Summary: SELinux is preventing /opt/drweb/drwebd.real from changing the access protection of memory on the heap. Detailed Description: The drwebd.real application attempted to change the access protection of memory on the heap (e.g., allocated using malloc). This is a potential security problem. Applications should not be doing this. Applications are sometimes coded incorrectly and request this permission. The SELinux Memory Protection Tests (http://www.akkadia.org/drepper/selinux-mem.html) web page explains how to remove this requirement. If drwebd.real does not work and you need it to work, you can configure SELinux temporarily to allow this access until the application is fixed. Please file a bug report against this package. Allowing Access: If you want drwebd.real to continue, you must turn on the allow_execheap boolean. Note: This boolean will affect all applications on the system. Fix Command: setsebool -P allow_execheap=1 Additional Information: Source Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Objects None [ process ] Source drwebd.real Source Path /opt/drweb/drwebd.real Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.7.19-62.fc13 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name allow_execheap Host Name (removed) Platform Linux (removed) 2.6.33.3-85.fc13.i686 #1 SMP Thu May 6 18:44:12 UTC 2010 i686 i686 Alert Count 150 First Seen Mon 11 Oct 2010 09:11:04 PM CEST Last Seen Mon 11 Oct 2010 09:11:24 PM CEST Local ID f8ab52b3-6509-487b-b0b0-beb4f0d27587 Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1286824284.234:1437): avc: denied { execheap } for pid=17623 comm="drwebd.real" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process node=(removed) type=SYSCALL msg=audit(1286824284.234:1437): arch=40000003 syscall=125 success=no exit=-13 a0=973a000 a1=200 a2=7 a3=972eb90 items=0 ppid=14704 pid=17623 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="drwebd.real" exe="/opt/drweb/drwebd.real" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) Hash String generated from allow_execheap,drwebd.real,unconfined_t,unconfined_t,process,execheap audit2allow suggests: #============= unconfined_t ============== #!!!! This avc can be allowed using the boolean 'allow_execheap' allow unconfined_t self:process execheap;
*** Bug 642017 has been marked as a duplicate of this bug. ***
This package has changed ownership in the Fedora Package Database. Reassigning to the new owner of this component.
This is also true for Red Hat EPEL 6 64 bit.
It is very strange for an application to need to modify/execute the heap. If you want to turn off the check you can execute setsebool -P allow_execheap 1 The following explains the access. http://www.akkadia.org/drepper/selinux-mem.html I would ask whoever provided /opt/drweb/drwebd.real why it needs this access?