A lot of selinux execstack denials in rawhide when starting audio apps

[Martin Sourada]

Hi,

I enabled SELinux for the first time and I got a lot of execstack
denials when starting applications providing audio output (so far I got
it with listen, rhythmbox, totem and gxine). I have new clean install
from latest rawhide live (plus some additional applications). Are these
worth filling bugs or are they false positives? I attach an output from
this denial for listen music player. I didn't do any actions to fix
these denials and the applications seem to work OK. I have SELinux
policy set to enforcing. If you need more info, ask. Not sure whether
this is for test or devel list so CC-ing devel.

Thanks,
Martin

[NZzi]

Martin Sourada wrote:
>  Hi,
>  
>  I enabled SELinux for the first time and I got a lot of execstack
>  denials when starting applications providing audio output (so far I got
>  it with listen, rhythmbox, totem and gxine). I have new clean install
>  from latest rawhide live (plus some additional applications). Are these
>  worth filling bugs or are they false positives? I attach an output from
>  this denial for listen music player. I didn't do any actions to fix
>  these denials and the applications seem to work OK. I have SELinux
>  policy set to enforcing. If you need more info, ask. Not sure whether
>  this is for test or devel list so CC-ing devel. 
do you relabel your file system when enabling selinux from disable to
enforcing?

your label of python is wrong, it should be bin_t

by the way, you should send this kind of mails to fedora-selinux

>  
>  Thanks,
>  Martin
>

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Ken YANG wrote:
>  Martin Sourada wrote:
> > Hi,
> >
> > I enabled SELinux for the first time and I got a lot of execstack
> > denials when starting applications providing audio output (so far I got
> > it with listen, rhythmbox, totem and gxine). I have new clean install
> > from latest rawhide live (plus some additional applications). Are these
> > worth filling bugs or are they false positives? I attach an output from
> > this denial for listen music player. I didn't do any actions to fix
> > these denials and the applications seem to work OK. I have SELinux
> > policy set to enforcing. If you need more info, ask. Not sure whether
> > this is for test or devel list so CC-ing devel.
>  
>  do you relabel your file system when enabling selinux from disable to
>  enforcing?
>  
>  your label of python is wrong, it should be bin_t
>  
>  by the way, you should send this kind of mails to fedora-selinux
>  
> > Thanks,
> > Martin
> >
>   
Yes please file any execstack avc's with the appropriate application,
and cc me.  You can turn off the execstack protections in order to get
the apps working by executing

setsebool -P allow_execstack 1

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.7 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iD8DBQFHChgRrlYvE4MpobMRAvT+AJ9ZKzQjhKIiEVJvJE5Z6hne6z0PrACg2ikv
> vJqcFqcExiCe+v9LlqYeMxU=
> =l8IG
> -----END PGP SIGNATURE-----