Selinux and K9copy

[Daniel J Walsh]

Rick Stevens wrote:
> On Thu, 2006-12-07 at 16:21 -0500, jim tate wrote:
>   
>> Running tail -f /var/log/messages
>> When I execute "k9copy" w/o quotes , I get the log in /var/log/messages. 
>> Same happens when running
>> as SU or user.
>>  From What I can see , I'm having problems with Selinux. How do I fix 
>> it? Relabel etc etc
>>
>> Dec 7 12:22:35 sysresccd kernel: audit(1165512155.670:17): avc: denied { 
>> execmod } for pid=32642 comm="k9copy" name="libk9copy.so.0.0.0" dev=hda1 
>> ino=3892747 scontext=user_u:system_r:unconfined_t:s0 
>> tcontext=system_ubject_r:lib_t:s0 tclass=file
>> Dec 7 12:22:36 sysresccd kernel: pci_set_power_state(): 0000:02:08.0: 
>> state=3, current state=5
>>     
>
> If you save the relative entries to a text file somewhere and run
> "audit2why <name-of-text-file", it'll give you some suggestions.
>   
Actually that will not tell you much.  A much better solution would be 
to run setroubleshootd.  This would translate that error message to 
something like the following:



Summary
    SELinux is preventing k9copy from loading libk9copy.so.0.0.0 which 
requires
    text relocation.

Detailed Description
    The k9copy application attempted to load libk9copy.so.0.0.0 which 
requires
    text relocation.  This is a potential security problem. Most 
libraries do
    not need this permission. Libraries are sometimes coded incorrectly and
    request this permission.  The http://people.redhat.com/drepper/selinux-
    mem.html web page explains how to remove this requirement.  You can
    configure SELinux temporarily to allow libk9copy.so.0.0.0 to use 
relocation
    as a workaround, until the library is fixed. Please file a
    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.

Allowing Access
    If you trust libk9copy.so.0.0.0 to run correctly, you can change the 
file
    context to textrel_shlib_t. "chcon -t textrel_shlib_t 
libk9copy.so.0.0.0"

    The following command will allow this access:
    chcon -t textrel_shlib_t libk9copy.so.0.0.0

Additional Information       

Source Context                user_u:system_r:unconfined_t
Target Context                system_u:object_r:lib_t
Target Objects                libk9copy.so.0.0.0 [ file ]
Affected RPM Packages        
Policy RPM                   
Selinux Enabled              
Policy Type                  
MLS Enabled                  
Enforcing Mode               
Plugin Name                   plugins.allow_execmod
Host Name                    
Platform                     
Alert Count                   1
Line Numbers                  1

Raw Audit Messages           

avc: denied { execmod } for comm="k9copy" dev=hda1 name="libk9copy.so.0.0.0"
pid=32642 scontext=user_u:system_r:unconfined_t:s0 tclass=file
tcontext=system_u:object_r:lib_t:s0


>> Jim
>>
>>     
> ----------------------------------------------------------------------
> - Rick Stevens, Senior Systems Engineer     rstevens at vitalstream.com -
> - VitalStream, Inc.                       http://www.vitalstream.com -
> -                                                                    -
> -         "OK, so you're a Ph.D. Just don't TOUCH anything!"         -
> ----------------------------------------------------------------------
>
>