firefox and selinux
by Antonio Olivares
Dear all,
I have set settroubleshoot to allow the following:
chcon -t unconfined_execmem_exec_t
'/usr/lib/firefox-3.0b4pre/firefox'
But it is happening again, I do not understand why I
need to do it multiple of times. I see a pattern
occuring: I have filed a bug report against
firefox-b3
https://bugzilla.redhat.com/show_bug.cgi?id=432198
I hope that firefox and selinux start to work together
and not against each other. :)
Summary:
SELinux is preventing firefox from making the program
stack executable.
Detailed Description:
The firefox application attempted to make its stack
executable. This is a
potential security problem. This should never ever be
necessary. Stack memory is
not executable on most OSes these days and this will
not change. Executable
stack memory is one of the biggest security problems.
An execstack error might
in fact be most likely raised by malicious code.
Applications are sometimes
coded incorrectly and request this permission. The
SELinux Memory Protection
Tests
(http://people.redhat.com/drepper/selinux-mem.html)
web page explains how
to remove this requirement. If firefox does not work
and you need it to work,
you can configure SELinux temporarily to allow this
access until the application
is fixed. Please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Allowing Access:
Sometimes a library is accidentally marked with the
execstack flag, if you find
a library with this flag you can clear it with the
execstack -c LIBRARY_PATH.
Then retry your application. If the app continues to
not work, you can turn the
flag back on with execstack -s LIBRARY_PATH.
Otherwise, if you trust firefox to
run correctly, you can change the context of the
executable to
unconfined_execmem_exec_t. "chcon -t
unconfined_execmem_exec_t
'/usr/lib/firefox-3.0b4pre/firefox'" You must also
change the default file
context files on the system in order to preserve them
even on a full relabel.
"semanage fcontext -a -t unconfined_execmem_exec_t
'/usr/lib/firefox-3.0b4pre/firefox'"
The following command will allow this access:
chcon -t unconfined_execmem_exec_t
'/usr/lib/firefox-3.0b4pre/firefox'
Additional Information:
Source Context
unconfined_u:unconfined_r:unconfined_t:SystemLow-
SystemHigh
Target Context
unconfined_u:unconfined_r:unconfined_t:SystemLow-
SystemHigh
Target Objects None [ process ]
Source firefox
Source Path
/usr/lib/firefox-3.0b3pre/firefox
Port <Unknown>
Host localhost
Source RPM Packages
firefox-3.0-0.beta2.16.nightly20080206.fc9
Target RPM Packages
Policy RPM
selinux-policy-3.2.7-1.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name allow_execstack
Host Name localhost
Platform Linux localhost
2.6.24-23.fc9 #1 SMP Wed Feb 6
11:36:31 EST 2008 i686
athlon
Alert Count 11
First Seen Fri 01 Feb 2008 05:08:54
PM CST
Last Seen Sat 09 Feb 2008 12:35:06
PM CST
Local ID
c4806f30-a6dc-43b0-8901-5531075795f7
Line Numbers
Raw Audit Messages
host=localhost type=AVC msg=audit(1202582106.621:28):
avc: denied { execstack } for pid=9246
comm="firefox"
scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tclass=process
host=localhost type=SYSCALL
msg=audit(1202582106.621:28): arch=40000003
syscall=125 success=no exit=-13 a0=bfa71000 a1=1000
a2=1000007 a3=fffff000 items=0 ppid=9232 pid=9246
auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500
egid=500 sgid=500 fsgid=500 tty=(none) comm="firefox"
exe="/usr/lib/firefox-3.0b4pre/firefox"
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
key=(null)
Regards,
Antonio
____________________________________________________________________________________
Never miss a thing. Make Yahoo your home page.
http://www.yahoo.com/r/hs
16 years, 2 months
SELinux is preventing ck-history (xdm_t) "search" to ./ConsoleKit (consolekit_var_run_t).
by Antonio Olivares
Dear all,
Setroubleshoot showed me the following:
Should I disregard them, or is ConsoleKit important to
the system.
Summary:
SELinux is preventing ck-history (xdm_t) "search" to
./ConsoleKit
(consolekit_var_run_t).
Detailed Description:
SELinux denied access requested by ck-history. It is
not expected that this
access is required by ck-history and this access may
signal an intrusion
attempt. It is also possible that the specific version
or configuration of the
application is causing it to require additional
access.
Allowing Access:
Sometimes labeling problems can cause SELinux denials.
You could try to restore
the default system file context for ./ConsoleKit,
restorecon -v './ConsoleKit'
If this does not work, there is currently no automatic
way to allow this access.
Instead, you can generate a local policy module to
allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385)
Or you can disable
SELinux protection altogether. Disabling SELinux
protection is not recommended.
Please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context
system_u:system_r:xdm_t:SystemLow-SystemHigh
Target Context
system_u:object_r:consolekit_var_run_t
Target Objects ./ConsoleKit [ dir ]
Source ck-history
Source Path /usr/bin/ck-history
Port <Unknown>
Host localhost
Source RPM Packages ConsoleKit-0.2.7-1.fc9
Target RPM Packages
Policy RPM
selinux-policy-3.2.7-1.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall_file
Host Name localhost
Platform Linux localhost
2.6.24.1-28.fc9 #1 SMP Sun Feb 10
17:27:37 EST 2008 i686
athlon
Alert Count 12
First Seen Mon 11 Feb 2008 07:05:42
AM CST
Last Seen Mon 11 Feb 2008 02:35:06
PM CST
Local ID
3cef7e4a-b1dc-4c27-83e3-91eccbb14047
Line Numbers
Raw Audit Messages
host=localhost type=AVC msg=audit(1202762106.60:13):
avc: denied { search } for pid=2469
comm="ck-history" name="ConsoleKit" dev=dm-0
ino=3342348
scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023
tcontext=system_u:object_r:consolekit_var_run_t:s0
tclass=dir
host=localhost type=SYSCALL
msg=audit(1202762106.60:13): arch=40000003 syscall=5
success=no exit=-13 a0=8fd3608 a1=0 a2=1b6 a3=0
items=0 ppid=1 pid=2469 auid=4294967295 uid=42 gid=42
euid=42 suid=42 fsuid=42 egid=42 sgid=42 fsgid=42
tty=(none) comm="ck-history" exe="/usr/bin/ck-history"
subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
TIA,
Antonio
____________________________________________________________________________________
Never miss a thing. Make Yahoo your home page.
http://www.yahoo.com/r/hs
16 years, 2 months
selinux now causing trouble with seamonkey
by Antonio Olivares
Dear all,
In addition to the bug filed
https://bugzilla.redhat.com/show_bug.cgi?id=432198
selinux now is causing trouble with seamonkey.
I deleted the ~/.mozilla/ directory and started from
scratch. So the argument about the plugins will not
work now :)
Am I the only one seeing this?
I feel kind of bad about complaining that selinux is
doing this, but it did not happen before and now it
does, both with firefox and with seamonkey.
Here's the message
Summary:
SELinux is preventing seamonkey-bin from making the
program stack executable.
Detailed Description:
The seamonkey-bin application attempted to make its
stack executable. This is a
potential security problem. This should never ever be
necessary. Stack memory is
not executable on most OSes these days and this will
not change. Executable
stack memory is one of the biggest security problems.
An execstack error might
in fact be most likely raised by malicious code.
Applications are sometimes
coded incorrectly and request this permission. The
SELinux Memory Protection
Tests
(http://people.redhat.com/drepper/selinux-mem.html)
web page explains how
to remove this requirement. If seamonkey-bin does not
work and you need it to
work, you can configure SELinux temporarily to allow
this access until the
application is fixed. Please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Allowing Access:
Sometimes a library is accidentally marked with the
execstack flag, if you find
a library with this flag you can clear it with the
execstack -c LIBRARY_PATH.
Then retry your application. If the app continues to
not work, you can turn the
flag back on with execstack -s LIBRARY_PATH.
Otherwise, if you trust
seamonkey-bin to run correctly, you can change the
context of the executable to
unconfined_execmem_exec_t. "chcon -t
unconfined_execmem_exec_t
'/usr/lib/seamonkey-1.1.8/seamonkey-bin'" You must
also change the default file
context files on the system in order to preserve them
even on a full relabel.
"semanage fcontext -a -t unconfined_execmem_exec_t
'/usr/lib/seamonkey-1.1.8/seamonkey-bin'"
The following command will allow this access:
chcon -t unconfined_execmem_exec_t
'/usr/lib/seamonkey-1.1.8/seamonkey-bin'
Additional Information:
Source Context
unconfined_u:unconfined_r:unconfined_t:SystemLow-
SystemHigh
Target Context
unconfined_u:unconfined_r:unconfined_t:SystemLow-
SystemHigh
Target Objects None [ process ]
Source firefox
Source Path
/usr/lib/firefox-3.0b3pre/firefox
Port <Unknown>
Host localhost
Source RPM Packages seamonkey-1.1.8-3.fc9
Target RPM Packages
Policy RPM
selinux-policy-3.2.7-1.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name allow_execstack
Host Name localhost
Platform Linux localhost
2.6.24.1-28.fc9 #1 SMP Sun Feb 10
17:27:37 EST 2008 i686
athlon
Alert Count 33
First Seen Fri 01 Feb 2008 05:08:54
PM CST
Last Seen Mon 11 Feb 2008 06:39:47
PM CST
Local ID
c4806f30-a6dc-43b0-8901-5531075795f7
Line Numbers
Raw Audit Messages
host=localhost type=AVC msg=audit(1202776787.936:31):
avc: denied { execstack } for pid=3481
comm="seamonkey-bin"
scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tclass=process
host=localhost type=SYSCALL
msg=audit(1202776787.936:31): arch=40000003
syscall=125 success=no exit=-13 a0=bff2d000 a1=1000
a2=1000007 a3=fffff000 items=0 ppid=1 pid=3481
auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500
egid=500 sgid=500 fsgid=500 tty=(none)
comm="seamonkey-bin"
exe="/usr/lib/seamonkey-1.1.8/seamonkey-bin"
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
key=(null)
____________________________________________________________________________________
Be a better friend, newshound, and
know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ
16 years, 2 months
More consolekit_t and dbus_t AVCs (from today's Rawhide)
by Tom London
After doing today's rawhide thing, get this on targeted/enforcing boot/login:
#============= system_dbusd_t ==============
allow system_dbusd_t NetworkManager_t:dbus send_msg;
allow system_dbusd_t unconfined_t:dbus send_msg;
#============= xdm_t ==============
allow xdm_t consolekit_var_run_t:dir search;
[copy of /var/log/audit/audit.log attached.]
tom
--
Tom London
16 years, 2 months
host certificates & keys
by "Stanisław T. Findeisen"
Hello
Are there any standard ways to add certificate and private key files to
services like Postfix (SMTP) or Dovecot (POP3/IMAP) to enable them use TLS?
STF
16 years, 2 months
selinux/setroubleshoot reports trouble with nspluginscan, NetworkManager_t
by Antonio Olivares
Dear all,
Upon applying todays updates rawhide report 20080205,
and the failed update/conflicts
\begin{QUOTE}
xorg-x11-xinit-1.0.7-3.fc9.i386 from development has
depsolving problems
--> xorg-x11-xinit-1.0.7-3.fc9.i386 (development)
conflicts with dbus < 1.1
.4-3.fc9
Error: xorg-x11-xinit-1.0.7-3.fc9.i386 (development)
conflicts with dbus < 1.
1.4-3.fc9
\end{QUOTE}
I get two denials from selinux
Summary:
SELinux is preventing nspluginscan from making the
program stack executable.
Detailed Description:
The nspluginscan application attempted to make its
stack executable. This is a
potential security problem. This should never ever be
necessary. Stack memory is
not executable on most OSes these days and this will
not change. Executable
stack memory is one of the biggest security problems.
An execstack error might
in fact be most likely raised by malicious code.
Applications are sometimes
coded incorrectly and request this permission. The
SELinux Memory Protection
Tests
(http://people.redhat.com/drepper/selinux-mem.html)
web page explains how
to remove this requirement. If nspluginscan does not
work and you need it to
work, you can configure SELinux temporarily to allow
this access until the
application is fixed. Please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Allowing Access:
Sometimes a library is accidentally marked with the
execstack flag, if you find
a library with this flag you can clear it with the
execstack -c LIBRARY_PATH.
Then retry your application. If the app continues to
not work, you can turn the
flag back on with execstack -s LIBRARY_PATH.
Otherwise, if you trust
nspluginscan to run correctly, you can change the
context of the executable to
unconfined_execmem_exec_t. "chcon -t
unconfined_execmem_exec_t
'/usr/bin/nspluginscan'" You must also change the
default file context files on
the system in order to preserve them even on a full
relabel. "semanage fcontext
-a -t unconfined_execmem_exec_t
'/usr/bin/nspluginscan'"
The following command will allow this access:
chcon -t unconfined_execmem_exec_t
'/usr/bin/nspluginscan'
Additional Information:
Source Context
unconfined_u:unconfined_r:unconfined_t:SystemLow-
SystemHigh
Target Context
unconfined_u:unconfined_r:unconfined_t:SystemLow-
SystemHigh
Target Objects None [ process ]
Source nspluginscan
Source Path /usr/bin/nspluginscan
Port <Unknown>
Host localhost.localdomain
Source RPM Packages kdebase-4.0.1-3.fc9
Target RPM Packages
Policy RPM
selinux-policy-3.2.6-5.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name allow_execstack
Host Name localhost.localdomain
Platform Linux
localhost.localdomain 2.6.24-17.fc9 #1 SMP
Mon Feb 4 19:02:27 EST
2008 i686 i686
Alert Count 2
First Seen Tue 05 Feb 2008 07:13:02
AM CST
Last Seen Tue 05 Feb 2008 07:41:42
PM CST
Local ID
7afb3a36-5b69-486c-a93b-02e714040250
Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC
msg=audit(1202262102.930:20): avc: denied {
execstack } for pid=2866 comm="nspluginscan"
scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tclass=process
host=localhost.localdomain type=SYSCALL
msg=audit(1202262102.930:20): arch=40000003
syscall=125 success=no exit=-13 a0=bfce4000 a1=1000
a2=1000007 a3=fffff000 items=0 ppid=2855 pid=2866
auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500
egid=500 sgid=500 fsgid=500 tty=(none)
comm="nspluginscan" exe="/usr/bin/nspluginscan"
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
key=(null)
Summary:
SELinux is preventing the 00-netreport
(NetworkManager_t) from executing ./init.
Detailed Description:
SELinux has denied the 00-netreport from executing
./init. If 00-netreport is
supposed to be able to execute ./init, this could be a
labeling problem. Most
confined domains are allowed to execute files labeled
bin_t. So you could change
the labeling on this file to bin_t and retry the
application. If this
00-netreport is not supposed to execute ./init, this
could signal a intrusion
attempt.
Allowing Access:
If you want to allow 00-netreport to execute ./init:
chcon -t bin_t './init' If
this fix works, please update the file context on
disk, with the following
command: semanage fcontext -a -t bin_t './init' Please
specify the full path to
the executable, Please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this selinux-policy
to make sure this becomes the default labeling.
Additional Information:
Source Context
system_u:system_r:NetworkManager_t
Target Context system_u:object_r:etc_t
Target Objects ./init [ file ]
Source 00-netreport
Source Path /bin/bash
Port <Unknown>
Host localhost.localdomain
Source RPM Packages bash-3.2-20.fc9
Target RPM Packages
Policy RPM
selinux-policy-3.2.6-5.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name execute
Host Name localhost.localdomain
Platform Linux
localhost.localdomain 2.6.24-17.fc9 #1 SMP
Mon Feb 4 19:02:27 EST
2008 i686 i686
Alert Count 1
First Seen Tue 05 Feb 2008 07:42:33
PM CST
Last Seen Tue 05 Feb 2008 07:42:33
PM CST
Local ID
9a1f71bd-9256-450a-bc0c-a7ebb115cacb
Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC
msg=audit(1202262153.640:107): avc: denied { execute
} for pid=3226 comm="00-netreport" name="init"
dev=dm-0 ino=360497
scontext=system_u:system_r:NetworkManager_t:s0
tcontext=system_u:object_r:etc_t:s0 tclass=file
host=localhost.localdomain type=SYSCALL
msg=audit(1202262153.640:107): arch=40000003
syscall=33 success=no exit=-13 a0=9f7a370 a1=1 a2=11
a3=9f7a370 items=0 ppid=2385 pid=3226 auid=4294967295
uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=(none) comm="00-netreport" exe="/bin/bash"
subj=system_u:system_r:NetworkManager_t:s0 key=(null)
Thanks,
Antonio
____________________________________________________________________________________
Never miss a thing. Make Yahoo your home page.
http://www.yahoo.com/r/hs
16 years, 2 months
postgresql with httpd and dotclear
by Nicolas Chauvet
Hello !
I try to use apache and postgresql with the dotclear blog engine.
When I try to enter the database information from the admin config
wizard within the browser, have a selinux denial :
audit(1202182131.382:34): avc: denied { name_connect } for pid=2604
comm="httpd" dest=5432 scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:object_r:postgresql_port_t:s0 tclass=tcp_socket
[root@haderach ~]# ls -Z /home/www/
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 dotclear
[root@haderach ~]# rpm -q sepostgresql
sepostgresql-8.2.6-1.158.fc8
selinux-policy-3.0.8-81.fc8
selinux-policy-targeted-3.0.8-81.fc8
[root@haderach data]# semodule -l |grep postgre
sepostgresql 1.158
On the other hand, when i try to use phpPgAdmin, it works. But i need to
change: /var/lib/pgsql/data/pg_hba.conf from ident sameuser to
md5.(tryed the same for dotclear without sucess).
Also, from: http://code.google.com/p/sepgsql/wiki/install_memo_Fedora7
As i'm using F-8, i expect not to need the additional recompiled
selinux-policy-2.6.4-38.sepgsql.fc7.noarch.rpm. (don't know if current
F-7 users will still need it?) - At least the .sepsql doen't fit the
same version number
Any tips for this ?
Nicolas (kwizart)
16 years, 2 months
Re: Fedora 8 odds and sods
by Paul Howarth
On Thu, 17 Jan 2008 12:51:33 -0500
Daniel J Walsh <dwalsh(a)redhat.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Paul Howarth wrote:
> > Today I've done a bit of a clean-up of the local policy modules
> > I've had in use over the last couple of Fedora releases, removing
> > bits that are no longer needed and consolidating the remaining ones
> > into a single "localmisc" module. The results of this is:
> >
> > policy_module(localmisc, 0.1.34)
> >
> > require {
> > attribute mailserver_delivery;
> > type depmod_t;
> > type httpd_t;
> > type load_policy_t;
> > type procmail_t;
> > type procmail_tmp_t;
> > type pptp_t;
> > type restorecon_t;
> > type sendmail_t;
> > type setfiles_t;
> > type soundd_port_t;
> > type squid_t;
> > type useradd_t;
> > type var_t;
> > };
> >
> > # ========================================
> > # Things that probably need to go upstream
> > # ========================================
> >
> > # Milter sockets, why did this work before?
> > #allow sendmail_t initrc_t:unix_stream_socket { read write
> > connectto }; init_stream_connect_script(mailserver_delivery)
> > init_rw_script_stream_sockets(mailserver_delivery)
> >
> Already added.
> > # Allow misc command output to be sent to a pipe, needed for rpm
> > scriptlets # Probably not needed since Fedora 8
> > #unconfined_rw_pipes(depmod_t)
> > #unconfined_rw_pipes(load_policy_t)
> > #unconfined_rw_pipes(setfiles_t)
> > #unconfined_rw_pipes(useradd_t)
> >
> > # Allow pptp to manage its own processes
> > allow pptp_t self:process signal;
> >
> Added.
> > # Allow sendmail to read procmail tempfiles for forwarding
> > # (would need a new interface in procmail.if to do this properly)
> > allow sendmail_t procmail_tmp_t:file { read write getattr ioctl };
> >
> Added
Policy now has procmail_read_tmp_files(sendmail_t) but this doesn't
allow write access by sendmail. Sendmail needs to write into
procmail_tmp_t when a procmail recipe pipes a message into a filter and
that filter creates a temp file I believe.
I'm getting the AVCs anyway:
type=AVC msg=audit(1202162399.034:320138): avc: denied { write } for
pid=16452 comm="sendmail" path="/tmp/choplist.16383" dev=dm-1 ino=13
scontext=system_u:system_r:sendmail_t:s0
tcontext=system_u:object_r:procmail_tmp_t:s0 tclass=file type=SYSCALL
msg=audit(1202162399.034:320138): arch=40000003 syscall=11 success=yes
exit=0 a0=bf8febff a1=84ffe44 a2=bf8fe3a4 a3=84ffe44 items=0 ppid=16384
pid=16452 auid=0 uid=502 gid=502 euid=502 suid=502 fsuid=502 egid=51
sgid=51 fsgid=51 tty=(none) comm="sendmail"
exe="/usr/sbin/sendmail.sendmail" subj=system_u:system_r:sendmail_t:s0
key=(null) type=AVC msg=audit(1202162401.083:320139): avc: denied
{ write } for pid=16453 comm="sendmail"
path=2F746D702F63686F706C6973742E3136333833202864656C6574656429
dev=dm-1 ino=13 scontext=system_u:system_r:sendmail_t:s0
tcontext=system_u:object_r:procmail_tmp_t:s0 tclass=file
Paul.
16 years, 2 months
semanage segmentation fault? (awstats)
by "Stanisław T. Findeisen"
Look I tried to intall awstats-6.6-1.fc7.noarch.rpm from Fedora release
on Fedora 7 64-bit and got segmentation fault in semanage I think.
First I tried this:
[root@srv-1 download]# rpm --install ./awstats-6.6-1.fc7.noarch.rpm
/var/tmp/rpm-tmp.71040: line 12: 3964 Segmentation fault semanage
fcontext -a -t httpd_sys_script_exec_t
'/usr/share/awstats/wwwroot/cgi-bin(/.*)?' 2> /dev/null
/var/tmp/rpm-tmp.71040: line 13: 3965 Segmentation fault semanage
fcontext -a -t httpd_sys_script_rw_t '/var/lib/awstats(/.*)?' 2> /dev/null
Then I realised I have HTTP server on, so I thought I will turn it off
and try again (on the way I had to erase the RPM because it was
considered "installed").
Then this happened:
[root@srv-1 download]# rpm --install ./awstats-6.6-1.fc7.noarch.rpm
/var/tmp/rpm-tmp.21042: line 12: 3995 Segmentation fault semanage
fcontext -a -t httpd_sys_script_exec_t
'/usr/share/awstats/wwwroot/cgi-bin(/.*)?' 2> /dev/null
/var/tmp/rpm-tmp.21042: line 13: 3996 Segmentation fault semanage
fcontext -a -t httpd_sys_script_rw_t '/var/lib/awstats(/.*)?' 2> /dev/null
I do not know what /var/tmp/rpm-tmp.* is, but I suppose that is an RPM
install script or something which comes with RPM (right?). After these 2
steps the /var/tmp directory was empty so I couldn't examine that file.
After that I downloaded awstats-6.7-2.fc7.noarch.rpm from Fedora updates
and it installed fine (although I haven't tested it yet).
I have also found this in /var/log/messages:
Feb 5 15:53:44 srv-1 kernel: semanage[3964]: segfault at
0000000000000000 rip 00002b610d7e9b49 rsp 00007fffa20be6b0 error 4
Feb 5 15:53:44 srv-1 kernel: semanage[3965]: segfault at
0000000000000000 rip 00002b2754535b49 rsp 00007fff5b3744b0 error 4
Feb 5 15:56:33 srv-1 kernel: semanage[3995]: segfault at
0000000000000000 rip 00002b0a226c9b49 rsp 00007fff8d1e0300 error 4
Feb 5 15:56:33 srv-1 kernel: semanage[3996]: segfault at
0000000000000000 rip 00002b0feea21b49 rsp 00007fffc0e86fc0 error 4
What do you think guys?
STF
16 years, 2 months
