Bug 537967 - SELinux is preventing /usr/bin/avidemux2_gtk from loading /usr/lib/libADM5avcodec.so.52 which requires text relocation.
Summary: SELinux is preventing /usr/bin/avidemux2_gtk from loading /usr/lib/libADM5avc...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 12
Hardware: i386
OS: Linux
low
medium
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:08b2b3aa296...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-11-17 00:35 UTC by Halfasleep
Modified: 2010-03-12 04:20 UTC (History)
9 users (show)

Fixed In Version: 3.6.32-55.fc12
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2009-12-07 22:46:32 UTC


Attachments (Terms of Use)

Description Halfasleep 2009-11-17 00:35:07 UTC
Summary:

SELinux is preventing /usr/bin/avidemux2_gtk from loading
/usr/lib/libADM5avcodec.so.52 which requires text relocation.

Detailed Description:

The avidemux2_gtk application attempted to load /usr/lib/libADM5avcodec.so.52
which requires text relocation. This is a potential security problem. Most
libraries do not need this permission. Libraries are sometimes coded incorrectly
and request this permission. The SELinux Memory Protection Tests
(http://people.redhat.com/drepper/selinux-mem.html) web page explains how to
remove this requirement. You can configure SELinux temporarily to allow
/usr/lib/libADM5avcodec.so.52 to use relocation as a workaround, until the
library is fixed. Please file a bug report.

Allowing Access:

If you trust /usr/lib/libADM5avcodec.so.52 to run correctly, you can change the
file context to textrel_shlib_t. "chcon -t textrel_shlib_t
'/usr/lib/libADM5avcodec.so.52'" You must also change the default file context
files on the system in order to preserve them even on a full relabel. "semanage
fcontext -a -t textrel_shlib_t '/usr/lib/libADM5avcodec.so.52'"

Fix Command:

chcon -t textrel_shlib_t '/usr/lib/libADM5avcodec.so.52'

Additional Information:

Source Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Target Context                system_u:object_r:lib_t:s0
Target Objects                /usr/lib/libADM5avcodec.so.52 [ file ]
Source                        avidemux2_qt4
Source Path                   /usr/bin/avidemux2_qt4
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           avidemux-gtk-2.5.1-6.20091010svn.fc12
Target RPM Packages           avidemux-libs-2.5.1-6.20091010svn.fc12
Policy RPM                    selinux-policy-3.6.32-41.fc12
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   allow_execmod
Host Name                     (removed)
Platform                      Linux (removed) 2.6.31.5-127.fc12.i686 #1 SMP
                              Sat Nov 7 21:41:45 EST 2009 i686 i686
Alert Count                   5
First Seen                    Tue 17 Nov 2009 12:30:18 AM GMT
Last Seen                     Tue 17 Nov 2009 12:33:38 AM GMT
Local ID                      e50a4d7b-cb5f-409b-96fa-b611029d1262
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1258418018.363:49): avc:  denied  { execmod } for  pid=2603 comm="avidemux2_gtk" path="/usr/lib/libADM5avcodec.so.52" dev=sda1 ino=88538 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lib_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1258418018.363:49): arch=40000003 syscall=125 success=no exit=-13 a0=e25000 a1=3f0000 a2=5 a3=bfd6c1b0 items=0 ppid=2575 pid=2603 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts2 ses=1 comm="avidemux2_gtk" exe="/usr/bin/avidemux2_gtk" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  selinux-policy-3.6.32-41.fc12,allow_execmod,avidemux2_qt4,unconfined_t,lib_t,file,execmod
audit2allow suggests:

#============= unconfined_t ==============
allow unconfined_t lib_t:file execmod;

Comment 1 Daniel Walsh 2009-11-17 13:18:46 UTC
Fixed in selinux-policy-3.6.32-46.fc12.noarch

Comment 2 Fedora Update System 2009-11-23 23:41:42 UTC
selinux-policy-3.6.32-49.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-49.fc12

Comment 3 Fedora Update System 2009-11-25 15:25:02 UTC
selinux-policy-3.6.32-49.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update selinux-policy'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2009-12131

Comment 4 Fedora Update System 2009-12-02 04:36:02 UTC
selinux-policy-3.6.32-49.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Mike 2009-12-02 13:49:22 UTC
Installing selinux-policy-3.6.32-49.fc12 did not fix the problem. Here is what happens:
I allowed text relocation for ADM5avcodec.so.52, but the next time I tried to launchavidemux it blocked ADM5swscale.so.0. Each time I allow text relocation for a blocked file, and the next time it blocks another file. When I got to ADM5postproc.so.51 it continues blocking it even after I allow text relocation, so I stopped there. These are the files blocked so far:

ADM5avcodec.so.52
ADM5swscale.so.0
ADM5coreimage.so.0
ADM5postproc.so.51

Comment 6 Daniel Walsh 2009-12-02 19:29:15 UTC
chcon -t textrel_shlib_t 

All of those files and it should work.

Could you give me the path to all of those files?

Comment 7 Mike 2009-12-02 20:23:36 UTC
I did:

[root@localhost ~]# chcon -t textrel_shlib_t '/usr/lib/libADM5avcodec.so.52'
[root@localhost ~]# chcon -t textrel_shlib_t '/usr/lib/libADM5swscale.so.0'
[root@localhost ~]# chcon -t textrel_shlib_t '/usr/lib/libADM5postproc.so.51'
[root@localhost ~]# chcon -t textrel_shlib_t '/usr/lib/libADM5avutil.so.50'
[root@localhost ~]# 

And both Avidemux GTK and Avidemux QT4 work now. Thank you!

Mike

Comment 8 Daniel Walsh 2009-12-02 21:08:05 UTC
Fixed in selinux-policy-3.6.32-53.fc12.noarch

Comment 9 Fedora Update System 2009-12-03 20:27:09 UTC
selinux-policy-3.6.32-55.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-55.fc12

Comment 10 Fedora Update System 2009-12-04 23:45:18 UTC
selinux-policy-3.6.32-55.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update selinux-policy'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2009-12650

Comment 11 Fedora Update System 2009-12-08 07:51:56 UTC
selinux-policy-3.6.32-55.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.