On Sun, 2006-05-28 at 13:34 +0100, Paul Howarth wrote:
< text trimmed >
> > [root@paragon ~]# ls -Z /lib/security/pam_poldi.so
> > -rwxr-xr-x root root
> > system_u:object_r:lib_t /lib/security/pam_poldi.so
>
> You're still getting errors because the object has context lib_t rather
> than textrel_shlib_t. The semanage call *should* get restorecon to use
> textrel_shlib_t for this file, but won't change the context itself.
>
> What's the output of:
> # semanage fcontext -l | grep pam_
/lib/security/pam_poldi.so regular file
system_u:object_r:textrel_shlib_t:s0
/sbin/pam_console_apply regular file
system_u:object_r:pam_console_exec_t:s0
/var/run/console(/.*)? all files
system_u:object_r:pam_var_console_t:s0
/var/run/sudo(/.*)? all files
system_u:object_r:pam_var_run_t:s0
/sbin/pam_timestamp_check regular file
system_u:object_r:pam_exec_t:s0
/lib64/security/pam_krb5/pam_krb5_storetmp regular file
system_u:object_r:pam_exec_t:s0
/lib/security/pam_krb5/pam_krb5_storetmp regular file
system_u:object_r:pam_exec_t:s0
> # ls -lZ /lib/security/pam_poldi.so
-rwxr-xr-x root root
system_u:object_r:textrel_shlib_t /lib/security/pam_poldi.so
> # restorecon -v /lib/security/pam_poldi.so
> # ls -lZ /lib/security/pam_poldi.so
-rwxr-xr-x root root
system_u:object_r:textrel_shlib_t /lib/security/pam_poldi.so
> > > 2. What "avc: denied" messages, if any, do you see in /var/log/messages
> > > relating to this?
> >
> > audit(1148810039.087:6): avc: denied { execmod } for pid=5144
> > comm="su" name="pam_poldi.so" dev=sdb6 ino=13631516
> > scontext=user_u:system_r:unconfined_t:s0
> > tcontext=system_u:object_r:lib_t:s0 tclass=file
> > audit(1148810079.358:7): avc: denied { execheap } for pid=5172
> > comm="su" scontext=user_u:system_r:unconfined_t:s0
> > tcontext=user_u:system_r:unconfined_t:s0 tclass=process
>
> Hmm, execheap looks bad. Software really shouldn't be doing that. Did
> you compile this module yourself? If so, did you use the default
> compiler optimization flags from FC5, which are:
Yes I did compile the module myself. The makefiles are being generated
with ./configure and friends, is this sufficient?
> -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions
> -fstack-protector --param=ssp-buffer-size=4 -m32 -march=i386
> -mtune=generic -fasynchronous-unwind-tables
>
> You may find that doing that improves things.
I have to get back to you on this one. I quick modification of all
Makefiles and Makefiles.am doesn't seem to get the expected results.
Jurgen
