Re: [gentoo-hardened] SELinux problem -> avc: denied {execmem}

[Petre Rodan]

Hi,

On Sun, May 21, 2006 at 04:40:57PM +0200, Jan Meier wrote:
> Hello,
> 
> I am running SELinux and at boot time I get the following avc: denied 
> messages:
> 
> May 21 16:01:40 jeeves audit(1148220069.887:0): avc:  denied  { execmem } for 
>  
> pid=1 comm=init scontext=system_u:system_r:kernel_t 
> tcontext=system_u:system_r:kernel_t tclass=process
> May 21 16:01:40 jeeves audit(1148220069.905:0): avc:  denied  { execmem } for 
>  
> pid=1 comm=init scontext=system_u:system_r:init_t 
> tcontext=system_u:system_r:init_t tclass=process
> May 21 16:01:40 jeeves audit(1148220070.475:0): avc:  denied  { execmem } for 
>  
> pid=896 comm=rc scontext=system_u:system_r:initrc_t 
> tcontext=system_u:system_r:initrc_t tclass=process
> May 21 16:01:40 jeeves audit(1148220070.920:0): avc:  denied  { execmem } for 
>  
> pid=904 comm=mount scontext=system_u:system_r:mount_t 
> tcontext=system_u:system_r:mount_t tclass=process
> May 21 16:01:40 jeeves audit(1148220071.457:0): avc:  denied  { execmem } for 
>  
> pid=934 comm=swapon scontext=system_u:system_r:fsadm_t 
> tcontext=system_u:system_r:fsadm_t tclass=process
> May 21 16:01:40 jeeves audit(1148220072.480:0): avc:  denied  { execmem } for 
>  
> pid=974 comm=modules-update scontext=system_u:system_r:update_modules_t 
> tcontext=system_u:system_r:update_modules_t tclass=process

your binares might lack the GNU_STACK header, i.e. they were built with an old 
toolchain.
use readelf --headers to find out if it's the case.

you might want to upgrade to the latest stable gcc and recompile all binaries 
with that header missing.

> When I execute `setenforce 1` I get a "Killed" after each command I execute, 
> does this have something to do with the denied messages?

you should enforce only when your policy is ok for your purposes.

cheers,
peter

-- 
petre rodan
<[EMAIL PROTECTED]>
Developer,
Hardened Gentoo Linux 

pgpqBL3Os1y2d.pgp
Description: PGP signature