Research
Skip Research Menus
Research MenuSecurity Enhanced Linux What's New Frequently Asked Questions Background Documents License Download Participating Mail List Archives Remaining Work Contributors Related Work Press Releases Information Assurance Research NIARL In-house Research Areas Mathematical Sciences Program Sabbaticals Computer & Information Sciences Research Technology Transfer Advanced Computing Advanced Mathematics Communications & Networking Information Processing Microelectronics Other Technologies Technology Fact Sheets Publications Related Links |
SELinux Mailing ListRe: Adding two new booleans to httpd to tighten it's security.
From: Tom London <selinux_at_gmail.com>
Date: Tue, 13 Dec 2005 06:46:55 -0800
scontext=root:system_r:unconfined_t:s0-s0:c0.c255 tcontext=root:system_r:unconfined_t:s0-s0:c0.c255 tclass=process type=SYSCALL msg=audit(1134338328.000:56): arch=40000003 syscall=125success=no exit=-13 a0=bfc78000 a1=1000 a2=1000007 a3=98b6e0 items=0 pid=5215 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="ld-linux.so.2" exe="/lib/ld-2.3.90.so"
and
type=AVC_PATH msg=audit(1134335151.660:39): path="/usr/lib/vmware/lib/libgdk-x11-2.0.so.0/libgdk-x11-2.0.so.0" type=SYSCALL msg=audit(1134335151.660:39): arch=40000003 syscall=125 per=400000success=no exit=-13 a0=b7c99000 a1=7b000 a2=5 a3=bfc5a1e0 items=0 pid=4418 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="vmware" exe="/usr/lib/vmware/bin/vmware" type=AVC msg=audit(1134335151.660:39): avc: denied { execmod } for pid=4418 comm="vmware" name="libgdk-x11-2.0.so.0" dev=dm-0 ino=343461 scontext=root:system_r:unconfined_t:s0-s0:c0.c255 tcontext=system_u:object_r:lib_t:s0 tclass=file Reply from VMware on my complaint about execmem issues: As your system refuses to execute even /lib/ld-2.3.90.so (if I understand it correctly), you seems to have some problem... None of VMware parts (at least I believe) require executable stack or heap. Applications which need it explicitly call mmap with PROT_EXEC. Another question is whether libraries we ship are correctly tagged to signal this - but it should not be problem as you can install all libraries VMware needs from your distribution, VMware just ships libraries it was linked with as it is simpler for us to ship you libgdk-whatever than (finding and) explaining that you must to install some-strange-package-with-no-gdk-in-filename to get VMware to work. On "correct" system with all libraries you should be able to run vmware directly by /usr/lib/vmware/bin/vmware. Apparently your system is missing at least openssl097... My understanding from this thread on how execmem works is that calling mmap with PROT_EXEC can (will?) still trigger execmem. Right? Here is the link to the discussion thread: Please hop on to help/clarify! http://www.vmware.com/community/thread.jspa?messageID=320149񎊕 thanks,
tom
-- |
|
Date Posted: Jan 15, 2009 | Last Modified: Jan 15, 2009 | Last Reviewed: Jan 15, 2009 |