Bug 524258 - setroubleshoot: SELinux is preventing /usr/bin/mplayer from loading /usr/lib/libxvidcore.so.4.2 which requires text relocation.
Summary: setroubleshoot: SELinux is preventing /usr/bin/mplayer from loading /usr...
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: i386
OS: Linux
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
Whiteboard: setroubleshoot_trace_hash:ce4ec5c0733...
Depends On:
TreeView+ depends on / blocked
Reported: 2009-09-18 14:55 UTC by Chris Poultney
Modified: 2009-09-18 15:08 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2009-09-18 15:08:09 UTC

Attachments (Terms of Use)

Description Chris Poultney 2009-09-18 14:55:30 UTC
The following was filed automatically by setroubleshoot:


SELinux is preventing /usr/bin/mplayer from loading /usr/lib/libxvidcore.so.4.2
which requires text relocation.

Detailed Description:

The mplayer application attempted to load /usr/lib/libxvidcore.so.4.2 which
requires text relocation. This is a potential security problem. Most libraries
do not need this permission. Libraries are sometimes coded incorrectly and
request this permission. The SELinux Memory Protection Tests
(http://people.redhat.com/drepper/selinux-mem.html) web page explains how to
remove this requirement. You can configure SELinux temporarily to allow
/usr/lib/libxvidcore.so.4.2 to use relocation as a workaround, until the library
is fixed. Please file a bug report.

Allowing Access:

If you trust /usr/lib/libxvidcore.so.4.2 to run correctly, you can change the
file context to textrel_shlib_t. "chcon -t textrel_shlib_t
'/usr/lib/libxvidcore.so.4.2'" You must also change the default file context
files on the system in order to preserve them even on a full relabel. "semanage
fcontext -a -t textrel_shlib_t '/usr/lib/libxvidcore.so.4.2'"

Fix Command:

chcon -t textrel_shlib_t '/usr/lib/libxvidcore.so.4.2'

Additional Information:

Source Context                unconfined_u:unconfined_r:unconfined_execmem_t:s0-
Target Context                system_u:object_r:lib_t:s0
Target Objects                /usr/lib/libxvidcore.so.4.2 [ file ]
Source                        vlc
Source Path                   /usr/bin/vlc
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           mplayer-1.0-0.109.20090329svn.fc11
Target RPM Packages           xvidcore-1.2.1-2.fc11
Policy RPM                    selinux-policy-3.6.32-1.fc12
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   allow_execmod
Host Name                     (removed)
Platform                      Linux (removed)
                              2.6.31- #1 SMP Tue
                              Aug 11 21:01:03 EDT 2009 i686 i686
Alert Count                   5
First Seen                    Fri 18 Sep 2009 09:35:59 AM BST
Last Seen                     Fri 18 Sep 2009 09:41:58 AM BST
Local ID                      a38fe742-48d4-4447-a77e-e0e1a17ccaba
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1253263318.885:2147): avc:  denied  { execmod } for  pid=13978 comm="mplayer" path="/usr/lib/libxvidcore.so.4.2" dev=sda2 ino=171426 scontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lib_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1253263318.885:2147): arch=40000003 syscall=125 success=no exit=-13 a0=c80000 a1=9d000 a2=5 a3=bfab0c90 items=0 ppid=13954 pid=13978 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=7 comm="mplayer" exe="/usr/bin/mplayer" subj=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 key=(null)

audit2allow suggests:

#============= unconfined_execmem_t ==============
allow unconfined_execmem_t lib_t:file execmod;

Comment 1 Daniel Walsh 2009-09-18 15:08:09 UTC
yum update

Note You need to log in before you can comment on or make changes to this bug.