file containing the function 'getLastErrorText' is not compiled with -fpic/-fPIC

Comment 2 Jan Pazdziora (Red Hat) 2009-07-31 15:20:41 UTC
Deepak, the tanukiwrapper problem is blocking Spacewalk 0.6 with SELinux Enforcing release both for Fedora 10 and for Fedora 11. Will you be able to release newly built package with the -fpic/-fPIC fix? Thank you.

Comment 3 Fedora Update System 2009-07-31 19:17:14 UTC
tanukiwrapper-3.2.3-2.4.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/tanukiwrapper-3.2.3-2.4.fc10

Comment 4 Deepak Bhole 2009-07-31 19:19:31 UTC
Jan, please try the above build and let me know if it fixes the issue. I have patched the make files to compile with -fPIC:

# eu-findtextrel /usr/lib/libgmp.so
eu-findtextrel: no text relocations reported in '/usr/lib/libgmp.so'

Comment 5 Deepak Bhole 2009-07-31 19:46:22 UTC
Er, posted wrong example in Comment #4. Meant to display this:

# eu-findtextrel /usr/lib/libwrapper.so 
eu-findtextrel: no text relocations reported in '/usr/lib/libwrapper.so'

Comment 6 Fedora Update System 2009-08-01 23:54:51 UTC
tanukiwrapper-3.2.3-2.4.fc10 has been pushed to the Fedora 10 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update tanukiwrapper'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F10/FEDORA-2009-8193

Comment 7 Jan Pazdziora (Red Hat) 2009-08-03 08:01:29 UTC
Thank you, eu-findtextrel /usr/lib/libwrapper.so is indeed clean.

Could you do similar rebuild for Fedora 11?

Comment 8 Deepak Bhole 2009-08-03 20:03:48 UTC
Yep. I built for 10, 11 and rawhide at the same time. Just wanted to make sure it works before pushing for f11. Pushed for updates-testing on F11:

https://admin.fedoraproject.org/updates/tanukiwrapper-3.2.3-3.4.fc11

Comment 9 Jan Pazdziora (Red Hat) 2009-08-04 06:22:16 UTC
Oh, great. Tested on F11, it looks good. Marking as VERIFIED.

Thank you, Jan

Comment 10 Fedora Update System 2009-08-17 21:58:15 UTC
tanukiwrapper-3.2.3-2.4.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.