Re: can't install 2.8.4-1 on Fedora Core 5

[John Mandereau]

Le mercredi 07 juin 2006 à 12:00 +0400, Roman V. Isaev a écrit :
> On 06/06, Han-Wen Nienhuys wrote:
> > >>>/usr/local//lilypond/usr/bin/lilypond: error while loading shared 
> > >>>libraries: /usr/local/lilypond/usr/bin/../lib/libfreetype.so.6: cannot 
> > >>>restore segment prot after reloc: Permission denied
> > >>>What's wrong?
> > >>Never seen this before. What's your platform exactly? (cpu architecture?)
> > >uname -a:
> > >Linux dragon.xyz.ru. 2.6.16-1.2111_FC5smp #1 SMP Thu May 4 21:35:09 EDT 
> > >2006 i686 i686 i386 GNU/Linux
> > >An old rpm lilypond-2.7.18-1.i386.rpm starts okay.
> > a quick google shows that this is related to SELinux settings. Can you 
> > investigate further for the proper solution yoursefl ?
> 
>       Ugh, I disabled SELinux and lilypond works now. But it's a wrong 
> solution 
> I suspect... :)
> 

Hello, sorry for the late reply, but I had no time to read all emails on
the list before...

This is a very popular issue on FC5, as it also pops up with other
applications like MPlayer.

You needn't completely disable SELinux for such an issue. The problem
is, libraries aren't allowed to relocate text on your FC5 system.
There are two workarounds:

1) The simplest, but maybe not the safest: allow text relocation for all
libraries. Run system-config-securitylevel, then in SELinux,
Compatibility, enable "Allow the use of shared libraries with Text
Relocation" (the boolean is /selinux/booleans/allow_execmod).

2) The most hassling: allow text relocation only for libraries which
need it. You must do it by hand for each library. The idea is to change
the library's security context type from lib_t to textrel_shlib_t. The 
textrel_shlib_t allows text relocation for a specific library, whatever
the value of /selinux/booleans/allow_execmod is. The command is:

chcon -t textrel_shlib_t /usr/local/lilypond/usr/bin/../lib/libfreetype.so.6


However, I find it strange that I haven't encountered this issue on my
FC5 box, where text relocation is denied by default.


Regards,
-- 
John Mandereau <address@hidden>