Bug 617015 - SELinux is preventing /usr/bin/knotify4 from loading /usr/lib/vlc/plugins/codec/librealvideo_plugin.so which requires text relocation.
SELinux is preventing /usr/bin/knotify4 from loading /usr/lib/vlc/plugins/cod...
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
13
i386 Linux
low Severity medium
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
setroubleshoot_trace_hash:d7f146d0080...
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2010-07-21 18:13 EDT by Piotrek Juźwiak
Modified: 2010-08-05 19:39 EDT (History)
2 users (show)

See Also:
Fixed In Version: selinux-policy-3.7.19-41.fc13
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-08-05 19:39:36 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Piotrek Juźwiak 2010-07-21 18:13:10 EDT
Summary:

SELinux is preventing /usr/bin/knotify4 from loading
/usr/lib/vlc/plugins/codec/librealvideo_plugin.so which requires text
relocation.

Detailed Description:

The knotify4 application attempted to load
/usr/lib/vlc/plugins/codec/librealvideo_plugin.so which requires text
relocation. This is a potential security problem. Most libraries do not need
this permission. Libraries are sometimes coded incorrectly and request this
permission. The SELinux Memory Protection Tests
(http://people.redhat.com/drepper/selinux-mem.html) web page explains how to
remove this requirement. You can configure SELinux temporarily to allow
/usr/lib/vlc/plugins/codec/librealvideo_plugin.so to use relocation as a
workaround, until the library is fixed. Please file a bug report.

Allowing Access:

If you trust /usr/lib/vlc/plugins/codec/librealvideo_plugin.so to run correctly,
you can change the file context to textrel_shlib_t. "chcon -t textrel_shlib_t
'/usr/lib/vlc/plugins/codec/librealvideo_plugin.so'" You must also change the
default file context files on the system in order to preserve them even on a
full relabel. "semanage fcontext -a -t textrel_shlib_t
'/usr/lib/vlc/plugins/codec/librealvideo_plugin.so'"

Fix Command:

chcon -t textrel_shlib_t '/usr/lib/vlc/plugins/codec/librealvideo_plugin.so'

Additional Information:

Source Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Target Context                system_u:object_r:lib_t:s0
Target Objects                /usr/lib/vlc/plugins/codec/librealvideo_plugin.so
                              [ file ]
Source                        knotify4
Source Path                   /usr/bin/knotify4
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           kdebase-runtime-4.4.92-1.fc13
Target RPM Packages           vlc-core-1.1.0-0.14.fc13
Policy RPM                    selinux-policy-3.7.19-37.fc13
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   allow_execmod
Host Name                     (removed)
Platform                      Linux (removed) 2.6.33.6-147.fc13.i686 #1
                              SMP Tue Jul 6 22:30:55 UTC 2010 i686 i686
Alert Count                   4
First Seen                    Thu 22 Jul 2010 12:09:06 AM CEST
Last Seen                     Thu 22 Jul 2010 12:09:11 AM CEST
Local ID                      72dff0a0-7d15-46e1-8b8c-038400b3977e
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1279750151.859:22626): avc:  denied  { execmod } for  pid=12150 comm="knotify4" path="/usr/lib/vlc/plugins/codec/librealvideo_plugin.so" dev=dm-6 ino=407014 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lib_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1279750151.859:22626): arch=40000003 syscall=125 success=no exit=-13 a0=4067000 a1=1b000 a2=5 a3=bfd789d0 items=0 ppid=1 pid=12150 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=73 comm="knotify4" exe="/usr/bin/knotify4" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  allow_execmod,knotify4,unconfined_t,lib_t,file,execmod
audit2allow suggests:

#============= unconfined_t ==============
#!!!! This avc can be allowed using the boolean 'allow_execmod'

allow unconfined_t lib_t:file execmod;
Comment 1 Piotrek Juźwiak 2010-07-21 18:17:00 EDT
Generally it started happening after installation of phonon-backend-vlc. It is annoying but doesn't make the system unusable, it just spews those problems often when the phonon engine is set to vlc backend and after that when kde must use the sound system. I understand the problem lies in vlc developers so i guess i will ask them what they can do about it.
Comment 2 Daniel Walsh 2010-07-22 10:10:45 EDT
The alert message tells you how to fix.

Miroslav can you fix the label in libraries.fc

/usr/lib(64)?/vlc/codec/librealvideo_plugin\.so --	gen_context(system_u:object_r:textrel_shlib_t,s0)
Comment 3 Piotrek Juźwiak 2010-07-22 15:57:30 EDT
I am fully aware on how to fix it but i would be fixing just the message allowing the text relocation to happen and i understand that is a security hazard ? I don't mind that message to come up, i am more worried about possible security issues?
Comment 4 Daniel Walsh 2010-07-22 16:39:36 EDT
I would not be worried about the security implication of this.  We have it labeled correctly for 64 bit machine but not 32 bit machines.  Real built the libraries incorrectly and that is causing the error.
Comment 5 Piotrek Juźwiak 2010-07-22 17:14:07 EDT
I see. In that case i volunteer to install test updates with a fix to this. Yhank You very much for such a great OS, and thank You for beeing such great developers of the best linux distro (at least in my opinion). Thank You!!
Comment 6 Miroslav Grepl 2010-07-23 07:50:58 EDT
Fixed in selinux-policy-3.7.19-40.fc13.noarch
Comment 7 Piotrek Juźwiak 2010-07-23 17:20:45 EDT
Thank You so much, i am going to test it and report back. Thanks!!
Comment 8 Fedora Update System 2010-07-28 11:10:51 EDT
selinux-policy-3.7.19-41.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/selinux-policy-3.7.19-41.fc13
Comment 9 Fedora Update System 2010-07-30 04:39:15 EDT
selinux-policy-3.7.19-41.fc13 has been pushed to the Fedora 13 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update selinux-policy'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/selinux-policy-3.7.19-41.fc13
Comment 10 Piotrek Juźwiak 2010-07-30 10:00:08 EDT
After applying this update the problem doesn't show up anymore. Thank You very much for your help. It is highly appreciated !! Thank You!!
Comment 11 Fedora Update System 2010-08-05 19:39:10 EDT
selinux-policy-3.7.19-41.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.