3:09 p.m.
Hi all,
As you main know, I maintain e-uae in RPM Fusion. Unluckily it
requires an executable heap and SELinux complains about this.
Therefore I try to tell SELinux that this program is OK to require an
executable heap and not to worry about. I read that changing the
context of the executable to unconfined_execmem_exec_t should be
enough.
This is the scriptlet I tried to make, but it doesn't work.
%post
[...]
semanage fcontext -a -t unconfined_execmem_exec_t %{_bindir}/uae
/dev/null 2>&1 || :
restorecon -R %{_bindir}/uae
%postun
[...]
if [ "$1" -eq "0" ]; then
semanage fcontext -d -t unconfined_execmem_exec_t %{_bindir}/uae
/dev/null 2>&1 || :
fi
Any idea what is wrong? A link to proper documentation should be
helpful too. I Googled a lot without finding anything really useful :(
Thanks.
Bye,
Andrea.
5:46 p.m.
On Thu, 2008-08-21 at 17:09 +0200, Andrea Musuruane wrote:
As you main know, I maintain e-uae in RPM Fusion. Unluckily it
requires an executable heap and SELinux complains about this.
Dan Walsh is implying executable heap really shouldn't be used, see
http://danwalsh.livejournal.com/6117.html?thread=23525 For the reasons
listed there, I'm not sure it's even possible to allow. Could uae be
fixed instead?
/David
8:24 p.m.
2008/8/25 David Juran <david(a)juran.se>:
Dan Walsh is implying executable heap really shouldn't be used,
see
http://danwalsh.livejournal.com/6117.html?thread=23525 For the reasons
listed there, I'm not sure it's even possible to allow. Could uae be
fixed instead?
I read that. Unluckily patching e-uae goes beyond my current skills.
BTW, I also posted on fedora-selinux-list. The post still have to
appear on the list tough, since I'm not subscribed.
Bye,
Andrea.
10:04 a.m.
Andrea Musuruane wrote:
Hi all,
As you main know, I maintain e-uae in RPM Fusion. Unluckily it
requires an executable heap and SELinux complains about this.
Therefore I try to tell SELinux that this program is OK to require an
executable heap and not to worry about. I read that changing the
context of the executable to unconfined_execmem_exec_t should be
enough.
This is the scriptlet I tried to make, but it doesn't work.
%post
[...]
semanage fcontext -a -t unconfined_execmem_exec_t %{_bindir}/uae
> /dev/null 2>&1 || :
restorecon -R %{_bindir}/uae
%postun
[...]
if [ "$1" -eq "0" ]; then
semanage fcontext -d -t unconfined_execmem_exec_t %{_bindir}/uae
> /dev/null 2>&1 || :
fi
Any idea what is wrong?
No,
But can you try the following:
ls -Z /usr/bin/uae
And if that does not show unconfined_execmem_exec_t, then the scriptlets are
not working for some reason.
If the scriptlets are not working you can try a manual chcon like this:
chcon -t unconfined_execmem_exec_t /usr/bin/uae
And then run uae with selinux enforcing, then we can see if setting the type to
unconfined_execmem_exec_t atleast fixes things? Maybe uae is just a wrapper
which startsup another binary, then the type of that binary needs changing too.
Regards,
Hans
10:31 a.m.
2008/8/27 Hans de Goede <j.w.r.degoede(a)hhs.nl>:
> Any idea what is wrong?
No,
But can you try the following:
ls -Z /usr/bin/uae
And if that does not show unconfined_execmem_exec_t, then the scriptlets are
not working for some reason.
It does show unconfined_execmem_exec_t. uae is the binary - there is
no wrapper.
I do think that unconfined_execmem_exec_t is not the right context.
But I cannot find a good one. I don't even know if a good one
exists...
Bye,
Andrea.
10:47 a.m.
Andrea Musuruane wrote:
2008/8/27 Hans de Goede <j.w.r.degoede(a)hhs.nl>:
>> Any idea what is wrong?
> No,
>
> But can you try the following:
> ls -Z /usr/bin/uae
>
> And if that does not show unconfined_execmem_exec_t, then the scriptlets are
> not working for some reason.
It does show unconfined_execmem_exec_t. uae is the binary - there is
no wrapper.
I do think that unconfined_execmem_exec_t is not the right context.
But I cannot find a good one. I don't even know if a good one
exists...
Try java_exec_t, otherwise try making it require an executable stack by doing:
execstack -s /usr/bin/uae
And combine that with either unconfined_execmem_exec_t or java_exec_t, it has
been a while for me, but in my memory requiring an executable stack (and
changing the type to allow this) sometimes helped with programs which need an
executable heap.
Regards,
Hans
8:07 p.m.
Hi Hans,
2008/8/27 Hans de Goede <j.w.r.degoede(a)hhs.nl>:
Try java_exec_t, otherwise try making it require an executable stack
by
doing:
execstack -s /usr/bin/uae
And combine that with either unconfined_execmem_exec_t or java_exec_t, it
has been a while for me, but in my memory requiring an executable stack (and
changing the type to allow this) sometimes helped with programs which need
an executable heap.
Sorry for the long waint. java_exec_t seems to be the right trick.
I'm talking with Dan Walsh from Red Hat about this issue too
BTW, If I cannot came up with something cleaner and more polish, I'll
submit e-uae with this "hack".
Thanks again.
Bye,
Andrea.
5905
days inactive
5936
days old
rpmfusion-developers@lists.rpmfusion.org
6 comments
3 participants
participants (3)
-
Andrea Musuruane -
David Juran -
Hans de Goede