Bug 683924 - SELinux is preventing /home/troche/Downloads/ctsitemonitor-linux/ctsitemonitor from using the 'execstack' accesses on a process.
Summary: SELinux is preventing /home/troche/Downloads/ctsitemonitor-linux/ctsitemonito...
Keywords:
Status: CLOSED CANTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 14
Hardware: i386
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL: http://ctsitemonitor.cullytechnologie...
Whiteboard: setroubleshoot_trace_hash:38238753cab...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-03-10 16:57 UTC by Ted Roche
Modified: 2011-03-10 17:44 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-03-10 17:44:37 UTC
Type: ---


Attachments (Terms of Use)

Description Ted Roche 2011-03-10 16:57:41 UTC
SELinux is preventing /home/troche/Downloads/ctsitemonitor-linux/ctsitemonitor from using the 'execstack' accesses on a process.

*****  Plugin allow_execstack (53.1 confidence) suggests  ********************

If you do not think /home/troche/Downloads/ctsitemonitor-linux/ctsitemonitor should need to map stack memory that is both writable and executable.
Then you need to report a bug. 
This is a potentially dangerous access.
Do
contact your security administrator and report this issue.

*****  Plugin catchall_boolean (42.6 confidence) suggests  *******************

If you want to allow unconfined executables to make their stack executable.  This should never, ever be necessary. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla
Then you must tell SELinux about this by enabling the 'allow_execstack' boolean.
Do
setsebool -P allow_execstack 1

*****  Plugin catchall (5.76 confidence) suggests  ***************************

If you believe that ctsitemonitor should be allowed execstack access on processes labeled unconfined_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep ctsitemonitor /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Target Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Target Objects                Unknown [ process ]
Source                        ctsitemonitor
Source Path                   /home/troche/Downloads/ctsitemonitor-
                              linux/ctsitemonitor
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.7-31.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     (removed)
Platform                      Linux saturn.tedroche.com
                              2.6.35.11-83.fc14.i686.PAE #1 SMP Mon Feb 7
                              06:57:55 UTC 2011 i686 i686
Alert Count                   7
First Seen                    Thu 20 Jan 2011 09:24:09 AM EST
Last Seen                     Thu 10 Mar 2011 11:41:39 AM EST
Local ID                      5f47c95e-8d3c-4c1b-84eb-77014c37c9a7

Raw Audit Messages
type=AVC msg=audit(1299775299.945:75): avc:  denied  { execstack } for  pid=6649 comm="ctsitemonitor" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process


type=SYSCALL msg=audit(1299775299.945:75): arch=i386 syscall=mprotect success=yes exit=0 a0=bfc55000 a1=1000 a2=1000007 a3=bfc541f0 items=0 ppid=1 pid=6649 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=2 comm=ctsitemonitor exe=/home/troche/Downloads/ctsitemonitor-linux/ctsitemonitor subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)

Hash: ctsitemonitor,unconfined_t,unconfined_t,process,execstack

audit2allow

#============= unconfined_t ==============
#!!!! This avc is allowed in the current policy

allow unconfined_t self:process execstack;

audit2allow -R

#============= unconfined_t ==============
#!!!! This avc is allowed in the current policy

allow unconfined_t self:process execstack;

Comment 1 Ted Roche 2011-03-10 17:09:14 UTC
ctSiteMonitor is an application apparently written using RealStudio. I suspect the embedded RealStudio runtimes depend on execstack functionality. I did not see any related bug postings.

Comment 2 Daniel Walsh 2011-03-10 17:44:37 UTC
The only solution to this is to turn the check off.


# setsebool -P allow_execstack 1

Or you could label it execmem_exec_t


chcon -t execmem_exec_t /home/troche/Downloads/ctsitemonitor-      linux/ctsitemonitor

But if users want to be able to download executables into their homedir that require execstack, then you need to turn the check off.


Note You need to log in before you can comment on or make changes to this bug.