SELinux problem whith totem.

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Pedro Jose wrote:
> Hello, I received this warning after installing totem-xine and run
> this for the first time. I am concerned because the solution  will
> affect all applications on the system. (SELinux warning).
> 
> This is:
> 
> 
> Resúmen:
> 
> SELinux is preventing totem from changing the access protection of memory on the
> heap.
> 
> Descripción Detallada:
> 
> The totem application attempted to change the access protection of memory on the
> heap (e.g., allocated using malloc). This is a potential security problem.
> Applications should not be doing this. Applications are sometimes coded
> incorrectly and request this permission. The SELinux Memory Protection Tests
> (http://people.redhat.com/drepper/selinux-mem.html) web page explains how to
> remove this requirement. If totem does not work and you need it to work, you can
> configure SELinux temporarily to allow this access until the application is
> fixed. Please file a bug report
> (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package.
> 
> Permitiendo Acceso:
> 
> If you want totem to continue, you must turn on the allow_execheap boolean.
> Note: This boolean will affect all applications on the system.
> 
> El siguiente comando permitirá este acceso:
> 
> setsebool -P allow_execheap=1
> 
> Información Adicional:
> 
> Contexto Fuente               system_u:system_r:unconfined_t:s0
> Contexto Destino              system_u:system_r:unconfined_t:s0
> Objetos Destino               None [ process ]
> Source                        totem
> Source Path                   /usr/bin/totem
> Port                          <Desconocido>
> Host                          localhost.localdomain
> Source RPM Packages           totem-xine-2.20.1-1.lvn8
> Target RPM Packages
> RPM de Políticas             selinux-policy-3.0.8-93.fc8
> SELinux Activado              True
> Tipo de Política             targeted
> MLS Activado                  True
> Modo Obediente                Enforcing
> Nombre de Plugin              allow_execheap
> Nombre de Equipo              localhost.localdomain
> Plataforma                    Linux localhost.localdomain 2.6.24.3-34.fc8 #1 SMP
>                               Wed Mar 12 18:17:20 EDT 2008 i686 i686
> Cantidad de Alertas           2
> First Seen                    lun 24 mar 2008 22:26:42 CET
> Last Seen                     lun 24 mar 2008 22:26:42 CET
> Local ID                      c06e8b85-a4b1-4b69-8672-76e95d189cf9
> Números de Línea
> 
> Mensajes de Auditoría Crudos
> 
> host=localhost.localdomain type=AVC msg=audit(1206394002.429:87): avc:
>  denied  { execheap } for  pid=5071 comm="totem"
> scontext=system_u:system_r:unconfined_t:s0
> tcontext=system_u:system_r:unconfined_t:s0 tclass=process
> 
> host=localhost.localdomain type=SYSCALL msg=audit(1206394002.429:87):
> arch=40000003 syscall=125 success=no exit=-13 a0=808f000 a1=ad4000
> a2=5 a3=bfe0eff0 items=0 ppid=1 pid=5071 auid=500 uid=500 gid=500
> euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none)
> comm="totem" exe="/usr/bin/totem"
> subj=system_u:system_r:unconfined_t:s0 key=(null)
> 
> 
> How can I do?
> 
> Thanks
> 
You are trying to run a program that is doing something dangerous.  I am
pretty sure this is caused by a badly coded codec.  You can either not
run the codec, or execute

# setsebool -P allow_execheap 1

Like the message told you.


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkfueCEACgkQrlYvE4MpobNhfwCbBRzkqtUp/2+6CkCuO6UWCKtl
StwAoOu+Ozzr7UPoFzGUgTwXAHsUXbzV
=m16G
-----END PGP SIGNATURE-----