Bug 922440 - when selinux is enable x segment fail
Summary: when selinux is enable x segment fail
Keywords:
Status: CLOSED WORKSFORME
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted
Version: 18
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Ben Levenson
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-03-16 21:43 UTC by Knut J BJuland
Modified: 2013-12-14 09:45 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2013-12-14 09:45:30 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
sudo ausearch -m avc >log (466.93 KB, application/octet-stream)
2013-03-21 17:36 UTC, Knut J BJuland
no flags Details
Xorg.0.log.old (33.34 KB, application/x-trash)
2013-04-04 12:53 UTC, Torrie Fischer
no flags Details

Description Knut J BJuland 2013-03-16 21:43:26 UTC
Description of problem:
I was able to use selinux with X in fedora 17

Version-Release number of selected component (if applicable):


How reproducible:
every time
Steps to Reproduce:
1. enable selinux
2.
3.
  
Actual results:
[   235.094] (EE) Backtrace:
[   235.096] (EE) 0: /usr/bin/Xorg (OsLookupColor+0x139) [0x472509]
[   235.096] (EE) 1: /lib64/libpthread.so.0 (__restore_rt+0x0) [0x37e140efff]
[   235.096] (EE) 2: /usr/bin/Xorg (XaceIsLocal+0x195a) [0x50094a]
[   235.096] (EE) 3: /usr/bin/Xorg (XaceIsLocal+0x2810) [0x502680]
[   235.096] (EE) 4: /usr/bin/Xorg (_CallCallbacks+0x34) [0x43e3c4]
[   235.096] (EE) 5: /usr/bin/Xorg (XaceHook+0xe8) [0x4fcea8]
[   235.097] (EE) 6: /usr/bin/Xorg (InitProximityClassDeviceStruct+0x34f) [0x5312ff]
[   235.097] (EE) 7: /usr/bin/Xorg (AssignTypeAndName+0x5e4c) [0x53fe7c]
[   235.097] (EE) 8: /usr/bin/Xorg (SendErrorToClient+0x41a) [0x43990a]
[   235.097] (EE) 9: /usr/bin/Xorg (_init+0x3a7a) [0x42b98a]
[   235.097] (EE) 10: /lib64/libc.so.6 (__libc_start_main+0xf5) [0x37e0821a05]
[   235.098] (EE) 11: /usr/bin/Xorg (_start+0x29) [0x428621]
[   235.098] (EE) 
[   235.098] (EE) Segmentation fault at address 0x0
[   235.098] 

Expected results:
xorg should run with xorg linux.
I have allose enable heap_exec and relabel the system

Additional info:

Comment 1 Knut J BJuland 2013-03-17 06:41:22 UTC
[   235.094] (EE) 
[   235.094] (EE) Backtrace:
[   235.096] (EE) 0: /usr/bin/Xorg (OsLookupColor+0x139) [0x472509]
[   235.096] (EE) 1: /lib64/libpthread.so.0 (__restore_rt+0x0) [0x37e140efff]
[   235.096] (EE) 2: /usr/bin/Xorg (XaceIsLocal+0x195a) [0x50094a]
[   235.096] (EE) 3: /usr/bin/Xorg (XaceIsLocal+0x2810) [0x502680]
[   235.096] (EE) 4: /usr/bin/Xorg (_CallCallbacks+0x34) [0x43e3c4]
[   235.096] (EE) 5: /usr/bin/Xorg (XaceHook+0xe8) [0x4fcea8]
[   235.097] (EE) 6: /usr/bin/Xorg (InitProximityClassDeviceStruct+0x34f) [0x5312ff]
[   235.097] (EE) 7: /usr/bin/Xorg (AssignTypeAndName+0x5e4c) [0x53fe7c]
[   235.097] (EE) 8: /usr/bin/Xorg (SendErrorToClient+0x41a) [0x43990a]
[   235.097] (EE) 9: /usr/bin/Xorg (_init+0x3a7a) [0x42b98a]
[   235.097] (EE) 10: /lib64/libc.so.6 (__libc_start_main+0xf5) [0x37e0821a05]
[   235.098] (EE) 11: /usr/bin/Xorg (_start+0x29) [0x428621]
[   235.098] (EE) 
[   235.098] (EE) Segmentation fault at address 0x0
[   235.098] 
Fatal server error:
[   235.098] Caught signal 11 (Segmentation fault). Server aborting
[   235.098] 
[   235.098] (EE) 
Please consult the Fedora Project support 
	 at http://wiki.x.org
 for help. 
[   235.098] (EE) Please also check the log file at "/var/log/Xorg.0.log" for additional information.
[   235.098] (EE) 
[   235.103] (II) evdev: Power Button: Close
[   235.103] (II) UnloadModule: "evdev"
[   235.109] (II) evdev: Power Button: Close
[   235.109] (II) UnloadModule: "evdev"
[   235.133] (II) evdev: USB Optical Mouse: Close
[   235.133] (II) UnloadModule: "evdev"
[   235.141] (II) evdev: GENERIC USB Audio Device: Close
[   235.141] (II) UnloadModule: "evdev"
[   235.146] (II) evdev: Microsft Microsoft Wireless Desktop Receiver 3.1A: Close
[   235.146] (II) UnloadModule: "evdev"
[   235.160] (II) evdev: Microsft Microsoft Wireless Desktop Receiver 3.1A: Close
[   235.160] (II) UnloadModule: "evdev"
[   235.500] Server terminated with error (1). Closing log file.

Comment 2 Miroslav Grepl 2013-03-18 09:34:06 UTC
Could you boot with

enforcing=0

as kernel parameter, log in and run

# ausearch -m avc -ts recent

Comment 3 Knut J BJuland 2013-03-18 18:37:58 UTC
Hi 

I ran the system on permissive mode. I have now gotten thh system to run by removing the policy and reinstall the policy without any alteration. I then relabel the system before I reinstall the nvidia driver. If I then do any alterations I am unable to mount my home dir.

Selinux is now running with permission.

ausearch -m avc -ts recent

does not show anything.

Comment 4 Daniel Walsh 2013-03-19 23:56:33 UTC
Not sure this is an SELinux policy issue, could be an X issue of something triggered by the nvidia driver.

What alterations of policy did you need to mount your homedir?

Comment 5 Knut J BJuland 2013-03-20 20:43:57 UTC
I reset to default targeted and removed a local selinx modules It worked now and I run the system in permissive mode. I have also relabed all files.

Comment 6 Daniel Walsh 2013-03-20 21:00:41 UTC
ANd if you run in enforcing X crashes?  Without any AVC messages?

Comment 7 Knut J BJuland 2013-03-21 17:36:14 UTC
Created attachment 714008 [details]
sudo ausearch -m avc  >log

sudo ausearch -m avc  >log

Comment 8 Knut J BJuland 2013-03-21 17:38:53 UTC
HI I manage to get it to work by reinstalling selinux policy and relaberling and then reinstall nvidia driver from rpmfusion. Then everything worked when running in permissive mode. I have now switch to senforcing mode and sent a log of sudo ausearch -m avc  >log

It you do not find a bug in the policy you can close it. Xorg is now working even with enforcing on.

Comment 9 Torrie Fischer 2013-04-04 12:52:57 UTC
I believe I am also affected by this bug. I'm using RPMFusion's nvidia akmod, and have selinux in permissive mode. I have not tried reinstalling the policy, but I can easily reproduce a crash in the same Xorg location by visiting tumblr with google chrome. I'm attaching my Xorg.0.log.old. It shows the same sort of crash:

[   875.720] (EE) 
[   875.720] (EE) Backtrace:
[   875.730] (EE) 0: /usr/bin/X (OsLookupColor+0x139) [0x472509]
[   875.731] (EE) 1: /lib64/libpthread.so.0 (__restore_rt+0x0) [0x7fb768a4dfff]
[   875.731] (EE) 
[   875.731] (EE) Segmentation fault at address 0x0

Also of use, here's the output of glxinfo:

$ glxinfo
name of display: :0
X Error of failed request:  BadWindow (invalid Window parameter)
  Major opcode of failed request:  153 (NV-GLX)
  Minor opcode of failed request:  4 ()
  Resource id in failed request:  0x4800003
  Serial number of failed request:  34
  Current serial number in output stream:  34


I'm running the latest KDE on fedora 18 with desktop effects enabled without issue, until I try to visit a website or launch media-explorer.

Comment 10 Torrie Fischer 2013-04-04 12:53:29 UTC
Created attachment 731581 [details]
Xorg.0.log.old

Comment 11 Torrie Fischer 2013-04-04 18:11:02 UTC
I actually had just recently ran fedup to update this system from fedora 17 to 18, so I was able to re-test this with kernel-3.6.7-4.fc17.x86_64. Still crashes with the same backtrace.

922713 seems to be a duplicate of this bug, but I'm running 3.8.5-201.fc18.x86_64, which is newer than the one in that bug.

Comment 12 Daniel Walsh 2013-04-08 17:49:19 UTC
Trever is it crashing in permissive mode?

Comment 13 Joseph Shraibman 2013-04-22 03:00:33 UTC
I get a segfault at the same location but I have selinux disabled.  I get it whenever I try to run starcraft (1 or 2) with wine.  I'm also using the nvidia driver from rpmfusion.

Comment 14 Joseph Shraibman 2013-04-22 03:07:25 UTC
I also always get a segfault within a minute of starting kde.  I'm stuck using xfce for now.  I suggest changing the package to xorg.

Comment 15 Joseph Shraibman 2013-04-22 03:09:05 UTC
On the second thought this is clearly a dupe of bug 922713

Comment 16 Miroslav Grepl 2013-04-23 07:44:53 UTC
Well if it is crashing also in permissve mode then it should not be a SELinux problem.


Note You need to log in before you can comment on or make changes to this bug.