Disable for java?

[Fred Harris]

Is there any way to disable selinux for java?  I tried 

chcon -t java_exec_t  /opt/java 

which I found searching around, and that didn't work.  

The problem I'm having is that I'm getting a million messages
complaining about "execmem", I guess having something to
do with accessing shared memory.  I'm trying to run Tomcat
and get about 100 messages per minute, so I'm faced
with either turning off selinux completely, turning off
the error logging on selinux, or turning off selinux
for java specifically.

I'm running the latest Sun Java version.

Thanks.



__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com

[Bruno Wolff III]

On Thu, May 04, 2006 at 18:44:20 -0700,
  Fred Harris <frharris27(a)yahoo.com&gt; wrote:
>  
>  The problem I'm having is that I'm getting a million messages
>  complaining about "execmem", I guess having something to
>  do with accessing shared memory.  I'm trying to run Tomcat
>  and get about 100 messages per minute, so I'm faced
>  with either turning off selinux completely, turning off
>  the error logging on selinux, or turning off selinux
>  for java specifically. 
One option would be to turn off execmem for everything until you get a
chance to figure out how to do something more limited.
You can do this in the security settings or use 'setsebool -P allow_execmem on'.

[Paul Howarth]

On Thu, 2006-05-04 at 18:44 -0700, Fred Harris wrote:
>  Is there any way to disable selinux for java?  I tried 
>  chcon -t java_exec_t  /opt/java 
>  
>  which I found searching around, and that didn't work.  
>  
>  The problem I'm having is that I'm getting a million messages
>  complaining about "execmem", I guess having something to
>  do with accessing shared memory.  I'm trying to run Tomcat
>  and get about 100 messages per minute, so I'm faced
>  with either turning off selinux completely, turning off
>  the error logging on selinux, or turning off selinux
>  for java specifically. 
Are these "denial" or "granted" messages? I believe the
"granted"
messages were turned off in an FC5 policy update - is your system up to
date regarding the SELinux packages?

>  I'm running the latest Sun Java version. 
You might also try installing Sun Java using the "JPackage method",
which doesn't install the files under /opt:

http://www.city-fan.org/tips/JpackageJava

Paul.