Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: atrpms: users

Mythtv and Fedora 11 SeLinux policy

 

 

atrpms users RSS feed   Index | Next | Previous | View Threaded


briandlong at gmail

Aug 31, 2009, 6:09 AM

Post #1 of 9 (1341 views)
Permalink
Mythtv and Fedora 11 SeLinux policy

I was playing with Mythtv 0.21-fixes "bijou" on my F11 machine with default
SELinux policy and noticed a few problems:

SELinux is preventing mythfrontend from loading
/usr/lib/mythtv/filters/libgreedyhdeint.so which requires text relocation
SELinux is preventing mythfrontend from loading
/usr/lib/nvidia-graphics-185.18.14/libvdpau_nvidia.so.185.18.14 which
requires text relocation

According to http://people.redhat.com/drepper/textrelocs.html, a compiler
flag change (-fPIC, -fpic, -fPIE, -fpie, etc) could fix the text relocation
issues. Since we cannot modify the compiler flags for the nvidia binary, I
believe the SELinux policy has to be relaxed for
libvdpau_nvidia.so.185.18.14; however, I believe the libgreedyhdeint.so
issue could be resolved at compile-time.

I've not compiled MythTV from source for a long time, so I don't know if
this is something that would need to take place upstream before AtRPMS would
accept the compiler flag change. If so, maybe AtRPMS could consider adding
the appropriate semanage / chcon commands to the MythTV & nvidia RPMs.

Thanks.

/Brian/


Axel.Thimm at ATrpms

Aug 31, 2009, 1:22 PM

Post #2 of 9 (1271 views)
Permalink
Re: Mythtv and Fedora 11 SeLinux policy [In reply to]

On Mon, Aug 31, 2009 at 09:09:31AM -0400, Brian Long wrote:
> I was playing with Mythtv 0.21-fixes "bijou" on my F11 machine with default
> SELinux policy and noticed a few problems:
>
> SELinux is preventing mythfrontend from loading
> /usr/lib/mythtv/filters/libgreedyhdeint.so which requires text relocation
> SELinux is preventing mythfrontend from loading
> /usr/lib/nvidia-graphics-185.18.14/libvdpau_nvidia.so.185.18.14 which
> requires text relocation
>
> According to http://people.redhat.com/drepper/textrelocs.html, a compiler
> flag change (-fPIC, -fpic, -fPIE, -fpie, etc) could fix the text relocation
> issues. Since we cannot modify the compiler flags for the nvidia binary, I
> believe the SELinux policy has to be relaxed for
> libvdpau_nvidia.so.185.18.14; however, I believe the libgreedyhdeint.so
> issue could be resolved at compile-time.
>
> I've not compiled MythTV from source for a long time, so I don't know if
> this is something that would need to take place upstream before AtRPMS would
> accept the compiler flag change.

I think mythtv already builds with -fPIC, I'll have to check the
buildlogs to be sure.

> If so, maybe AtRPMS could consider adding the appropriate semanage /
> chcon commands to the MythTV & nvidia RPMs.

Sure, but I must admit that I know next to nothing on how to do this
correctly in a specfile. Most similar examples are fixed by the
centrally managed policies, if you know of a good example where and
how to place proper selinux manipulation bits in the specfile, I'll be
glad to do it. I know the rpm format can carry selinux information, so
it looks like it needs to be in %install and not %post.
--
Axel.Thimm at ATrpms.net


ylee at pobox

Sep 1, 2009, 3:15 AM

Post #3 of 9 (1253 views)
Permalink
Re: Mythtv and Fedora 11 SeLinux policy [In reply to]

Axel Thimm <Axel.Thimm [at] ATrpms> says:
> I think mythtv already builds with -fPIC, I'll have to check the
> buildlogs to be sure.

My system indeed builds the SRPM with -fPIC.

--
Yeechang Lee <ylee [at] pobox> | San Francisco CA US

_______________________________________________
atrpms-users mailing list
atrpms-users [at] atrpms
http://lists.atrpms.net/mailman/listinfo/atrpms-users


Axel.Thimm at ATrpms

Sep 2, 2009, 7:21 AM

Post #4 of 9 (1250 views)
Permalink
Re: Mythtv and Fedora 11 SeLinux policy [In reply to]

On Tue, Sep 01, 2009 at 03:15:06AM -0700, Yeechang Lee wrote:
> Axel Thimm <Axel.Thimm [at] ATrpms> says:
> > I think mythtv already builds with -fPIC, I'll have to check the
> > buildlogs to be sure.
>
> My system indeed builds the SRPM with -fPIC.

I can confirm this - and Brian's mythtv, who is using F11/i586 had
this in the buildlog:

gcc -c -pipe -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-pro
tector --param=ssp-buffer-size=4 -m32 -march=i586 -mtune=generic -fasynchronous-
unwind-tables -fomit-frame-pointer -pthread -Wall -Wno-switch -Wdisabled-optimiz
ation -Wpointer-arith -Wredundant-decls -Wno-pointer-sign -Wno-missing-prototype
s -D_REENTRANT -DPIC -fPIC -DMMX -Di386 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D
QT_NO_DEBUG -DQT_THREAD_SUPPORT -DQT_PLUGIN -DQT_SHARED -DQT_TABLET_SUPPORT -I/u
sr/lib/qt-3.3/mkspecs/default -I. -I/usr/include -I/usr/include -I/usr/include -
I../../libs/libavcodec -I../../libs/libavutil -I../../libs/libmythtv -I../../lib
s/libavcodec -I../.. -I/usr/lib/qt-3.3/include -o filter_greedyhdeint.o filter_g
reedyhdeint.c

So the flags are already in place. Something else seems to be wrong.
--
Axel.Thimm at ATrpms.net


briandlong at gmail

Sep 2, 2009, 10:18 AM

Post #5 of 9 (1247 views)
Permalink
Re: Mythtv and Fedora 11 SeLinux policy [In reply to]

On Wed, Sep 2, 2009 at 10:21 AM, Axel Thimm <Axel.Thimm [at] atrpms> wrote:

> On Tue, Sep 01, 2009 at 03:15:06AM -0700, Yeechang Lee wrote:
> > Axel Thimm <Axel.Thimm [at] ATrpms> says:
> > > I think mythtv already builds with -fPIC, I'll have to check the
> > > buildlogs to be sure.
> >
> > My system indeed builds the SRPM with -fPIC.
>
> I can confirm this - and Brian's mythtv, who is using F11/i586 had
> this in the buildlog:
>
> gcc -c -pipe -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions
> -fstack-pro
> tector --param=ssp-buffer-size=4 -m32 -march=i586 -mtune=generic
> -fasynchronous-
> unwind-tables -fomit-frame-pointer -pthread -Wall -Wno-switch
> -Wdisabled-optimiz
> ation -Wpointer-arith -Wredundant-decls -Wno-pointer-sign
> -Wno-missing-prototype
> s -D_REENTRANT -DPIC -fPIC -DMMX -Di386 -D_GNU_SOURCE
> -D_FILE_OFFSET_BITS=64 -D
> QT_NO_DEBUG -DQT_THREAD_SUPPORT -DQT_PLUGIN -DQT_SHARED -DQT_TABLET_SUPPORT
> -I/u
> sr/lib/qt-3.3/mkspecs/default -I. -I/usr/include -I/usr/include
> -I/usr/include -
> I../../libs/libavcodec -I../../libs/libavutil -I../../libs/libmythtv
> -I../../lib
> s/libavcodec -I../.. -I/usr/lib/qt-3.3/include -o filter_greedyhdeint.o
> filter_g
> reedyhdeint.c
>
> So the flags are already in place. Something else seems to be wrong.
>

Does this help?
> eu-findtextrel /usr/lib/mythtv/filters/libgreedyhdeint.so
either the file containing the function 'GreedyHDeintFilter' or the file
containing the function 'apply_chroma_filter' is not compiled with
-fpic/-fPIC

I'm not too familiar with -fPIC and -fPIE, but I ran the utility mentioned
at the redhat.com URL and it output the above line multiple times. It
appears apply_chroma_filter is contained in color.c. Are the build logs
publicly available?

/Brian/


Axel.Thimm at ATrpms

Sep 2, 2009, 11:24 AM

Post #6 of 9 (1246 views)
Permalink
Re: Mythtv and Fedora 11 SeLinux policy [In reply to]

On Wed, Sep 02, 2009 at 01:18:45PM -0400, Brian Long wrote:
> On Wed, Sep 2, 2009 at 10:21 AM, Axel Thimm <Axel.Thimm [at] atrpms> wrote:
>
> > On Tue, Sep 01, 2009 at 03:15:06AM -0700, Yeechang Lee wrote:
> > > Axel Thimm <Axel.Thimm [at] ATrpms> says:
> > > > I think mythtv already builds with -fPIC, I'll have to check the
> > > > buildlogs to be sure.
> > >
> > > My system indeed builds the SRPM with -fPIC.
> >
> > I can confirm this - and Brian's mythtv, who is using F11/i586 had
> > this in the buildlog:
> >
> > gcc -c -pipe -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions
> > -fstack-pro
> > tector --param=ssp-buffer-size=4 -m32 -march=i586 -mtune=generic
> > -fasynchronous-
> > unwind-tables -fomit-frame-pointer -pthread -Wall -Wno-switch
> > -Wdisabled-optimiz
> > ation -Wpointer-arith -Wredundant-decls -Wno-pointer-sign
> > -Wno-missing-prototype
> > s -D_REENTRANT -DPIC -fPIC -DMMX -Di386 -D_GNU_SOURCE
> > -D_FILE_OFFSET_BITS=64 -D
> > QT_NO_DEBUG -DQT_THREAD_SUPPORT -DQT_PLUGIN -DQT_SHARED -DQT_TABLET_SUPPORT
> > -I/u
> > sr/lib/qt-3.3/mkspecs/default -I. -I/usr/include -I/usr/include
> > -I/usr/include -
> > I../../libs/libavcodec -I../../libs/libavutil -I../../libs/libmythtv
> > -I../../lib
> > s/libavcodec -I../.. -I/usr/lib/qt-3.3/include -o filter_greedyhdeint.o
> > filter_g
> > reedyhdeint.c
> >
> > So the flags are already in place. Something else seems to be wrong.
> >
>
> Does this help?
> > eu-findtextrel /usr/lib/mythtv/filters/libgreedyhdeint.so
> either the file containing the function 'GreedyHDeintFilter' or the file
> containing the function 'apply_chroma_filter' is not compiled with
> -fpic/-fPIC
>
> I'm not too familiar with -fPIC and -fPIE, but I ran the utility mentioned
> at the redhat.com URL and it output the above line multiple times. It
> appears apply_chroma_filter is contained in color.c. Are the build logs
> publicly available?

No, they are not, and they should, so I don't have to dig them up :)

color.c was built with the same options:

gcc -c -pipe -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-pro
tector --param=ssp-buffer-size=4 -m32 -march=i586 -mtune=generic -fasynchronous-
unwind-tables -fomit-frame-pointer -pthread -Wall -Wno-switch -Wdisabled-optimiz
ation -Wpointer-arith -Wredundant-decls -Wno-pointer-sign -Wno-missing-prototype
s -D_REENTRANT -DPIC -fPIC -DMMX -Di386 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D
QT_NO_DEBUG -DQT_THREAD_SUPPORT -DQT_PLUGIN -DQT_SHARED -DQT_TABLET_SUPPORT -I/u
sr/lib/qt-3.3/mkspecs/default -I. -I/usr/include -I/usr/include -I/usr/include -
I../../libs/libavcodec -I../../libs/libavutil -I../../libs/libmythtv -I../../lib
s/libavcodec -I../.. -I/usr/lib/qt-3.3/include -o color.o color.c

So anything that libgreedyhdeint.so is built from is built with -fPIC,
but AFAIK if there is some asm in there it can make it non-relocatable
as well. And both color.c and filter_greedyhdeint.c (which includes
greedyh.asm) have asm code inside. If one wants to fix this one needs
to fix upstream the asm code. The Red Hat URL further quotes on that:

The tool is not able to distinguish compiler-generated code
from assembler code written by the programmer. In both cases
the tool will print the message above since it is what is
correct in 99% of all cases. If the problem is indeed the
result of hand-written assembler code the solution is not as
simple as adding a compiler/assembler flag. The code needs to
be rewritten. This is architecture specific and can vary widely
between every single instance. We are not going into those
details here. Find a person with sufficient assembly
programming skills if this problem appears.

--
Axel.Thimm at ATrpms.net


briandlong at gmail

Sep 3, 2009, 6:36 AM

Post #7 of 9 (1224 views)
Permalink
Re: Mythtv and Fedora 11 SeLinux policy [In reply to]

On Wed, Sep 2, 2009 at 2:24 PM, Axel Thimm <Axel.Thimm [at] atrpms> wrote:

> <snip>
> So anything that libgreedyhdeint.so is built from is built with -fPIC,
> but AFAIK if there is some asm in there it can make it non-relocatable
> as well. And both color.c and filter_greedyhdeint.c (which includes
> greedyh.asm) have asm code inside. If one wants to fix this one needs
> to fix upstream the asm code. The Red Hat URL further quotes on that:
>
> The tool is not able to distinguish compiler-generated code
> from assembler code written by the programmer. In both cases
> the tool will print the message above since it is what is
> correct in 99% of all cases. If the problem is indeed the
> result of hand-written assembler code the solution is not as
> simple as adding a compiler/assembler flag. The code needs to
> be rewritten. This is architecture specific and can vary widely
> between every single instance. We are not going into those
> details here. Find a person with sufficient assembly
> programming skills if this problem appears.
>

I opened a Trac ticket with MythTV devs:
http://svn.mythtv.org/trac/ticket/6973

Considering the push for 0.22 right now, I doubt it will be fixed in the
short-term.

With regards to your RPMs, would it make sense to place the appropriate
semanage and chcon commands inside the %post of the nvidia rpms so that the
libvdpau_nvidia.so.<version> will load properly while SELinux is
configured? Or do you prefer to leave SELinux management to the end user?

Thanks.

/Brian/


Axel.Thimm at ATrpms

Sep 3, 2009, 6:46 AM

Post #8 of 9 (1235 views)
Permalink
Re: Mythtv and Fedora 11 SeLinux policy [In reply to]

On Thu, Sep 03, 2009 at 09:36:29AM -0400, Brian Long wrote:
> With regards to your RPMs, would it make sense to place the appropriate
> semanage and chcon commands inside the %post of the nvidia rpms so that the
> libvdpau_nvidia.so.<version> will load properly while SELinux is
> configured?

Yes, can you make a copy & paste suggestion? Similar for the mythtv
problem with selinux, I wouldn't mind adding selinux tagging.

There is a reason not to, because some solutions do that in %post
which manes that there needs to be a runtime dependency on the selinux
tools. I think that rpm is smart enough to carry the selinux tags as
file attributes within the rpm format, but a quick google doesn't show
how to add these during the build.

It doesn't matter much for the mythtv install, as there are anyway a
million and one dependency, but maybe the nvidia packages on a thin
client wouldn't want to have the selinux management tools and their
dependencies pulled in. I don't know, how do others think?

> Or do you prefer to leave SELinux management to the end user?

SELinux management to the end user means the end users are just high
profile admins :)
--
Axel.Thimm at ATrpms.net


john.robinson at anonymous

Sep 3, 2009, 7:19 AM

Post #9 of 9 (1237 views)
Permalink
Re: Mythtv and Fedora 11 SeLinux policy [In reply to]

On 03/09/2009 14:46, Axel Thimm wrote:
[...]
> There is a reason not to, because some solutions do that in %post
> which manes that there needs to be a runtime dependency on the selinux
> tools.

Yes, but perhaps you could surround the relevant section with something like
if which chcon &>/dev/null ; then
whatever
fi

Cheers,

John.


_______________________________________________
atrpms-users mailing list
atrpms-users [at] atrpms
http://lists.atrpms.net/mailman/listinfo/atrpms-users

atrpms users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.