Fedora Account System
Red Hat Associate
Red Hat Customer
Created attachment 472356 [details] Backtrace at the crash Description of problem: When using the help function in gimp, a window flashes briefly but disappears, and the message /usr/lib64/gimp/2.0/plug-ins/help-browser: fatal error: Segmenteringsfel is written on the console. Version-Release number of selected component (if applicable): selinux-policy-3.9.7-1.fc14.noarch gimp-2.6.11-1.fc14.x86_64 webkitgtk-1.3.6-1.fc14.x86_64 How reproducible: Every time Steps to Reproduce: 1. Make sure neither allow_execmem nor allow_execstack is enabled. 2. Start gimp. 3. Use the Help->Help menu. Actual results: A window briefly flash and disappears. Expected results: A window with help documentation. Additional info: Setting EITHER allow_execstack OR allow_execmem makes the help function work. (I don't quite understand why both of them work.) Setting the type of /usr/lib64/gimp/2.0/plug-ins/help-browser to execmem_exec_t also fixes the problem, which might be the best solution according to this thread: http://lists.fedoraproject.org/pipermail/selinux/2011-January/013408.html The crash happens when the application tries to mmap anonymous pages: 17020 gettimeofday( <unfinished ...> 17020 <... gettimeofday resumed> {1294488756, 742289}, NULL) = 0 17020 mmap(NULL, 2147483648, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...> 17020 <... mmap resumed> ) = -1 EACCES (Permission denied) 17020 --- SIGSEGV (Segmentation fault) @ 0 (0) --- The code doing this is in the webkitgtk library, a stack trace is attached.
Created attachment 472358 [details] I think this might be a solution to fix this issue (untested) I think this might be a solution to fix this issue (untested)
> Expected results: > A window with help documentation. Göran, you mean the alert does not help you?
> you mean the alert does not help you? No, that is not what I mean. There is nothing wrong with the alert from SELinux. What I meant was simply that when I click on "help" in Gimp, I expect to see a window with help information about Gimp. I.e. the window help-browser shows when it works correctly.
I think we need to label it execmem_exec_t, as dgrift suggested.
Yes, I agree.
Fixed in selinux-policy-3.7.19-87.fc13
selinux-policy-3.7.19-89.fc13 has been submitted as an update for Fedora 13. https://admin.fedoraproject.org/updates/selinux-policy-3.7.19-89.fc13
selinux-policy-3.7.19-89.fc13 has been pushed to the Fedora 13 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: https://admin.fedoraproject.org/updates/selinux-policy-3.7.19-89.fc13
selinux-policy-3.7.19-89.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report.