Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: The libjvm.so file has executable stack flag set. That leads to AVC denial avc: denied { execstack } for pid=25972 comm="java" scontext=unconfined_u:system_r:initrc_t:s0 tcontext=unconfined_u:system_r:initrc_t:s0 tclass=process when trying to start tomcat5 (as part of Spacewalk server). However, when I clear the execstack, tomcat5 seems to start and run just fine. So my assumption is that it is actually not needed, generally. Version-Release number of selected component (if applicable): # rpm -qf /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/amd64/server/libjvm.so java-1.6.0-openjdk-1.6.0.0-33.b16.fc12.x86_64 How reproducible: Deterministic. Steps to Reproduce: 1. run execstack -q /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/amd64/server/libjvm.so 2. Run service tomcat5 start with Enforcing SELinux. Actual results: # execstack -q /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/amd64/server/libjvm.so X /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/amd64/server/libjvm.so Fails, with dl failure on line 696Error: failed /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/amd64/server/libjvm.so, because /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/amd64/server/libjvm.so: cannot enable executable stack as shared object requires: Permission denied in catalina.out. Expected results: # execstack -q /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/amd64/server/libjvm.so - /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/amd64/server/libjvm.so and tomcat5 starting just fine. Additional info: Running # execstack -c /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/amd64/server/libjvm.so # makes tomcat5 run fine but user should not need to do that ou their system.
This might have been fixed upstream by: http://icedtea.classpath.org/hg/icedtea6?cmd=changeset;node=be41014d9d9b Is the patches/hotspot/default/icedtea-gcc-stack-markings.patch in the current rpm sources?
(In reply to comment #1) > This might have been fixed upstream by: > http://icedtea.classpath.org/hg/icedtea6?cmd=changeset;node=be41014d9d9b > > Is the patches/hotspot/default/icedtea-gcc-stack-markings.patch in the current > rpm sources? No, it is not included in latest RPM, release 33.
*** Bug 540153 has been marked as a duplicate of this bug. ***
And while we are adding other bugs as duplicates to this one -- could we actually get new java built, so that the bug can be close and everyone is happy? Especially as upstream seems to have working patch? Thank you, Jan
Upstream is preparing to release 1.7 soon. Once it is out, it will be built into rawhide. Re-assigning component owner to package builder.
Thank you. While I appreciate the fix in rawhide with 1.7, Fedora 12 has nine to ten more months of life ahead, and this issue prevents applications like tomcat to run properly with SELinux Enforcing. So I'd claim that it is a pretty serious issue, and warrants a respin of the java-1.6.0-openjdk package for Fedora 12. Thank you for considering that. Jan
This bug has been triaged -- Fedora Bugzappers volunteer triage team https://fedoraproject.org/wiki/BugZappers
Whilst waiting for an update, am I right in thinking that the following can be used as a workaround? # setsebool allow_java_execstack 1
It probably can. However: why is it so hard to respin java package in the first place? Is there some kind of politics behind this?
(In reply to comment #7) > This bug has been triaged What does it mean in practical terms? When can we expect fixed package to be released?
It means that the bug report is complete and and actionable: http://fedoraproject.org/wiki/BugZappers/BugStatusWorkFlow#Triaged -- Fedora Bugzappers volunteer triage team https://fedoraproject.org/wiki/BugZappers
java-1.6.0-openjdk-1.6.0.0-33.b17.fc11 has been submitted as an update for Fedora 11. http://admin.fedoraproject.org/updates/java-1.6.0-openjdk-1.6.0.0-33.b17.fc11
java-1.6.0-openjdk-1.6.0.0-36.b17.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/java-1.6.0-openjdk-1.6.0.0-36.b17.fc12
java-1.6.0-openjdk-1.6.0.0-35.b17.fc13 has been submitted as an update for Fedora 13. http://admin.fedoraproject.org/updates/java-1.6.0-openjdk-1.6.0.0-35.b17.fc13
The released package fixes the issue on Fedora 12. This bugzilla can now be closed as resolved.
java-1.6.0-openjdk-1.6.0.0-33.b17.fc11 has been pushed to the Fedora 11 stable repository. If problems still persist, please make note of it in this bug report.
java-1.6.0-openjdk-1.6.0.0-36.b17.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.
java-1.6.0-openjdk-1.6.0.0-35.b17.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report.