SELinux and NSS [was: Problem with NSS update - Firefox, Evolution]
by Jonathan Berry
On 1/28/06, Jonathan Berry <berryja(a)gmail.com> wrote:
> On 1/28/06, Jonathan Berry <berryja(a)gmail.com> wrote:
> > Hi all,
> >
> > I just installed FC5T2 x86_64 to test it out. Install went smoothly
> > and I just finished up all the updates. I seem to be having an issue
> > with the NSS update:
> > # grep -i nss /var/log/yum.log
> > Jan 28 00:06:03 Updated: nss.x86_64 3.11-3
> > Jan 28 00:07:25 Updated: nss.i386 3.11-3
> > Jan 28 00:20:14 Updated: nss_ldap.i386 248-1
> > Jan 28 00:20:18 Updated: nss_ldap.x86_64 248-1
> >
> > I have seen two symptoms of some problem thus far in Firefox and
> > Evolution. Firefox starts with a warning that it could not initialize
> > the security component (something to that effect) and gives some
> > statement that it could be a file permissions problem in the profile
> > directory. Perms look to be okay in ~/.mozilla/firefox/ and I get no
> > SELinux or other messages. Evolution flat refuses to run. The
> > problem is more apparent from the command line:
> > $ evolution
> > (evolution:3437): evolution-smime-WARNING **: Failed all methods for
> > initializing NSS
> > (evolution:3437): camel-WARNING **: Failed to initialize NSS
> >
> > Any ideas? Time for a bugzilla entry? (probably after I sleep some...)
>
> More information...
>
> I just tried reinstalling the original nss pacakges and I am still
> having issues. Firefox gives the security warning and will not do any
> ssl stuff (not good!) and evolution will not start.
> $ rpm -qa nss{,_ldap}
> nss_ldap-244-2.1.x86_64
> nss-3.11-2.x86_64
> nss_ldap-244-2.1.i386
> nss-3.11-2.i386
>
> I've tried rebooting and even booting the original kernel and get the
> same results. Is anyone else seeing this?
Okay, well, I keep responding to myself...
This now seems to be related to SELinux somehow. If I issue a
"setenforce 0" command, then Firefox and SSL work just fine, Evolution
starts, and all is well. With enforcing disabled, when I start
Firefox or Evolution, I get some "avc: granted { execmem }" messages
in audit.log relating to the programs. Unfortunately, I do not get
any failure or otherwise messages in audit.log when SELinux is on.
FC5T2 x86_64 fully updated as of today.
$ rpm -qa | grep selinux
libselinux-devel-1.29.6-1.x86_64
libselinux-python-1.29.6-1.x86_64
selinux-policy-2.2.8-1.noarch
selinux-policy-targeted-2.2.8-1.noarch
libselinux-1.29.6-1.x86_64
libselinux-1.29.6-1.i386
Below I will post the AVC messages that I get when starting Evolution
and Firefox with SELinux off. I do not get any messages with SELinux
enabled (ie, enforcing). I'll also give the ls -Z output for the NSS
stuff. Is no one else seeing this? Should I go ahead and bugzilla
this (now that I can actually access https, heh)?
Jonathan
Lots of info follows.
$ ls -Z `rpm -ql nss`
-rw-r--r-- root root system_u:object_r:lib_t
/usr/lib64/libfreebl3.chk
-rw-r--r-- root root system_u:object_r:lib_t
/usr/lib64/libfreebl3.so
-rw-r--r-- root root system_u:object_r:lib_t
/usr/lib64/libnss3.so
-rw-r--r-- root root system_u:object_r:lib_t
/usr/lib64/libnssckbi.so
-rw-r--r-- root root system_u:object_r:lib_t
/usr/lib64/libsmime3.so
-rw-r--r-- root root system_u:object_r:lib_t
/usr/lib64/libsoftokn3.chk
-rw-r--r-- root root system_u:object_r:lib_t
/usr/lib64/libsoftokn3.so
-rw-r--r-- root root system_u:object_r:lib_t
/usr/lib64/libssl3.so
-rw-r--r-- root root system_u:object_r:lib_t
/usr/lib/libfreebl3.chk
-rw-r--r-- root root system_u:object_r:lib_t
/usr/lib/libfreebl3.so
-rw-r--r-- root root system_u:object_r:lib_t
/usr/lib/libnss3.so
-rw-r--r-- root root system_u:object_r:lib_t
/usr/lib/libnssckbi.so
-rw-r--r-- root root system_u:object_r:lib_t
/usr/lib/libsmime3.so
-rw-r--r-- root root system_u:object_r:lib_t
/usr/lib/libsoftokn3.chk
-rw-r--r-- root root system_u:object_r:lib_t
/usr/lib/libsoftokn3.so
-rw-r--r-- root root system_u:object_r:lib_t
/usr/lib/libssl3.so
$ ls -Z `rpm -ql nss_ldap`
-rw-r--r-- root root system_u:object_r:etc_t /etc/ldap.conf
-rw-r--r-- root root system_u:object_r:etc_t /etc/ldap.conf
-rwxr-xr-x root root system_u:object_r:lib_t
/lib64/libnss_ldap-2.3.90.so
lrwxrwxrwx root root system_u:object_r:lib_t
/lib64/libnss_ldap.so.2 -> libnss_ldap-2.3.90.so
-rwxr-xr-x root root system_u:object_r:lib_t
/lib64/security/pam_ldap.so
-rwxr-xr-x root root system_u:object_r:lib_t
/lib/libnss_ldap-2.3.90.so
lrwxrwxrwx root root system_u:object_r:lib_t
/lib/libnss_ldap.so.2 -> libnss_ldap-2.3.90.so
-rwxr-xr-x root root system_u:object_r:lib_t
/lib/security/pam_ldap.so
lrwxrwxrwx root root system_u:object_r:lib_t
/usr/lib64/libnss_ldap.so -> ../../lib64/libnss_ldap.so.2
lrwxrwxrwx root root system_u:object_r:lib_t
/usr/lib/libnss_ldap.so -> ../../lib/libnss_ldap.so.2
[... snip tons more files with perms: -rw-r--r-- root root
system_u:object_r:usr_t]
I get the following AVC messages when starting Evolution with SELinux off:
type=AVC msg=audit(1138480597.454:108): avc: granted { execmem } for
pid=3745 comm="evolution" scontext=user_u:system_r:unco
nfined_t:s0 tcontext=user_u:system_r:unconfined_t:s0 tclass=process
type=SYSCALL msg=audit(1138480597.454:108): arch=c000003e syscall=10
success=yes exit=0 a0=7fffffce9000 a1=1000 a2=1000007 a3=4
items=0 pid=3745 auid=4294967295 uid=500 gid=500 euid=500 suid=500
fsuid=500 egid=500 sgid=500 fsgid=500 comm="evolution" exe=
"/usr/bin/evolution-2.6"
type=AVC msg=audit(1138480597.558:109): avc: granted { execmem } for
pid=3745 comm="evolution" scontext=user_u:system_r:unco
nfined_t:s0 tcontext=user_u:system_r:unconfined_t:s0 tclass=process
type=SYSCALL msg=audit(1138480597.558:109): arch=c000003e syscall=9
success=yes exit=1073741824 a0=0 a1=a01000 a2=7 a3=62 items
=0 pid=3745 auid=4294967295 uid=500 gid=500 euid=500 suid=500
fsuid=500 egid=500 sgid=500 fsgid=500 comm="evolution" exe="/usr/
bin/evolution-2.6"
type=AVC msg=audit(1138480597.590:110): avc: granted { execmem } for
pid=3761 comm="evolution" scontext=user_u:system_r:unco
nfined_t:s0 tcontext=user_u:system_r:unconfined_t:s0 tclass=process
type=SYSCALL msg=audit(1138480597.590:110): arch=c000003e syscall=9
success=yes exit=1084231680 a0=0 a1=a01000 a2=7 a3=62 items
=0 pid=3761 auid=4294967295 uid=500 gid=500 euid=500 suid=500
fsuid=500 egid=500 sgid=500 fsgid=500 comm="evolution" exe="/usr/
bin/evolution-2.6"
type=AVC msg=audit(1138480597.630:111): avc: granted { execmem } for
pid=3745 comm="evolution" scontext=user_u:system_r:unco
nfined_t:s0 tcontext=user_u:system_r:unconfined_t:s0 tclass=process
type=SYSCALL msg=audit(1138480597.630:111): arch=c000003e syscall=9
success=yes exit=1094721536 a0=0 a1=a01000 a2=7 a3=62 items
=0 pid=3745 auid=4294967295 uid=500 gid=500 euid=500 suid=500
fsuid=500 egid=500 sgid=500 fsgid=500 comm="evolution" exe="/usr/
bin/evolution-2.6"
type=AVC msg=audit(1138480598.770:112): avc: granted { execmem } for
pid=3745 comm="evolution" scontext=user_u:system_r:unco
nfined_t:s0 tcontext=user_u:system_r:unconfined_t:s0 tclass=process
type=SYSCALL msg=audit(1138480598.770:112): arch=c000003e syscall=9
success=yes exit=1105211392 a0=0 a1=a01000 a2=7 a3=62 items
=0 pid=3745 auid=4294967295 uid=500 gid=500 euid=500 suid=500
fsuid=500 egid=500 sgid=500 fsgid=500 comm="evolution" exe="/usr/
bin/evolution-2.6"
type=AVC msg=audit(1138480598.878:113): avc: granted { execmem } for
pid=3745 comm="evolution" scontext=user_u:system_r:unco
nfined_t:s0 tcontext=user_u:system_r:unconfined_t:s0 tclass=process
type=SYSCALL msg=audit(1138480598.878:113): arch=c000003e syscall=9
success=yes exit=1115701248 a0=0 a1=a01000 a2=7 a3=62 items
=0 pid=3745 auid=4294967295 uid=500 gid=500 euid=500 suid=500
fsuid=500 egid=500 sgid=500 fsgid=500 comm="evolution" exe="/usr/
bin/evolution-2.6"
I get the following AVC messages when starting Firefox with SELinux off:
type=AVC msg=audit(1138480668.242:114): avc: granted { execmem } for
pid=3802 comm="firefox-bin" scontext=user_u:system_r:unconfined_t:s0
tcontext=user_u:system_r:unconfined_t:s0 tclass=process
type=SYSCALL msg=audit(1138480668.242:114): arch=c000003e syscall=10
success=yes exit=0 a0=7fffffa74000 a1=1000 a2=1000007 a3=4 items=0
pid=3802 auid=4294967295 uid=500 gid=500 euid=500 suid=500 fsuid=500
egid=500 sgid=500 fsgid=500 comm="firefox-bin"
exe="/usr/lib64/firefox-1.5/firefox-bin"
type=AVC msg=audit(1138480668.242:115): avc: granted { execmem } for
pid=3802 comm="firefox-bin" scontext=user_u:system_r:unconfined_t:s0
tcontext=user_u:system_r:unconfined_t:s0 tclass=process
type=SYSCALL msg=audit(1138480668.242:115): arch=c000003e syscall=10
success=yes exit=0 a0=41403000 a1=a00000 a2=7 a3=4 items=0 pid=3802
auid=4294967295 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500
sgid=500 fsgid=500 comm="firefox-bin"
exe="/usr/lib64/firefox-1.5/firefox-bin"
type=AVC msg=audit(1138480668.242:116): avc: granted { execmem } for
pid=3802 comm="firefox-bin" scontext=user_u:system_r:unconfined_t:s0
tcontext=user_u:system_r:unconfined_t:s0 tclass=process
type=SYSCALL msg=audit(1138480668.242:116): arch=c000003e syscall=10
success=yes exit=0 a0=40a02000 a1=a00000 a2=7 a3=4 items=0 pid=3802
auid=4294967295 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500
sgid=500 fsgid=500 comm="firefox-bin"
exe="/usr/lib64/firefox-1.5/firefox-bin"
type=AVC msg=audit(1138480668.242:117): avc: granted { execmem } for
pid=3802 comm="firefox-bin" scontext=user_u:system_r:unconfined_t:s0
tcontext=user_u:system_r:unconfined_t:s0 tclass=process
type=SYSCALL msg=audit(1138480668.242:117): arch=c000003e syscall=10
success=yes exit=0 a0=40001000 a1=a00000 a2=7 a3=4 items=0 pid=3802
auid=4294967295 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500
sgid=500 fsgid=500 comm="firefox-bin"
exe="/usr/lib64/firefox-1.5/firefox-bin"
type=AVC msg=audit(1138480668.502:118): avc: granted { execmem } for
pid=3803 comm="firefox-bin" scontext=user_u:system_r:unconfined_t:s0
tcontext=user_u:system_r:unconfined_t:s0 tclass=process
type=SYSCALL msg=audit(1138480668.502:118): arch=c000003e syscall=9
success=yes exit=1105211392 a0=0 a1=a01000 a2=7 a3=62 items=0 pid=3803
auid=4294967295 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500
sgid=500 fsgid=500 comm="firefox-bin"
exe="/usr/lib64/firefox-1.5/firefox-bin"
18 years, 1 month
Burning CDs
by Leon Stringer
Should I be able to burn CDs?
I remember a post a while back saying this wasn't working. Is it fixed
now?
I'm trying to burn the FC5t2 ISOs and I've tried with GNOME and cdrecord
but they're failing the sha1sum test.
Advice and assistance gratefully received,
Leon...
18 years, 1 month
X trouble with Intel 82810E DC-133 graphics chipset in FC5T2
by Willem Riede
I tried to upgrade an oldish Dell Optiplex GX110 that's now running FC3 to FC5T2,
and this is how far I got:
... Intel 82810E DC-133 cGC [Chipset Graphics Controller]
... Viewsonic P813
1...2...3...4...5.... X server started successfully
mini-wm: Fatal IO error 104 (Connection reset by peer) on Xserver :1.0
and the tail of X.log reads:
(EE) GARTInit: Unable to open /dev/agpgart (No such device)
(EE) I810(0): AGP GART support is not available. Make sure your kernel has
agpgart support or that the agpgart kernel module is loaded.
(EE) Screen(s) found, but none have a usable configuration.
Fatal server error:
no screens found
Known problem? Should I bugzilla? Provide more information?
Thanks, Willem Riede.
PS - appologies for re-posting, I had not used the right subject.
18 years, 1 month
Today's nit picks
by Don Springall
If you send a file to the trash with Konqueror it end up on my system in
/home/don/.local/share/Trash/files.
If you send something to the trash with Nautilus it end up in
/home/don/.Trash
When you are running a gnome desktop the trash icon point to
/home/don/.Trash so you never see the files Konqueror sent to its trash can.
When you switch from a gnome session to a kde session (gnome being your
default) you are then prompted with a dialog asking if you want to make kde
your default manager or just use it for this session only. If you choose
this session only kde still ends up being the default.
If you try opening a file with kwrite from Konqueror (in super user mode
using "kdesu kfmclient openProfile webbrowsing") you get "KDEInit could not
launch 'kwrite'".
18 years, 1 month
gweather-applet-2 crashes
by Brian C. Huffman
After today's rawhide update (and actually since the big gnome-session
crash creator), gweather-applet-2 still fails to load. When I try to
add to the panel, it dies.
I don't know how to recreate on the command line -
typing /usr/lib/gweather-applet-2 just hangs.
Brian
18 years, 1 month
Problems with FC5 test 2
by Linuxer Wang
Hello, all
I am using FC5 test2. The problems:
1. Remote installation: I can't install FC5 test2 from a remote ftp
server. The iso is for DVD. When I tried to connect, it responses:
Unable to get the file ftp://192.168.10.1//fc5/repodata/repomd.xml. The
file IS there, and can be accessed, so I wonder if it should be
192.168.10.1/fc5/, not 192.168.10.1//fc5/?
2. Acrobat 7.0.5 can't start when SELinux is running. I have to disable
the SELinux: setenforce 0, otherwise it will not start. It seems an old
problem in a new release.
3. The start menu and the right side panel always be ready to be dead. I
don't know if it's because there's the configuration files from the last
FC4 gnome. I will delete them for a test.
The good news is: Speed Step and ALSA works for the first time on my
laptop. I will never be forced to use OSS.
18 years, 1 month
Problems with PowerMac 2.7GHz cooling with 2.6.15-1.1824_FC4
by Brian D. Carlstrom
I was running 6 G5 machines with various FC4 kernels up to and including
2.6.14-1.1656_FC4. However, our two newest 2.7GHz dual processor
machines were be powering off by the therm_pm72 driver because of
overheating. The problem was confirmed by use of the
/sbin/critical_overtemp callback that the therm_pm72 driver provides.
Since we are using these machines as compute boxes, we have been limping
along with a critical_overtemp script that logged the invocation and
rebooted (instead of powering off.)
Recently I saw that there was patch to 2.6.15 to fix a bug in therm_pm72
that was contributing to the overtemp situation, specifically this patch:
commit 6ee7fb7e363aa8828b3920422416707c79f39007
Author: Benjamin Herrenschmidt <benh(a)kernel.crashing.org>
Date: Mon Dec 19 11:24:53 2005 +1100
[PATCH] powerpc: g5 thermal overtemp bug
The g5 thermal control for liquid cooled machines has a small bug, when
the temperatures gets too high, it boosts all fans to the max, but
incorrectly sets the liquids pump to the min instead of the max speed,
thus causing the overtemp condition not to clear and the machine to shut
down after a while. This fixes it to set the pumps to max speed instead.
This problem might explain some of the reports of random shutdowns that
some g5 users have been reporting in the past.
Many thanks to Marcus Rothe for spending a lot of time trying various
patches & sending log logs before I found out that typo. Note that
overtemp handling is still not perfect and the machine might still
shutdown, that patch should reduce if not eliminate such occcurences in
"normal" conditions with high load. I'll implement a better handling
with proper slowing down of the CPUs later.
Signed-off-by: Benjamin Herrenschmidt <benh(a)kernel.crashing.org>
Signed-off-by: Linus Torvalds <torvalds(a)osdl.org>
I saw that the 2.6.15-1.1823_FC4 kernel had this patch so I tried that
but now have a different problem. The cooling system runs full blast
because the hardware is receiving the usually once a second commands
from the OS. This is very similar to the situation with the old FC4
kernels such as 2.6.11-1.1369_FC4 where the therm_pm72 driver was not
enabled because it only checked for PowerMac7,2 machines (as suggested
by pm72 in the driver name) and the new machines were detected as
PowerMac7,3. The machines no longer reboot, but the room that they are
in (a shared office for 3) is not inhabitable because of the noise.
Today I switched to 2.6.15-1.1824_FC4 to confirm that the situation
remains unchanged. The only thing I notice superficially different about
the kernals it that the therm_pm72 was built as a kernel module in all
FC4 kernels until now but this has changed to be built into the kernel
directly. I'm not sure if this could be a problem but I wanted to
mention it.
In any case, for the short term my officemates and I have fled to other
offices. I'll probably tack a wack at debugging the problem, but wanted
to post to let people know of the problem with the new kernel, and old
kernel for that matter!
-bri
P.S. - I'll also note that benh, the driver author said elsewhere that
the overtemp problem is partially a manufacturing problem with the later
machines. We seem to be seeing that as our original 2.7GHz machine that
we got when they first came out does not have any cooling problems even
though its our server and has a far higher load that the other machines.
-bri
18 years, 1 month
FC5T2 issues with GLUT
by Jonathan Berry
Hi all,
I'm taking a class on computer graphics and we are using GLUT to
develop OpenGL programs. There seems to be a problem with GLUT on
FC5T2 x86_64 (currently updated). Compiling a simple OpenGL program
with GLUT and running it produces:
$ ./gltest
./gltest: error while loading shared libraries: libGL.so.1: cannot
enable executable stack as shared object requires: Permission denied
Disabling SELinux yields:
$ ./gltest
freeglut (./gltest): ERROR: Internal error <Visual with necessary
capabilities not found> in function fgOpenWindow
X Error of failed request: BadWindow (invalid Window parameter)
Major opcode of failed request: 4 (X_DestroyWindow)
Resource id in failed request: 0x0
Serial number of failed request: 16
Current serial number in output stream: 19
Versions:
$ rpm -qa | grep glut | grep x86_64
freeglut-2.4.0-2.1.x86_64
freeglut-devel-2.4.0-2.1.x86_64
$ rpm -qa | grep GL | grep x86_64
mesa-libGL-6.4.1-5.x86_64
mesa-libGLU-devel-6.4.1-5.x86_64
mesa-libGLw-6.4.1-5.x86_64
mesa-libGL-devel-6.4.1-5.x86_64
mesa-libGLU-6.4.1-5.x86_64
mesa-libGLw-devel-6.4.1-5.x86_64
I have an nVidia graphics card, but am only using the nv driver for
testing so far. Looking back at the errors, the message "Visual with
necessary capabilities not found" looks suspicious. The program I'm
running is simple and runs on some machines that do not have 3d
accelerated drivers. Either way, the first error from SELinux does
not look good. I can use "execstack -s gltest" to get around that
with SELinux still enabled (but get the same error as with SELinux
disabled).
Below is the program I'm running, it just brings up a window and draws
a line segment. Just in case someone wants to try it out.
Jonathan
$ cat gltest.c
#include <GL/glut.h>
#include <stdlib.h>
#include <stdio.h>
#include <math.h>
void LineSegment( void )
{
glClear( GL_COLOR_BUFFER_BIT );
glColor3f( 1.0, 0.0, 0.0 );
glBegin( GL_LINES );
glVertex2i( 180, 15 );
glVertex2i( 10, 145 );
glEnd();
glFlush();
}
int main( int argc, char *argv[] )
{
glutInit( &argc, argv );
glutInitDisplayMode( GLUT_SINGLE | GLUT_RGB );
glutInitWindowPosition( 50, 100 );
glutInitWindowSize( 400, 300 );
glutCreateWindow( "An Example OpenGL Program" );
glClearColor( 1.0, 1.0, 1.0, 0.0 );
glMatrixMode( GL_PROJECTION );
gluOrtho2D( 0.0, 200.0, 0.0, 150.0 );
glutDisplayFunc( LineSegment );
glutMainLoop();
return 0;
}
18 years, 1 month
How many people have unbootable FC5T2?
by Matthew Carter
Just a quick quiz on how many people have a install of fedora that is
unbootable? Where does it stop? When did it stop?
Only reason I am asking is I havent had mine working since early test1
and am nervous about the release of FC5 as it might not support my
laptop. I have used fedora on it since FC3 and have never had any
issues but FC5 tests seem to be causing all hell to break loose.
Matt
18 years, 1 month