[Synfig-devl] [ synfig-Bugs-1742235 ] Failed to run with selinux enabled

[SourceForge.net <no...@so...>]

Bugs item #1742235, was opened at 2007-06-23 21:33
Message generated for change (Comment added) made by rpedroso
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=757416&aid=1742235&group_id=144022

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Binary Installation
Group: SVN version
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Atrus (gmatrus)
Summary: Failed to run with selinux enabled

Initial Comment:
After install the unofficial rpm from http://atrus.mmaa.ru/synfig/
I was unable to run both synfig and synfigstudio on my fc7 with SELinux enforced

the error was:
synfigstudio: error while loading shared libraries: /usr/lib/libsynfig.so.0: cannot restore segment prot after reloc: Permission denied

I solved this issue runnig this command as root:
chcon -c -v -R -u system_u -r object_r -t textrel_shlib_t /usr/lib/libsynfig.so.0

Note: I'm not a SELinux expert so I don't know if this a good solution.


----------------------------------------------------------------------

Comment By: Ricardo Pedroso (rpedroso)
Date: 2007-06-25 00:48

Message:
Logged In: YES 
user_id=1218361
Originator: NO

I've found this two articles:
http://people.redhat.com/drepper/selinux-mem.html
http://people.redhat.com/drepper/textrelocs.html

After read the second one I tried compile synfig with:
./configure --with-pic
./make

than run with:
./src/tool/synfig

it has run ok.

To be sure, I've done the same steps with:
./configure
./make
than:
./src/tool/synfig

I've got the "cannot restore segment prot after reloc: Permission denied"
error in libsynfig.so.0


----------------------------------------------------------------------

Comment By: Ricardo Pedroso (rpedroso)
Date: 2007-06-24 12:57

Message:
Logged In: YES 
user_id=1218361
Originator: NO

Where can I attach the audit.log file?

Ayway, here it's an audit.log excerpt:
type=AVC msg=audit(1182621081.072:105): avc:  denied  { execmod } for 
pid=5210 comm="synfigstudio" name="libsynfig.so.0.0.0" dev=sda3 ino=1615293
scontext=user_u:system_r:unconfined_t:s0
tcontext=system_u:object_r:lib_t:s0 tclass=file
type=SYSCALL msg=audit(1182621081.072:105): arch=40000003 syscall=125
success=no exit=-13 a0=110000 a1=16d000 a2=5 a3=bfbbe6e0 items=0 ppid=6708
pid=5210 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=pts1 comm="synfigstudio" exe="/usr/bin/synfigstudio"
subj=user_u:system_r:unconfined_t:s0 key=(null)
type=AVC_PATH msg=audit(1182621081.072:105): 
path="/usr/lib/libsynfig.so.0.0.0"

----------------------------------------------------------------------

Comment By: Paul Wise (pabs3)
Date: 2007-06-23 23:17

Message:
Logged In: YES 
user_id=35028
Originator: NO

Please provide more info. Audit logs would be especially useful.

----------------------------------------------------------------------

Comment By: Atrus (gmatrus)
Date: 2007-06-23 22:32

Message:
Logged In: YES 
user_id=1627997
Originator: NO

Actually, I'm don't use SELinux at home so this problem is surprise for
me. I'll go to read SELinux documentation to resolve this problem
correctly, but it can take a several time.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=757416&aid=1742235&group_id=144022