libicudata.so.26.0, prelink, symbolic link, ...

[Tom London]

Running targeted/enforcing, latest rawhide.

Noticed the following AVC in log:
Mar 25 07:38:36 localhost kernel: audit(1111765116.214:0): avc: 
denied  { execmod } for  pid=13994 comm=ld-linux.so.2
path=/usr/lib/openoffice.org1.9.87/program/libicudata.so.26.0 dev=dm-0
ino=164963 scontext=user_u:system_r:crond_t
tcontext=system_u:object_r:lib_t tclass=file

This appears to be generated by prelink run from cron.
Here are entries from prelink.log:

Prelinking /usr/lib/openoffice.org1.9.87/program/libicudata.so.26.0
/usr/sbin/prelink:
/usr/lib/openoffice.org1.9.87/program/libicudata.so.26.0 Could not
trace symbol resolving
/usr/sbin/prelink: Could not prelink
/usr/lib/openoffice.org1.9.87/program/libicuuc.so.26.0 because its
dependency /usr/lib/openoffice.org1.9.87/program/libicudata.so.26.0
could not be prelinked
/usr/sbin/prelink: Could not prelink
/usr/lib/openoffice.org1.9.87/program/libicule.so.26.0 because its
dependency /usr/lib/openoffice.org1.9.87/program/libicuuc.so.26.0
could not be prelinked
Prelinking /usr/lib/openoffice.org1.9.87/program/libjvmaccessgcc3.so.3
/usr/sbin/prelink: Could not prelink
/usr/lib/openoffice.org1.9.87/program/libvcl680li.so because its
dependency /usr/lib/openoffice.org1.9.87/program/libicuuc.so.26.0
could not be prelinked
<<<< etc. >>>

Interestingly, the AVC seems to be showing the the type of the link
instead of the type of the real file:
[root@tlondon program]# ls -lZ libicudata*
lrwxrwxrwx  root     root     system_u:object_r:lib_t         
libicudata.so -> libicudata.so.26.0
lrwxrwxrwx  root     root     system_u:object_r:lib_t         
libicudata.so.26 -> libicudata.so.26.0
-r--r--r--  root     root     system_u:object_r:shlib_t       
libicudata.so.26.0

Any significance to this?

tom

[Ulrich Drepper]

Tom London wrote:
> Running targeted/enforcing, latest rawhide.
>
> Noticed the following AVC in log:
> Mar 25 07:38:36 localhost kernel: audit(1111765116.214:0): avc:
> denied  { execmod } for  pid=13994 comm=ld-linux.so.2
> path=/usr/lib/openoffice.org1.9.87/program/libicudata.so.26.0 dev=dm-0
> ino=164963 scontext=user_u:system_r:crond_t
> tcontext=system_u:object_r:lib_t tclass=file

/usr/lib/openoffice.org1.9.87/program/libicudata.so.26.0 has text
relocations, which shouldn't be the case.  This is no SELinux issue, but
instead an OO.org build problem.

--
➧ Ulrich Drepper ➧ Red Hat, Inc. ➧ 444 Castro St ➧ Mountain View, CA ❖

[Ivan Gyurdiev]

> /usr/lib/openoffice.org1.9.87/program/libicudata.so.26.0 has text
> relocations, which shouldn't be the case.  This is no SELinux issue, but
> instead an OO.org build problem.

I sent a policy patch about this some time ago  (to mark it as such)..
Can't recall if it wasn't merged, or if I just missed this particular 
library.
Look in /etc/selinux/targeted/src/policy/file_contexts/distros.fc for 
libicudata.

chcon -t textrel_shlib_t to fix it temporarily.

There is a vast list of those in the SELinux policy - maybe bugs should 
be filed
in the appropriate apps to fix them.