On Sun, 2006-05-28 at 12:09 +0200, Jurgen Kramer wrote:
> On Sun, 2006-05-28 at 11:01 +0100, Paul Howarth wrote:
> > On Sun, 2006-05-28 at 11:57 +0200, Jurgen Kramer wrote:
> > > On Sat, 2006-05-27 at 21:40 +0100, Paul Howarth wrote:
> > > > On Sat, 2006-05-27 at 18:54 +0200, Jurgen Kramer wrote:
> > > > > I am trying to add a custom PAM module (pam_poldi.so) to my FC5 system
> > > > > to be able to login using a OpenPGP smartcard. I already changed the
> > > > > security context of /lib/security/pam_poldi.so to match the other pam
> > > > > modules (system_u:object_r:lib_t) but it seems that is not enough. In
> > > > > syslog I still see:
> > > > >
> > > > > su: PAM unable to dlopen(/lib/security/pam_poldi.so)
> > > > > su: PAM [error: /lib/security/pam_poldi.so: cannot restore segment prot
> > > > > after reloc: Permission denied]
> > > > >
> > > > > This can propably be fixed with a chcon -t
> > > > > texrel_shlib_t /lib/security/pam_poldi.so
> > > > >
> > > > > This will probably not survice an selinux update or relabel session.
> > > > > What is the proper way to add the module so it will survice relabels and
> > > > > selinux updates?
> > > >
> > > > This should do it:
> > > >
> > > > # semanage fcontext -a -t textrel_shlib_t -f
> > > > -- /lib/security/pam_poldi.so
> > > >
> > > > (that's all one long line)
> > > >
> > > > You could test it by changing the context back to lib_t and then doing:
> > > >
> > > > # restorecon -v /lib/security/pam_poldi.so
> > > >
> > > > which should set it back to textrel_shlib_t.
> > > Unfortunately that did not do it :(
> > >
> > > I still get:
> > >
> > > su: PAM unable to dlopen(/lib/security/pam_poldi.so)
> > > su: PAM [error: /lib/security/pam_poldi.so: cannot restore segment prot
> > > after reloc: Permission denied]
> > > su: PAM adding faulty module: /lib/security/pam_poldi.so
> > >
> > > Any ideas?
> >
> > 1. Is the context type of /lib/security/pam_poldi.so currently set to
> > textrel_shlib_t?
>
> [root@paragon ~]# ls -Z /lib/security/pam_poldi.so
> -rwxr-xr-x root root
> system_u:object_r:lib_t /lib/security/pam_poldi.so
You're still getting errors because the object has context lib_t rather
than textrel_shlib_t. The semanage call *should* get restorecon to use
textrel_shlib_t for this file, but won't change the context itself.
What's the output of:
# semanage fcontext -l | grep pam_
# ls -lZ /lib/security/pam_poldi.so
# restorecon -v /lib/security/pam_poldi.so
# ls -lZ /lib/security/pam_poldi.so
> > 2. What "avc: denied" messages, if any, do you see in /var/log/messages
> > relating to this?
>
> audit(1148810039.087:6): avc: denied { execmod } for pid=5144
> comm="su" name="pam_poldi.so" dev=sdb6 ino=13631516
> scontext=user_u:system_r:unconfined_t:s0
> tcontext=system_u:object_r:lib_t:s0 tclass=file
> audit(1148810079.358:7): avc: denied { execheap } for pid=5172
> comm="su" scontext=user_u:system_r:unconfined_t:s0
> tcontext=user_u:system_r:unconfined_t:s0 tclass=process
Hmm, execheap looks bad. Software really shouldn't be doing that. Did
you compile this module yourself? If so, did you use the default
compiler optimization flags from FC5, which are:
-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions
-fstack-protector --param=ssp-buffer-size=4 -m32 -march=i386
-mtune=generic -fasynchronous-unwind-tables
You may find that doing that improves things.
Paul.
