fedora-selinux-list-request@redhat.com wrote:
Subject: Error running ffmpeg due to permission denied on library From: "Robert Foster" rfoster@mountainvisions.com.au Date: Thu, 27 Apr 2006 12:41:09 +1000 To: fedora-selinux-list@redhat.com
To: fedora-selinux-list@redhat.com
Hi, I'm trying to get ffmpeg working for Gallery2 on FC5, and getting the following error (from the debug message via Gallery):
Executing: ( "/usr/bin/ffmpeg" "-h" ) 2>/MV/webs/Repository/gallery/tmp/g2dbgitTQYC file_exists(/MV/webs/Repository/gallery/tmp/g2dbgitTQYC) filesize(/MV/webs/Repository/gallery/tmp/g2dbgitTQYC) fopen(/MV/webs/Repository/gallery/tmp/g2dbgitTQYC, r, 0) feof(Resource id #108) fgets(Resource id #108, 4096) feof(Resource id #108) fgets(Resource id #108, 4096) feof(Resource id #108) fclose(Resource id #108) unlink(/MV/webs/Repository/gallery/tmp/g2dbgitTQYC) Regular Output: Error Output: /usr/bin/ffmpeg: error while loading shared libraries: libavcodec.so.51: cannot enable executable stack as shared object requires: Permission denied Status: 127 (expected 0) A quick look in /usr/lib reveals:
-rwxr-xr-x root root system_u:object_r:textrel_shlib_t /usr/lib/libavcodec-CVS.so lrwxrwxrwx root root system_u:object_r:lib_t /usr/lib/libavcodec.so -> libavcodec-CVS.so lrwxrwxrwx root root system_u:object_r:lib_t /usr/lib/libavcodec.so.51 -> libavcodec-CVS.so
/var/log/audit/audit.log shows:
type=SYSCALL msg=audit(1146010953.133:45163): arch=40000003 syscall=125 success=no exit=-13 a0=bfc5b000 a1=1000 a2=1000007 a3=fffff000 items=0 pid=25005 auid=1000 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 comm="ffmpeg" exe="/usr/bin/ffmpeg" type=AVC msg=audit(1146010953.141:45164): avc: denied { execstack } for pid=25007 comm="ffmpeg" scontext=user_u:system_r:httpd_sys_script_t:s0 tcontext=user_u:system_r:httpd_sys_script_t:s0 tclass=process type=SYSCALL msg=audit(1146010953.141:45164): arch=40000003 syscall=125 success=no exit=-13 a0=bf9e8000 a1=1000 a2=1000007 a3=fffff000 items=0 pid=25007 auid=1000 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 comm="ffmpeg" exe="/usr/bin/ffmpeg" type=AVC msg=audit(1146010953.213:45165): avc: denied { execstack } for pid=25009 comm="ffmpeg" scontext=user_u:system_r:httpd_sys_script_t:s0 tcontext=user_u:system_r:httpd_sys_script_t:s0 tclass=process type=SYSCALL msg=audit(1146010953.213:45165): arch=40000003 syscall=125 success=no exit=-13 a0=bfbe6000 a1=1000 a2=1000007 a3=fffff000 items=0 pid=25009 auid=1000 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 comm="ffmpeg" exe="/usr/bin/ffmpeg" type=AVC msg=audit(1146010953.221:45166): avc: denied { execstack } for pid=25011 comm="ffmpeg" scontext=user_u:system_r:httpd_sys_script_t:s0 tcontext=user_u:system_r:httpd_sys_script_t:s0 tclass=process type=SYSCALL msg=audit(1146010953.221:45166): arch=40000003 syscall=125 success=no exit=-13 a0=bf89b000 a1=1000 a2=1000007 a3=fffff000 items=0 pid=25011 auid=1000 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 comm="ffmpeg" exe="/usr/bin/ffmpeg" when I run the page producing the error output.
I tried to set the allow_execstack boolean but it didn't make any difference.
I'm out of ideas on this one - any help appreciated :)
Robert Foster General Manager Mountain Visions P/L http://mountainvisions.com.au http://mountainvisions.com.au/ Mobile: 0418 131 065
I had the same problem when using Kino which also uses ffmpeg. Here is what I did and it works.
execstack -c /usr/lib/libmp3lame.so.0 execstack -c /usr/lib/libxvidcore.so.4 chcon -t textrel_shlib_t /usr/lib/libavformat.so.50
chcon -t textrel_shlib_t /usr/lib/libavutil.so.49 chcon -t textrel_shlib_t /usr/lib/libavcodec.so.51
This also takes care of the problem with lame-3.96.1-10.rhfc5.at, libxvidcore4-1.1.0-8.rhfc5.at, libavformat50-0.4.9-14_cvs20060301.rhfc5.at, libavutil49-0.4.9-14_cvs20060301.rhfc5.at, and libavcodec51-0.4.9-14_cvs20060301.rhfc5.at.
Regards, John
Hi John, Thanks for that, executing
#execstack -c /usr/lib/libavcodec.so.51.8.0 Did the trick.
Robert Foster
-----Original Message----- From: fedora-selinux-list-bounces@redhat.com [mailto:fedora-selinux-list-bounces@redhat.com] On Behalf Of John Griffiths Sent: Friday, 28 April 2006 2:47 AM To: fedora-selinux-list@redhat.com Subject: Re: fedora-selinux-list Digest, Vol 26, Issue 32
<snip> </snip> I had the same problem when using Kino which also uses ffmpeg. Here is what I did and it works.
execstack -c /usr/lib/libmp3lame.so.0 execstack -c /usr/lib/libxvidcore.so.4 chcon -t textrel_shlib_t /usr/lib/libavformat.so.50
chcon -t textrel_shlib_t /usr/lib/libavutil.so.49 chcon -t textrel_shlib_t /usr/lib/libavcodec.so.51
This also takes care of the problem with lame-3.96.1-10.rhfc5.at, libxvidcore4-1.1.0-8.rhfc5.at, libavformat50-0.4.9-14_cvs20060301.rhfc5.at, libavutil49-0.4.9-14_cvs20060301.rhfc5.at, and libavcodec51-0.4.9-14_cvs20060301.rhfc5.at.
Regards, John
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
John Griffiths wrote:
fedora-selinux-list-request@redhat.com wrote:
Subject: Error running ffmpeg due to permission denied on library From: "Robert Foster" rfoster@mountainvisions.com.au Date: Thu, 27 Apr 2006 12:41:09 +1000 To: fedora-selinux-list@redhat.com
To: fedora-selinux-list@redhat.com
Hi, I'm trying to get ffmpeg working for Gallery2 on FC5, and getting the following error (from the debug message via Gallery):
Executing: ( "/usr/bin/ffmpeg" "-h" ) 2>/MV/webs/Repository/gallery/tmp/g2dbgitTQYC file_exists(/MV/webs/Repository/gallery/tmp/g2dbgitTQYC) filesize(/MV/webs/Repository/gallery/tmp/g2dbgitTQYC) fopen(/MV/webs/Repository/gallery/tmp/g2dbgitTQYC, r, 0) feof(Resource id #108) fgets(Resource id #108, 4096) feof(Resource id #108) fgets(Resource id #108, 4096) feof(Resource id #108) fclose(Resource id #108) unlink(/MV/webs/Repository/gallery/tmp/g2dbgitTQYC) Regular Output: Error Output: /usr/bin/ffmpeg: error while loading shared libraries: libavcodec.so.51: cannot enable executable stack as shared object requires: Permission denied Status: 127 (expected 0) A quick look in /usr/lib reveals:
-rwxr-xr-x root root system_u:object_r:textrel_shlib_t /usr/lib/libavcodec-CVS.so lrwxrwxrwx root root system_u:object_r:lib_t /usr/lib/libavcodec.so -> libavcodec-CVS.so lrwxrwxrwx root root system_u:object_r:lib_t /usr/lib/libavcodec.so.51 -> libavcodec-CVS.so
/var/log/audit/audit.log shows:
type=SYSCALL msg=audit(1146010953.133:45163): arch=40000003 syscall=125 success=no exit=-13 a0=bfc5b000 a1=1000 a2=1000007 a3=fffff000 items=0 pid=25005 auid=1000 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 comm="ffmpeg" exe="/usr/bin/ffmpeg" type=AVC msg=audit(1146010953.141:45164): avc: denied { execstack } for pid=25007 comm="ffmpeg" scontext=user_u:system_r:httpd_sys_script_t:s0 tcontext=user_u:system_r:httpd_sys_script_t:s0 tclass=process type=SYSCALL msg=audit(1146010953.141:45164): arch=40000003 syscall=125 success=no exit=-13 a0=bf9e8000 a1=1000 a2=1000007 a3=fffff000 items=0 pid=25007 auid=1000 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 comm="ffmpeg" exe="/usr/bin/ffmpeg" type=AVC msg=audit(1146010953.213:45165): avc: denied { execstack } for pid=25009 comm="ffmpeg" scontext=user_u:system_r:httpd_sys_script_t:s0 tcontext=user_u:system_r:httpd_sys_script_t:s0 tclass=process type=SYSCALL msg=audit(1146010953.213:45165): arch=40000003 syscall=125 success=no exit=-13 a0=bfbe6000 a1=1000 a2=1000007 a3=fffff000 items=0 pid=25009 auid=1000 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 comm="ffmpeg" exe="/usr/bin/ffmpeg" type=AVC msg=audit(1146010953.221:45166): avc: denied { execstack } for pid=25011 comm="ffmpeg" scontext=user_u:system_r:httpd_sys_script_t:s0 tcontext=user_u:system_r:httpd_sys_script_t:s0 tclass=process type=SYSCALL msg=audit(1146010953.221:45166): arch=40000003 syscall=125 success=no exit=-13 a0=bf89b000 a1=1000 a2=1000007 a3=fffff000 items=0 pid=25011 auid=1000 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 comm="ffmpeg" exe="/usr/bin/ffmpeg" when I run the page producing the error output.
I tried to set the allow_execstack boolean but it didn't make any difference.
I'm out of ideas on this one - any help appreciated :)
Robert Foster General Manager Mountain Visions P/L http://mountainvisions.com.au http://mountainvisions.com.au/ Mobile: 0418 131 065
I had the same problem when using Kino which also uses ffmpeg. Here is what I did and it works.
execstack -c /usr/lib/libmp3lame.so.0 execstack -c /usr/lib/libxvidcore.so.4
Please submit bugs on these to Kino and ffmpeg.
chcon -t textrel_shlib_t /usr/lib/libavformat.so.50
chcon -t textrel_shlib_t /usr/lib/libavutil.so.49 chcon -t textrel_shlib_t /usr/lib/libavcodec.so.51
This also takes care of the problem with lame-3.96.1-10.rhfc5.at, libxvidcore4-1.1.0-8.rhfc5.at, libavformat50-0.4.9-14_cvs20060301.rhfc5.at, libavutil49-0.4.9-14_cvs20060301.rhfc5.at, and libavcodec51-0.4.9-14_cvs20060301.rhfc5.at.
Regards, John
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
Daniel J Walsh wrote:
John Griffiths wrote:
fedora-selinux-list-request@redhat.com wrote:
Subject: Error running ffmpeg due to permission denied on library From: "Robert Foster" rfoster@mountainvisions.com.au Date: Thu, 27 Apr 2006 12:41:09 +1000 To: fedora-selinux-list@redhat.com
To: fedora-selinux-list@redhat.com
Hi, I'm trying to get ffmpeg working for Gallery2 on FC5, and getting the following error (from the debug message via Gallery):
snip
I had the same problem when using Kino which also uses ffmpeg. Here is what I did and it works.
execstack -c /usr/lib/libmp3lame.so.0 execstack -c /usr/lib/libxvidcore.so.4
Please submit bugs on these to Kino and ffmpeg.
Actually /usr/lib/libmp3lame.so.0 is part of lame-3.96.1-10.rhfc5.at and libxvidcore4-1.1.0-8.rhfc5.at both from ATRpms.net.
I'll let the people at ATRpm know.
OT: Wish I had changed the subject of the reply in my original. Sorry.
Regards, John
On Tue, May 02, 2006 at 02:07:37PM -0400, John Griffiths wrote:
Daniel J Walsh wrote:
John Griffiths wrote:
fedora-selinux-list-request@redhat.com wrote:
Subject: Error running ffmpeg due to permission denied on library From: "Robert Foster" rfoster@mountainvisions.com.au Date: Thu, 27 Apr 2006 12:41:09 +1000 To: fedora-selinux-list@redhat.com
To: fedora-selinux-list@redhat.com
Hi, I'm trying to get ffmpeg working for Gallery2 on FC5, and getting the following error (from the debug message via Gallery):
snip
I had the same problem when using Kino which also uses ffmpeg. Here is what I did and it works.
execstack -c /usr/lib/libmp3lame.so.0 execstack -c /usr/lib/libxvidcore.so.4
Please submit bugs on these to Kino and ffmpeg.
Actually /usr/lib/libmp3lame.so.0 is part of lame-3.96.1-10.rhfc5.at and libxvidcore4-1.1.0-8.rhfc5.at both from ATRpms.net.
I'll let the people at ATRpm know.
Is this considered a packaging or upstream issue?
If packaging: What is the recommended way to fix it specfile-wise?
Axel Thimm wrote:
On Tue, May 02, 2006 at 02:07:37PM -0400, John Griffiths wrote:
Daniel J Walsh wrote:
John Griffiths wrote:
fedora-selinux-list-request@redhat.com wrote:
Subject: Error running ffmpeg due to permission denied on library From: "Robert Foster" rfoster@mountainvisions.com.au Date: Thu, 27 Apr 2006 12:41:09 +1000 To: fedora-selinux-list@redhat.com
To: fedora-selinux-list@redhat.com
Hi, I'm trying to get ffmpeg working for Gallery2 on FC5, and getting the following error (from the debug message via Gallery):
snip
I had the same problem when using Kino which also uses ffmpeg. Here is what I did and it works.
execstack -c /usr/lib/libmp3lame.so.0 execstack -c /usr/lib/libxvidcore.so.4
Please submit bugs on these to Kino and ffmpeg.
Actually /usr/lib/libmp3lame.so.0 is part of lame-3.96.1-10.rhfc5.at and libxvidcore4-1.1.0-8.rhfc5.at both from ATRpms.net.
I'll let the people at ATRpm know.
Is this considered a packaging or upstream issue?
If packaging: What is the recommended way to fix it specfile-wise?
From this, I find the folks at ATRpms know.
On Tue, May 02, 2006 at 02:27:24PM -0400, John Griffiths wrote:
Axel Thimm wrote:
On Tue, May 02, 2006 at 02:07:37PM -0400, John Griffiths wrote:
Daniel J Walsh wrote:
John Griffiths wrote:
fedora-selinux-list-request@redhat.com wrote:
Subject: Error running ffmpeg due to permission denied on library From: "Robert Foster" rfoster@mountainvisions.com.au Date: Thu, 27 Apr 2006 12:41:09 +1000 To: fedora-selinux-list@redhat.com
To: fedora-selinux-list@redhat.com I'm trying to get ffmpeg working for Gallery2 on FC5, and getting the following error (from the debug message via Gallery):
I had the same problem when using Kino which also uses ffmpeg. Here is what I did and it works.
execstack -c /usr/lib/libmp3lame.so.0 execstack -c /usr/lib/libxvidcore.so.4
Please submit bugs on these to Kino and ffmpeg.
Actually /usr/lib/libmp3lame.so.0 is part of lame-3.96.1-10.rhfc5.at and libxvidcore4-1.1.0-8.rhfc5.at both from ATRpms.net.
I'll let the people at ATRpm know.
Is this considered a packaging or upstream issue?
If packaging: What is the recommended way to fix it specfile-wise?
From this, I find the folks at ATRpms know.
I'm very sure they'll be just as confused as I am ;)
Axel Thimm wrote:
On Tue, May 02, 2006 at 02:27:24PM -0400, John Griffiths wrote:
Axel Thimm wrote:
On Tue, May 02, 2006 at 02:07:37PM -0400, John Griffiths wrote:
Daniel J Walsh wrote:
John Griffiths wrote:
fedora-selinux-list-request@redhat.com wrote:
> Subject: > Error running ffmpeg due to permission denied on library > From: > "Robert Foster" rfoster@mountainvisions.com.au > Date: > Thu, 27 Apr 2006 12:41:09 +1000 > To: > fedora-selinux-list@redhat.com > > To: > fedora-selinux-list@redhat.com > I'm trying to get ffmpeg working for Gallery2 on FC5, and getting > the following error (from the debug message via Gallery): >
I had the same problem when using Kino which also uses ffmpeg. Here is what I did and it works.
execstack -c /usr/lib/libmp3lame.so.0 execstack -c /usr/lib/libxvidcore.so.4
Please submit bugs on these to Kino and ffmpeg.
Actually /usr/lib/libmp3lame.so.0 is part of lame-3.96.1-10.rhfc5.at and libxvidcore4-1.1.0-8.rhfc5.at both from ATRpms.net.
I'll let the people at ATRpm know.
Is this considered a packaging or upstream issue?
If packaging: What is the recommended way to fix it specfile-wise?
From this, I find the folks at ATRpms know.
I'm very sure they'll be just as confused as I am ;)
Point them at
http://people.redhat.com/~drepper/selinux-mem.html
and
http://people.redhat.com/drepper/nonselsec.pdf
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
On Tue, May 02, 2006 at 03:09:03PM -0400, Daniel J Walsh wrote:
Axel Thimm wrote:
On Tue, May 02, 2006 at 02:27:24PM -0400, John Griffiths wrote:
Axel Thimm wrote:
On Tue, May 02, 2006 at 02:07:37PM -0400, John Griffiths wrote:
Daniel J Walsh wrote:
John Griffiths wrote:
>fedora-selinux-list-request@redhat.com wrote: > >>Subject: >>Error running ffmpeg due to permission denied on library >>From: >>"Robert Foster" rfoster@mountainvisions.com.au >>Date: >>Thu, 27 Apr 2006 12:41:09 +1000 >>To: >>fedora-selinux-list@redhat.com >> >>To: >>fedora-selinux-list@redhat.com >>I'm trying to get ffmpeg working for Gallery2 on FC5, and getting >>the following error (from the debug message via Gallery): >>
>I had the same problem when using Kino which also uses ffmpeg. Here >is what I did and it works. > > execstack -c /usr/lib/libmp3lame.so.0 > execstack -c /usr/lib/libxvidcore.so.4 > > Please submit bugs on these to Kino and ffmpeg.
Actually /usr/lib/libmp3lame.so.0 is part of lame-3.96.1-10.rhfc5.at and libxvidcore4-1.1.0-8.rhfc5.at both from ATRpms.net.
I'll let the people at ATRpm know.
Is this considered a packaging or upstream issue?
If packaging: What is the recommended way to fix it specfile-wise?
From this, I find the folks at ATRpms know.
I'm very sure they'll be just as confused as I am ;)
Point them at
^^^^
Them is largely myself, that's why I can tell how confused "they" will be. ;)
http://people.redhat.com/~drepper/selinux-mem.html
and
But these reference upstream fixing, not packaging ones. Do idioms exist to cirumvent this at the packaging level (other than fixing the source and Patch0: the fix), or is the recommendation to report to upstream and wait for a fix while disabling selinux at the mean time?
Axel Thimm wrote:
On Tue, May 02, 2006 at 03:09:03PM -0400, Daniel J Walsh wrote:
Axel Thimm wrote:
On Tue, May 02, 2006 at 02:27:24PM -0400, John Griffiths wrote:
Axel Thimm wrote:
On Tue, May 02, 2006 at 02:07:37PM -0400, John Griffiths wrote:
Daniel J Walsh wrote:
> John Griffiths wrote: > > >> fedora-selinux-list-request@redhat.com wrote: >> >> >>> Subject: >>> Error running ffmpeg due to permission denied on library >>> From: >>> "Robert Foster" rfoster@mountainvisions.com.au >>> Date: >>> Thu, 27 Apr 2006 12:41:09 +1000 >>> To: >>> fedora-selinux-list@redhat.com >>> >>> To: >>> fedora-selinux-list@redhat.com >>> I'm trying to get ffmpeg working for Gallery2 on FC5, and getting >>> the following error (from the debug message via Gallery): >>> >>>
>> I had the same problem when using Kino which also uses ffmpeg. Here >> is what I did and it works. >> >> execstack -c /usr/lib/libmp3lame.so.0 >> execstack -c /usr/lib/libxvidcore.so.4 >> >> >> > Please submit bugs on these to Kino and ffmpeg. > > > Actually /usr/lib/libmp3lame.so.0 is part of lame-3.96.1-10.rhfc5.at and libxvidcore4-1.1.0-8.rhfc5.at both from ATRpms.net.
I'll let the people at ATRpm know.
Is this considered a packaging or upstream issue?
If packaging: What is the recommended way to fix it specfile-wise?
From this, I find the folks at ATRpms know.
I'm very sure they'll be just as confused as I am ;)
Point them at
^^^^
Them is largely myself, that's why I can tell how confused "they" will be. ;)
http://people.redhat.com/~drepper/selinux-mem.html
and
But these reference upstream fixing, not packaging ones. Do idioms exist to cirumvent this at the packaging level (other than fixing the source and Patch0: the fix), or is the recommendation to report to upstream and wait for a fix while disabling selinux at the mean time?
How about executing
execstack -c /usr/lib/libmp3lame.so.0
execstack -c /usr/lib/libxvidcore.so.4
In the postinstall? If it does not break anything.
selinux@lists.fedoraproject.org