Bug 580679 - SELinux is preventing lsnrctl from loading /u01/app/oracle/product/11.1.0/db_1/lib/libclntsh.so.11.1 which requires text relocation.
SELinux is preventing lsnrctl from loading /u01/app/oracle/product/11.1.0/db_...
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: selinux-policy (Show other bugs)
All Linux
low Severity high
: rc
: ---
Assigned To: Daniel Walsh
BaseOS QE Security Team
Depends On:
  Show dependency treegraph
Reported: 2010-04-08 14:48 EDT by Michael Worsham
Modified: 2010-04-08 15:34 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2010-04-08 15:34:02 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Michael Worsham 2010-04-08 14:48:58 EDT
[SELinux is in permissive mode, the operation would have been denied but was
permitted due to permissive mode.]

The lsnrctl application attempted to load
/u01/app/oracle/product/11.1.0/db_1/lib/libclntsh.so.11.1 which requires text
relocation. This is a potential security problem. Most libraries do not need
this permission. Libraries are sometimes coded incorrectly and request this
permission. The SELinux Memory Protection Tests
(http://people.redhat.com/drepper/selinux-mem.html) web page explains how to
remove this requirement. You can configure SELinux temporarily to allow
/u01/app/oracle/product/11.1.0/db_1/lib/libclntsh.so.11.1 to use relocation as a
workaround, until the library is fixed. Please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package.

Allowing Access:

If you trust /u01/app/oracle/product/11.1.0/db_1/lib/libclntsh.so.11.1 to run
correctly, you can change the file context to textrel_shlib_t. "chcon -t
textrel_shlib_t '/u01/app/oracle/product/11.1.0/db_1/lib/libclntsh.so.11.1'" You
must also change the default file context files on the system in order to
preserve them even on a full relabel. "semanage fcontext -a -t textrel_shlib_t

The following command will allow this access:

chcon -t textrel_shlib_t '/u01/app/oracle/product/11.1.0/db_1/lib/libclntsh.so.11.1'

Additional Information:

Source Context                user_u:system_r:unconfined_t
Target Context                user_u:object_r:default_t
Target Objects                /u01/app/oracle/product/11.1.0/db_1/lib/libclntsh.
                              so.11.1 [ file ]
Source                        sqlplus
Source Path                   /u01/app/oracle/product/11.1.0/db_1/bin/sqlplus
Port                          <Unknown>
Source RPM Packages
Target RPM Packages
Policy RPM                    selinux-policy-2.4.6-255.el5_4.1
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Permissive
Plugin Name                   allow_execmod
Alert Count                   7
First Seen                    Wed Apr  7 15:26:05 2010
Last Seen                     Thu Apr  8 04:16:18 2010
Local ID                      7f2ae546-15a2-4739-ba2a-0f6ca4f5745c
Line Numbers

Raw Audit Messages

host=XXXXX type=AVC msg=audit(1270714578.484:315128): avc:  denied  { execmod } for  pid=25898 comm="lsnrctl" path="/u01/app/oracle/product/11.1.0/db_1/lib/libclntsh.so.11.1" dev=dm-0 ino=7507481 scontext=user_u:system_r:unconfined_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=file

host=XXXXX type=SYSCALL msg=audit(1270714578.484:315128): arch=c000003e syscall=10 success=yes exit=0 a0=2ae0fdd6f000 a1=2322000 a2=5 a3=2ae0fde02800 items=0 ppid=25855 pid=25898 auid=502 uid=504 gid=505 euid=504 suid=504 fsuid=504 egid=505 sgid=505 fsgid=505 tty=pts0 ses=39 comm="lsnrctl" exe="/u01/app/oracle/product/11.1.0/db_1/bin/lsnrctl" subj=user_u:system_r:unconfined_t:s0 key=(null)
Comment 1 Daniel Walsh 2010-04-08 15:34:02 EDT
Probably best to turn off this check

setsebool -P allow_execmod 1

Note You need to log in before you can comment on or make changes to this bug.