"denied" error message

[Stephen Smalley]

On Wed, 2007-07-25 at 16:03 -0400, Bill Tangren wrote:
> Bill Tangren wrote:
> > I have the following error message showing up in my audit logs. This is 
> > on an SELinux-enabled web server (running RHEL ES 4, fully patched). 
> > This is actually an selinux error, so if this not the correct place to 
> > ask this question, please let me know.
> > 
> 
> Never mind. I got at least a partial answer by googling NSA's selinux mailing 
> list archive. I quote from one of those pages:
> 
> "Typically, that audit message suggests that kernel is translating PROT_READ 
> requests by that binary to PROT_READ|PROT_EXECUTE in order to provide 
> compatibility with "legacy" binaries that presumed read-implies-exec logic."
> 
> This is an old program that is calling shared libraries. It isn't hurting the 
> program, but it is filling up my audit logs. I guess I'll leave it alone.
> 
> Thanks anyway.
> 

Options:
- Rebuild the program with current compiler toolchain.
- Try to mark the program as not requiring an executable stack,
	cp /location/of/bin/aa_pap8 /location/of/bin/aa_pap8.orig
	execstack -c /location/of/bin/aa_pap8
- Modify your policy to dontaudit the permission or to allow it, as
required.

-- 
Stephen Smalley
National Security Agency