Gentoo Archives: gentoo-hardened

From: solar <solar@g.o>
To: gentoo-hardened@l.g.o
Cc: SELinux <selinux@×××××××××.gov>
Subject: Re: [gentoo-hardened] mysql 4.1 requires shlib_t:file execmod?
Date: Sat, 22 Oct 2005 18:12:19
Message-Id: 1130004616.8908.38.camel@alto
In Reply to: Re: [gentoo-hardened] mysql 4.1 requires shlib_t:file execmod? by Antoine Martin
1 On Sat, 2005-10-22 at 18:41 +0100, Antoine Martin wrote:
2 > On Sat, 2005-10-22 at 13:31 -0400, solar wrote:
3 > > On Sat, 2005-10-22 at 17:37 +0100, Antoine Martin wrote:
4 > > > On Sat, 2005-10-22 at 17:53 +0200, pageexec@××××××××.hu wrote:
5 > > > > On 22 Oct 2005 at 16:45, Antoine Martin wrote:
6 > > > > > > what does scanelf -T /usr/lib/libmysqlclient.so.14 report?
7 > > > > > > if it's not text relocs, then post an strace please.
8 > > > > > Is scanelf a PaX tool?
9 > > > >
10 > > > > app-misc/pax-utils
11 > > > Thanks,
12 > > >
13 > > > scanelf -T /usr/lib/libmysqlclient.so.14
14 > > > shows nothing at all.
15 > > > (I also tried adding a -R, even -a shows nothing!)
16 > >
17 > >
18 > > This should help pinpoint whats up. Post the results of the following
19 > > commands.
20 > >
21 > >
22 > > emerge portage-utils pax-utils ; # If you don't already have both.
23 > I didn't.
24 > >
25 > > #1
26 > > qlist mysql | scanelf -qtf -
27 > TEXTREL /usr/lib/mysql/libmysqlclient.so
28 > TEXTREL /usr/lib/mysql/libmysqlclient_r.so
29 > TEXTREL /usr/lib/libmysqlclient.so
30 > TEXTREL /usr/lib/libmysqlclient.so.14.0.0
31 > TEXTREL /usr/lib/libmysqlclient_r.so
32 > TEXTREL /usr/lib/libmysqlclient_r.so.14.0.0
33
34 Looks like you do infact have textrels in your mysql.
35 I've seen this happen before when linked with a miscompiled
36 libcrypto.so
37
38 > > #2
39 > > scanelf -a /usr/lib/libmysqlclient.so.14
40 > Nothing here
41
42 If nothing here then chances are your running scanelf while trying to
43 enforce and no such policy exists for scanelf.
44
45
46 > >
47 > > #3
48 > > scanelf -a $(qfile -C $(scanelf -BF%n /usr/lib/libmysqlclient.so.14 \
49 > > | awk '{print $1}'| tr , ' ' ) | cut -d '(' -f 2 | tr ')' ' ' )
50 > scanelf: Unknown option
51
52 Perhaps you typo something here.
53 You should be able to copy + paste the command.
54
55 It should look something like the following.
56
57 tinderbox ~ # scanelf -a -- $(qfile -C $(scanelf -BF%
58 n /usr/lib/libmysqlclient.so.14 | awk '{print $1}'| tr , ' ' ) | cut -d
59 '(' -f 2 | tr ')' ' ' )
60 TYPE PAX STK/REL/PTL TEXTREL RPATH BIND FILE
61 ET_DYN ---xe- RW- R-- RW- - - NOW /lib/libcrypt.so.1
62 ET_DYN ---xe- RW- R-- RW- - - NOW /lib/libnsl.so.1
63 ET_DYN ---xe- RW- R-- RW- - - NOW /lib/libm.so.6
64 ET_DYN ---xe- RW- R-- RW- - - NOW /lib/libz.so.1
65 ET_DYN ---xe- RW- R-- RW- - - NOW /lib/libc.so.6
66 ET_DYN ---xe- RW- R-- RW- - - NOW /usr/lib/libssl.so.0.9.7
67 ET_DYN ---xe- RW- R-- RW- - - NOW /usr/lib/libcrypto.so.0.9.7
68
69 --
70 solar <solar@g.o>
71 Gentoo Linux
72
73 --
74 gentoo-hardened@g.o mailing list

Replies

Subject Author
[gentoo-hardened] SELinux n00b questions Dale Pontius <DEPontius@××××××.net>
Re: [gentoo-hardened] mysql 4.1 requires shlib_t:file execmod? Antoine Martin <antoine@××××××××××.uk>