SELinux doesn't like much lately, in that regard this is unsurprising.
@MrSchism
It's strange that a software need this permission really.
Some raw logs :
type=AVC msg=audit(1355994685.521:407): avc: denied { execheap } for pid=4329 comm="MainThrd" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process
type=SYSCALL msg=audit(1355994685.521:407): arch=40000003 syscall=125 success=no exit=-13 a0=e9ac000 a1=c000 a2=7 a3=fff5bfcc items=0 ppid=4283 pid=4329 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=2 tty=pts1 comm="MainThrd" exe="/home/michael/Steam/ubuntu12_32/steam" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=ANOM_ABEND msg=audit(1355994685.624:408): auid=1000 uid=1000 gid=1000 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=4329 comm="MainThrd" reason="memory violation" sig=11
It's really not that strange to see code being built up dynamically. It's getting more common in modern applications, especially with JIT compilation under the hood (I'm assuming Steam is doing this). I'm not really familiar with the specific rules for SELinux, but I'd think execheap is almost a necessity for those applications.
But, why it use execheap randomly ?
On Thu, Dec 20, 2012 at 7:29 AM, Stijn van Drongelen <
[email protected]> wrote:
It's really not that strange to see code being built up dynamically. It's
getting more common in modern applications, especially with JIT compilation
under the hood (I'm assuming Steam is doing this). I'm not really familiar
with the specific rules for SELinux, but I'd think execheap is almost a
necessity for those applications.—
Reply to this email directly or view it on GitHubhttps://github.com/ValveSoftware/steam-for-linux/issues/88#issuecomment-11571683.
What do you mean by "randomly"?
Looking more closely, it is actually a bug. If you decode the error log (syscall=125 refers to sys_mprotect), it seems Steam tried to make the following call:
sys_mprotect(0x0E9AC000, 49152 /* 48 kibibyte */, PROT_READ | PROT_WRITE | PROT_EXEC);
It is always a Bad Thing to try to make a slab of memory both writable and executable. On Windows, the same thing would be forbidden under Data Execution Prevention (DEP). This should be fixed.
By randomly I would say: it only cause problem for specific key registration.
At what point when running Steam does this happen? Steam hosts web pages which use JavaScript and WebKit will JIT that code, so execheap is necessary.
@gdrewb-valve It happened when he was adding a game key (source: OP). This is an actual bug, because a system call tried to make memory both writable and executable (in general, it should only be one at once) (source: @Tinctorius).
Either the WebKit JIT compiler should be replaced by an interpreter (when NX is enforced), or the JIT code should be fixed to work with NX enforcement of writable pages. A properly programmed JIT compiler doesn't need memory to be both writable and executable, because it won't rewrite code that's already compiled.
Have you passed that feedback on to the WebKit folks? I don't see an open issue mentioning selinux problems but this may be something they've already dealt with.
They seem to be invalidating the issue without further investigation. The report doesn't have sufficient information, so I've opened a new ticket to avoid confusion.
Thanks for passing that on to the WebKit team.
I understand that you would like to pass the ticket to Webkit team as it is their ownership. However, as steam made the choice of going with Webkit, I think steam at the very least should track this issue. I would rather have a status like "waiting on dependent team/project" than have the issue closed.
This is hilarious. Seriously these threads go back to 2013.
Started getting it again, finally looked around to find out why and now I remember.. Literally searching for execheap and steam turns up some awesome security fails on Valves part. Threads all being closed by them of course. So why is this popping up again?
In my case, tf2 and I suspect mp3 related. Joined a server with quakesounds which sent the client into a ballistic fit since it couldn't decode the mp3s.
OS : Fedora 18
Main updates repos : updates-testing
Arch : x64
When : Add new Humble Bundle Keys
:-1:
SELinux is preventing /home/michael/Steam/ubuntu12_32/steam from using the execheap access on a process.
Plugin: catchall_boolean
you want to allow steam to have execheap access on the processIf vous souhaitez allow unconfined executables to make their heap memory executable. Doing this is a really bad idea. Probably indicates a badly coded executable, but could indicate an attack.
setsebool -P selinuxuser_execheap 1