Re: [gentoo-hardened] SELinux problem -> avc: denied {execmem}

[Petre Rodan]

Hi,

On Sun, May 21, 2006 at 04:40:57PM +0200, Jan Meier wrote:
> Hello,
>
> I am running SELinux and at boot time I get the following avc: denied
> messages:
>
> May 21 16:01:40 jeeves audit(1148220069.887:0): avc:  denied  { execmem } for
> pid=1 comm=init scontext=system_u:system_r:kernel_t
> tcontext=system_u:system_r:kernel_t tclass=process
> May 21 16:01:40 jeeves audit(1148220069.905:0): avc:  denied  { execmem } for
> pid=1 comm=init scontext=system_u:system_r:init_t
> tcontext=system_u:system_r:init_t tclass=process
> May 21 16:01:40 jeeves audit(1148220070.475:0): avc:  denied  { execmem } for
> pid=896 comm=rc scontext=system_u:system_r:initrc_t
> tcontext=system_u:system_r:initrc_t tclass=process
> May 21 16:01:40 jeeves audit(1148220070.920:0): avc:  denied  { execmem } for
> pid=904 comm=mount scontext=system_u:system_r:mount_t
> tcontext=system_u:system_r:mount_t tclass=process
> May 21 16:01:40 jeeves audit(1148220071.457:0): avc:  denied  { execmem } for
> pid=934 comm=swapon scontext=system_u:system_r:fsadm_t
> tcontext=system_u:system_r:fsadm_t tclass=process
> May 21 16:01:40 jeeves audit(1148220072.480:0): avc:  denied  { execmem } for
> pid=974 comm=modules-update scontext=system_u:system_r:update_modules_t
> tcontext=system_u:system_r:update_modules_t tclass=process

your binares might lack the GNU_STACK header, i.e. they were built with an old toolchain.
use readelf --headers to find out if it's the case.

you might want to upgrade to the latest stable gcc and recompile all binaries with that header missing.

> When I execute `setenforce 1` I get a "Killed" after each command I execute,
> does this have something to do with the denied messages?

you should enforce only when your policy is ok for your purposes.

cheers,
peter

-- 
petre rodan
<kaiowas@g.o>
Developer,
Hardened Gentoo Linux