shared lib problem

[Junji Kanemaru]

Hi,

I'm having problem with fc5-test2 that my app fails to load its
own shared library. The error I'm getting is:

"cannot restore segment prot after reloc: Permission denied"

It only happens when /selinux/enforce is true. I changed 
security context of the shared library but same... Any clue?

If more info needed then let me know what kind of info are
needed.

Thanks,
-- Junji

-- 
Junji Kanemaru
Linuon Inc.
Tokyo Japan

[Mark Ennis]

See:
http://people.redhat.com/drepper/selinux-mem.html
http://people.redhat.com/drepper/dsohowto.pdf

On 2/9/06, Junji Kanemaru <linux(a)linuon.com&gt; wrote:
>  Hi,
>
>  I'm having problem with fc5-test2 that my app fails to load its
>  own shared library. The error I'm getting is:
>
>  "cannot restore segment prot after reloc: Permission denied"
>
>  It only happens when /selinux/enforce is true. I changed
>  security context of the shared library but same... Any clue?
>
>  If more info needed then let me know what kind of info are
>  needed.
>
>  Thanks,
>  -- Junji
>
>  --
>  Junji Kanemaru
>  Linuon Inc.
>  Tokyo Japan
>
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>

[Junji Kanemaru]

Thanks for the info. 

Actually, it worked with texrel_shlib_t. Don't know if it is right
solution or not... 

I briefly read the site but still not sure what the real solution is.
I wonder if the error is pointing there's some fundamental bugs
lurk in my code. 
There are no writable variables in shared libraries but almost all
code have been written in C++. Is it affecting for some reason?
I had no problems with SELinux targeted policy in fc4.

Please enlighten me.

Thanks,
-- Junji

Mark Ennis wrote:
>  See:
>  http://people.redhat.com/drepper/selinux-mem.html
>  http://people.redhat.com/drepper/dsohowto.pdf
>  
>  On 2/9/06, Junji Kanemaru <linux(a)linuon.com&gt; wrote:
>  
> >Hi,
> >
> >I'm having problem with fc5-test2 that my app fails to load its
> >own shared library. The error I'm getting is:
> >
> >"cannot restore segment prot after reloc: Permission denied"
> >
> >It only happens when /selinux/enforce is true. I changed
> >security context of the shared library but same... Any clue?
> >
> >If more info needed then let me know what kind of info are
> >needed.
> >
> >Thanks,
> >-- Junji
> >
> >--
> >Junji Kanemaru
> >Linuon Inc.
> >Tokyo Japan
> >
> >--
> >fedora-selinux-list mailing list
> &gt;fedora-selinux-list(a)redhat.com
> >https://www.redhat.com/mailman/listinfo/fedora-selinux-list
> >
>  
>   
-- 
Junji Kanemaru
Linuon Inc.
Tokyo Japan

[Dawid Gajownik]

Dnia 02/09/2006 10:47 AM, Użytkownik Junji Kanemaru napisał:
>  Actually, it worked with texrel_shlib_t. Don't know if it is
> right
>  solution or not...  
It's just a workaround. It would be better to get rid of text 
relocations because they're evil ;)
http://thread.gmane.org/gmane.linux.gentoo.devel/33992
http://article.gmane.org/gmane.linux.gentoo.devel/34037

>  There are no writable variables in shared libraries but almost all
>  code have been written in C++. 
This can be a bug in gcc:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=175275
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=175442
or you missed -fpic/-fPIC option when compiling your coftware

http://www.gentoo.org/proj/en/hardened/pic-guide.xml
http://www.gentoo.org/proj/en/hardened/pic-internals.xml
http://www.gentoo.org/proj/en/hardened/pic-fix-guide.xml

Hope that helps.

Regards,
	Dawid

-- 

   ^_*

[Junji Kanemaru]

>  or you missed -fpic/-fPIC option when compiling your coftware 
I missed it. After I added -fPIC the avc error has gone.
But now  dlopen() fails. dlerror() says:
"No such file or directory"

The shared libraries that my app is loading are plugins.
They are not linked with main app. they are loaded on demand
and resolved symbols on the fly.
Do I need some tweaking with them?

-- junji

-- 
Junji Kanemaru
Linuon Inc.
Tokyo Japan

[Junji Kanemaru]

It worked after reboot machine. I'm not sure what caused
dlopen() error. One thing I suspect that I added a path file
in /etc/ld.so.conf.d to point my plugins dir and ran ldconfig,
but the cache wasn't updated properly or something like
that. 
I had LD_CONFIG_PATH to point the plugin dir then it didn't
work though. Maybe ld library related bug?

Anyways, thanks for info. It seems working now.

-- Junji

Junji Kanemaru wrote:
> >or you missed -fpic/-fPIC option when compiling your coftware
>  
>  
>  I missed it. After I added -fPIC the avc error has gone.
>  But now  dlopen() fails. dlerror() says:
>  "No such file or directory"
>  
>  The shared libraries that my app is loading are plugins.
>  They are not linked with main app. they are loaded on demand
>  and resolved symbols on the fly.
>  Do I need some tweaking with them?
>  
>  -- junji
>   
-- 
Junji Kanemaru
Linuon Inc.
Tokyo Japan

[Ulrich Drepper]

Junji Kanemaru wrote:
>  There are no writable variables in shared libraries but almost all
>  code have been written in C++. Is it affecting for some reason?
>  I had no problems with SELinux targeted policy in fc4. 
The latter is not surprising.  The problems arise due to new tests which
were not in FC4.  But the tests are not at fault.

If you use C++ your code might be clean (you'll have to check that
carefully) and there still can be problems:

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=175442

Unfortunately I don't see a fix on the horizon yet.

-- 
➧ Ulrich Drepper ➧ Red Hat, Inc. ➧ 444 Castro St ➧ Mountain View, CA ❖