Summary: SELinux is preventing /home/michael/mupen/mupen64plus from changing the access protection of memory on the heap. Detailed Description: The mupen64plus application attempted to change the access protection of memory on the heap (e.g., allocated using malloc). This is a potential security problem. Applications should not be doing this. Applications are sometimes coded incorrectly and request this permission. The SELinux Memory Protection Tests (http://people.redhat.com/drepper/selinux-mem.html) web page explains how to remove this requirement. If mupen64plus does not work and you need it to work, you can configure SELinux temporarily to allow this access until the application is fixed. Please file a bug report against this package. Allowing Access: If you want mupen64plus to continue, you must turn on the allow_execheap boolean. Note: This boolean will affect all applications on the system. Fix Command: setsebool -P allow_execheap=1 Additional Information: Source Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Objects None [ process ] Source mupen64plus Source Path /home/michael/mupen/mupen64plus Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.7.19-39.fc13 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name allow_execheap Host Name (removed) Platform Linux (removed) 2.6.33.3-85.fc13.x86_64 #1 SMP Thu May 6 18:09:49 UTC 2010 x86_64 x86_64 Alert Count 1 First Seen Tue 03 Aug 2010 12:22:36 PM MDT Last Seen Tue 03 Aug 2010 12:22:36 PM MDT Local ID 5aa2afc8-e4f0-48fd-ae38-0f065c3b184b Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1280859756.65:23042): avc: denied { execheap } for pid=15773 comm="mupen64plus" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process node=(removed) type=SYSCALL msg=audit(1280859756.65:23042): arch=c000003e syscall=10 success=no exit=-13 a0=2689000 a1=410d0 a2=7 a3=42100 items=0 ppid=15741 pid=15773 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts0 ses=1 comm="mupen64plus" exe="/home/michael/mupen/mupen64plus" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) Hash String generated from allow_execheap,mupen64plus,unconfined_t,unconfined_t,process,execheap audit2allow suggests: #============= unconfined_t ============== #!!!! This avc can be allowed using the boolean 'allow_execheap' allow unconfined_t self:process execheap;
I have no idea what kind of application this is but execheap should almost never be needed. http://people.redhat.com/~drepper/selinux-mem.html Explains the access. If you really need this app to run you can turn off the check by executing # setsebool -P allow_execheap 1