Bug 813895 - SELinux is preventing wfcmgr.bin from using the 'execstack' accesses on a process.
Summary: SELinux is preventing wfcmgr.bin from using the 'execstack' accesses on a pro...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 17
Hardware: i686
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:607467f1c6a9e7c957e833b3bd1...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-04-18 17:21 UTC by Mikhail
Modified: 2012-04-20 15:01 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2012-04-20 11:47:43 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Mikhail 2012-04-18 17:21:34 UTC
libreport version: 2.0.10
executable:     /usr/bin/python2.7
hashmarkername: setroubleshoot
kernel:         3.3.2-1.fc17.i686.PAE
time:           Wed 18 Apr 2012 11:21:11 PM YEKT

description:
:SELinux is preventing wfcmgr.bin from using the 'execstack' accesses on a process.
:
:*****  Plugin allow_execstack (53.1 confidence) suggests  ********************
:
:If you believe that 
:/opt/Citrix/ICAClient/libctxssl.so
:should not require execstack
:Then you should clear the execstack flag and see if wfcmgr.bin works correctly.
:Report this as a bug on /opt/Citrix/ICAClient/libctxssl.so.
:You can clear the exestack flag by executing:
:Do
:execstack -c /opt/Citrix/ICAClient/libctxssl.so
:
:*****  Plugin catchall_boolean (42.6 confidence) suggests  *******************
:
:If you want to allow unconfined executables to make their stack executable.  This should never, ever be necessary. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla
:Then you must tell SELinux about this by enabling the 'allow_execstack'boolean.
:Do
:setsebool -P allow_execstack 1
:
:*****  Plugin catchall (5.76 confidence) suggests  ***************************
:
:If you believe that wfcmgr.bin should be allowed execstack access on processes labeled unconfined_t by default.
:Then you should report this as a bug.
:You can generate a local policy module to allow this access.
:Do
:allow this access for now by executing:
:# grep wfcmgr.bin /var/log/audit/audit.log | audit2allow -M mypol
:# semodule -i mypol.pp
:
:Additional Information:
:Source Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
:                              023
:Target Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
:                              023
:Target Objects                 [ process ]
:Source                        wfcmgr.bin
:Source Path                   wfcmgr.bin
:Port                          <Unknown>
:Host                          (removed)
:Source RPM Packages           
:Target RPM Packages           
:Policy RPM                    selinux-policy-3.10.0-114.fc17.noarch
:Selinux Enabled               True
:Policy Type                   targeted
:Enforcing Mode                Enforcing
:Host Name                     (removed)
:Platform                      Linux (removed) 3.3.2-1.fc17.i686.PAE #1 SMP Fri Apr 13
:                              20:44:48 UTC 2012 i686 i686
:Alert Count                   3
:First Seen                    Wed 18 Apr 2012 11:11:10 PM YEKT
:Last Seen                     Wed 18 Apr 2012 11:11:49 PM YEKT
:Local ID                      d1ba7851-12d1-443d-a2fa-9157ae1b37bb
:
:Raw Audit Messages
:type=AVC msg=audit(1334769109.392:96): avc:  denied  { execstack } for  pid=3296 comm="ld-linux.so.2" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process
:
:
:Hash: wfcmgr.bin,unconfined_t,unconfined_t,process,execstack
:
:audit2allowunable to open /sys/fs/selinux/policy:  Permission denied
:
:
:audit2allow -Runable to open /sys/fs/selinux/policy:  Permission denied
:
:

Comment 1 Mikhail 2012-04-19 06:05:39 UTC
Problem begins occurs after installing Citrix Receiver http://www.citrix.com/English/ss/downloads/details.asp?downloadId=2316611&productId=1689163

Comment 2 Miroslav Grepl 2012-04-20 11:47:43 UTC
Did you try to do what sealert suggests?

Comment 3 Daniel Walsh 2012-04-20 15:01:09 UTC
If this solves the problem for you could you open a bug with Citrix, to build their libraries correctly.

execstack -c /opt/Citrix/ICAClient/libctxssl.so

We will turn on the allow_execstack boolean back on for the final release.


Note You need to log in before you can comment on or make changes to this bug.