From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Camm Maguire Newsgroups: gmane.lisp.gcl.devel,gmane.emacs.devel,gmane.comp.mathematics.axiom.devel Subject: Re: Re: unexec and fedora core 4 Date: 09 Dec 2005 16:43:44 -0500 Message-ID: <54ek4mymi7.fsf@intech19.enhanced.com> References: <87hd9j42g3.fsf@jurta.org> <54acfbnjoh.fsf_-_@intech19.enhanced.com> <54wtiee1up.fsf@intech19.enhanced.com> NNTP-Posting-Host: main.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: sea.gmane.org 1134164662 14957 80.91.229.2 (9 Dec 2005 21:44:22 GMT) X-Complaints-To: usenet@sea.gmane.org NNTP-Posting-Date: Fri, 9 Dec 2005 21:44:22 +0000 (UTC) Cc: gcl-devel@gnu.org, emacs-devel@gnu.org, root , Matt Kaufmann , axiom-developer@nongnu.org, Sandip Ray Original-X-From: gcl-devel-bounces+gnu-gcl-devel=m.gmane.org@gnu.org Fri Dec 09 22:44:09 2005 Return-path: Original-Received: from lists.gnu.org ([199.232.76.165]) by ciao.gmane.org with esmtp (Exim 4.43) id 1Ekq28-0006cY-4R for gnu-gcl-devel@m.gmane.org; Fri, 09 Dec 2005 22:44:04 +0100 Original-Received: from localhost ([127.0.0.1] helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Ekq2T-0006ia-Vp for gnu-gcl-devel@m.gmane.org; Fri, 09 Dec 2005 16:44:26 -0500 Original-Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1Ekq2S-0006hz-Kx for gcl-devel@gnu.org; Fri, 09 Dec 2005 16:44:24 -0500 Original-Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1Ekq2R-0006he-Uh for gcl-devel@gnu.org; Fri, 09 Dec 2005 16:44:24 -0500 Original-Received: from [199.232.76.173] (helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Ekq2R-0006hb-SE; Fri, 09 Dec 2005 16:44:23 -0500 Original-Received: from [67.101.227.59] (helo=intech19.enhanced.com) by monty-python.gnu.org with esmtp (Exim 4.34) id 1Ekq3h-00006o-OV; Fri, 09 Dec 2005 16:45:42 -0500 Original-Received: from camm by intech19.enhanced.com with local (Exim 3.35 #1 (Debian)) id 1Ekq1o-0005DJ-00; Fri, 09 Dec 2005 16:43:44 -0500 Original-To: Juho Snellman In-Reply-To: <54wtiee1up.fsf@intech19.enhanced.com> Original-Lines: 90 User-Agent: Gnus/5.09 (Gnus v5.9.0) Emacs/21.2 X-BeenThere: gcl-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: gcl-devel.gnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Original-Sender: gcl-devel-bounces+gnu-gcl-devel=m.gmane.org@gnu.org Errors-To: gcl-devel-bounces+gnu-gcl-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.lisp.gcl.devel:6052 gmane.emacs.devel:47351 gmane.comp.mathematics.axiom.devel:7627 Archived-At: Greetings! OK, here is what I believe now to be the case -- the SELinux option allow_execmem, which is 'active' on the bad box, is causing the problem. All is well if one takes the drastic action of sudo /bin/sh -c "/usr/sbin/setenforce 0" but will probably allso work if one changes /etc/selinux/strict/src/policy/domains/user.te:bool allow_execmem false; to /etc/selinux/strict/src/policy/domains/user.te:bool allow_execmem true; and sudo /bin/sh -c "cd /etc/selinux/strict/src/policy && make load" though I have not confirmed this not wanting to hose the machine in question. The security people appear to persist in their (IMHO quite erroneous) assumption that there is no legitimate need for an executable heap. Tim Daly likely has further thoughts on this, but I saw the comment again here: http://copilotconsulting.com/mail-archives/selinux.2005/msg02006.html Take care, Camm Maguire writes: > Juho Snellman writes: > > > wrote: > > > Greetings! I am a developer of GCL, which shares unexec with emacs. > > > I have noticed on certain recent Fedora Core 4 machines, binaries > > > produced with unexec cannot mprotect memory (allocated with brk) > > > PROT_EXEC (returning EACCESS, i.e. permission denied), whereas > > > binaries output by ld can do so just fine. This does not vary with > > > exec-shield or randomize_va_space settings, and appears quite machine > > > specific. The same binary which functions perfectly normally on one > > > fc4 machine shows this failure only on another machine. I have as yet > > > been unable to correlate this with dynamic library placement, or other > > > settings in /proc/sys. > > > > Just a guess, but this might be related to SELinux. Do the machines > > have differences in /etc/selinux/config? > > > > Bingo! (I think) The config files are identical, but the problem > machine has a 'strict' subdirectory with a host of files and options. > Any idea of what I should look for herein, and what this could have to > do with unexec vs ld? > > Thank you so much! > > > -- > > Juho Snellman > > > > > > > > _______________________________________________ > > Gcl-devel mailing list > > Gcl-devel@gnu.org > > http://lists.gnu.org/mailman/listinfo/gcl-devel > > > > > > > > -- > Camm Maguire camm@enhanced.com > ========================================================================== > "The earth is but one country, and mankind its citizens." -- Baha'u'llah > > > _______________________________________________ > Gcl-devel mailing list > Gcl-devel@gnu.org > http://lists.gnu.org/mailman/listinfo/gcl-devel > > > -- Camm Maguire camm@enhanced.com ========================================================================== "The earth is but one country, and mankind its citizens." -- Baha'u'llah