Re: [gentoo-hardened] mysql 4.1 requires shlib_t:file execmod?

[Antoine Martin <antoine@nagafix.co.uk>]

On Mon, 2005-10-24 at 15:47 +0200, pageexec@freemail.hu wrote:
> On 23 Oct 2005 at 21:42, Antoine Martin wrote:
> 
> ok, so this is the story of the textrelocs in libmysqlclient:
> 
> > open("/usr/lib/libmysqlclient.so.14", O_RDONLY) = 3
> > mmap2(NULL, 2061732, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3,
> > 0) = 0xb7d24000
> > mprotect(0xb7d24000, 1073152, PROT_READ|PROT_WRITE) = 0
> > mprotect(0xb7d24000, 1073152, PROT_READ|PROT_EXEC) = -1 EACCES
> > (Permission denied)
> 
> this is either PaX (if you have NOELFRELOCS on) or SELinux,
> i think they call it execmem or something like that.
Yes, I started this thread and CCed the SELinux list.
I can make this work by allowing postfix to execmem all shlibs.
ie for all the postfix domains:
allow postfix_{domain}_t shlib_t:file execmod;

But this is not the right way to do it, I admit this is only a very tiny
security risk, but I would much rather figure out a way to fix the
library to not require execmod. No other library requires it, and the
previous version of mysql I was using (4.0) didn't either.

> what do 'scanelf -T /usr/lib/libmysqlclient.so.14' or
>         'eu-findtextrel /usr/lib/libmysqlclient.so.14'
> say (it can't be 'nothing' for sure ;-)? eu-findtexrel
> is in dev-libs/elfutils.
# scanelf -T /usr/lib/libmysqlclient.so.14
 TYPE   TEXTRELS FILE
        TEXTREL libmysqlclient.so.14: DES_encrypt2 [0xDAD5C] in
DES_encrypt3 [0xDACD0]
        TEXTREL libmysqlclient.so.14: DES_encrypt2 [0xDAD70] in
DES_encrypt3 [0xDACD0]
        TEXTREL libmysqlclient.so.14: DES_encrypt2 [0xDAD84] in
DES_encrypt3 [0xDACD0]
        TEXTREL libmysqlclient.so.14: DES_encrypt2 [0xDAE8C] in
DES_decrypt3 [0xDAE00]
        TEXTREL libmysqlclient.so.14: DES_encrypt2 [0xDAEA0] in
DES_decrypt3 [0xDAE00]
        TEXTREL libmysqlclient.so.14: DES_encrypt2 [0xDAEB4] in
DES_decrypt3 [0xDAE00]
        TEXTREL libmysqlclient.so.14: DES_encrypt1 [0xDAF82] in
DES_ncbc_encrypt [0xDAF30]
        TEXTREL libmysqlclient.so.14: DES_encrypt1 [0xDAFEA] in
DES_ncbc_encrypt [0xDAF30]
        TEXTREL libmysqlclient.so.14: DES_encrypt1 [0xDB01B] in
DES_ncbc_encrypt [0xDAF30]
        TEXTREL libmysqlclient.so.14: DES_encrypt1 [0xDB067] in
DES_ncbc_encrypt [0xDAF30]
        TEXTREL libmysqlclient.so.14: DES_encrypt3 [0xDB14B] in
DES_ede3_cbc_encrypt [0xDB0F0]
        TEXTREL libmysqlclient.so.14: DES_encrypt3 [0xDB1B3] in
DES_ede3_cbc_encrypt [0xDB0F0]
        TEXTREL libmysqlclient.so.14: DES_decrypt3 [0xDB1EB] in
DES_ede3_cbc_encrypt [0xDB0F0]
        TEXTREL libmysqlclient.so.14: DES_decrypt3 [0xDB237] in
DES_ede3_cbc_encrypt [0xDB0F0]
        TEXTREL libmysqlclient.so.14: RC5_32_encrypt [0xDD461] in
RC5_32_cbc_encrypt [0xDD410]
        TEXTREL libmysqlclient.so.14: RC5_32_encrypt [0xDD4C9] in
RC5_32_cbc_encrypt [0xDD410]
        TEXTREL libmysqlclient.so.14: RC5_32_decrypt [0xDD4FB] in
RC5_32_cbc_encrypt [0xDD410]
        TEXTREL libmysqlclient.so.14: RC5_32_decrypt [0xDD547] in
RC5_32_cbc_encrypt [0xDD410]
        TEXTREL libmysqlclient.so.14: BF_encrypt [0xDFB45] in
BF_cbc_encrypt [0xDFAF0]
        TEXTREL libmysqlclient.so.14: BF_encrypt [0xDFBB5] in
BF_cbc_encrypt [0xDFAF0]
        TEXTREL libmysqlclient.so.14: BF_decrypt [0xDFBEF] in
BF_cbc_encrypt [0xDFAF0]
        TEXTREL libmysqlclient.so.14: BF_decrypt [0xDFC43] in
BF_cbc_encrypt [0xDFAF0]
ET_DYN  /usr/lib/libmysqlclient.so.14

Hope this helps...

Many thanks
Antoine

-- 
gentoo-hardened@gentoo.org mailing list