SELinux and “failed to map segment from shared object” error


I am reading and following examples in MySQL 5.1 Plugin Development. After compiling and moving a .so file (think DLL or Assembly file in Windows) into MySQL plugin directory, I got this message when I tried to create a UDF (User Defined Function):

[sourcecode language=”text”]
mysql> create function udf_staticexample returns integer soname ‘udf_staticexample.so’;
ERROR 1126 (HY000): Can’t open shared library ‘udf_staticexample.so’ (errno: 0 /usr/lib/mysql/plugin/udf_staticexample.so: failed to map segment from shared object: Permission denied)
[/sourcecode]

This is caused by the fact that the .so shared object file is not in the right SELinux security context:

[sourcecode language=”text”]
[root@asusfedora plugin]# ll -Z
lrwxrwxrwx. root root system_u:object_r:lib_t:s0 ha_archive.so -> ha_archive.so.0.0.0
lrwxrwxrwx. root root system_u:object_r:lib_t:s0 ha_archive.so.0 -> ha_archive.so.0.0.0
-rwxr-xr-x. root root system_u:object_r:lib_t:s0 ha_archive.so.0.0.0
lrwxrwxrwx. root root system_u:object_r:lib_t:s0 ha_blackhole.so -> ha_blackhole.so.0.0.0
lrwxrwxrwx. root root system_u:object_r:lib_t:s0 ha_blackhole.so.0 -> ha_blackhole.so.0.0.0
-rwxr-xr-x. root root system_u:object_r:lib_t:s0 ha_blackhole.so.0.0.0
lrwxrwxrwx. root root system_u:object_r:lib_t:s0 ha_example.so -> ha_example.so.0.0.0
lrwxrwxrwx. root root system_u:object_r:lib_t:s0 ha_example.so.0 -> ha_example.so.0.0.0
-rwxr-xr-x. root root system_u:object_r:lib_t:s0 ha_example.so.0.0.0
lrwxrwxrwx. root root system_u:object_r:lib_t:s0 ha_federated.so -> ha_federated.so.0.0.0
lrwxrwxrwx. root root system_u:object_r:lib_t:s0 ha_federated.so.0 -> ha_federated.so.0.0.0
-rwxr-xr-x. root root system_u:object_r:lib_t:s0 ha_federated.so.0.0.0
-rwxr-xr-x. root root unconfined_u:object_r:user_home_t:s0 udf_staticexample.so
[/sourcecode]

To fix this, use chcon –reference to change the security context of the file in question to a referenced file, like this:

[sourcecode language=”text”]
[root@asusfedora plugin]# chcon –reference=/usr/lib/mysql/plugin/ha_archive.so /usr/lib/mysql/plugin/udf_staticexample.so
[root@asusfedora plugin]# ll -Z
lrwxrwxrwx. root root system_u:object_r:lib_t:s0 ha_archive.so -> ha_archive.so.0.0.0
lrwxrwxrwx. root root system_u:object_r:lib_t:s0 ha_archive.so.0 -> ha_archive.so.0.0.0
-rwxr-xr-x. root root system_u:object_r:lib_t:s0 ha_archive.so.0.0.0
lrwxrwxrwx. root root system_u:object_r:lib_t:s0 ha_blackhole.so -> ha_blackhole.so.0.0.0
lrwxrwxrwx. root root system_u:object_r:lib_t:s0 ha_blackhole.so.0 -> ha_blackhole.so.0.0.0
-rwxr-xr-x. root root system_u:object_r:lib_t:s0 ha_blackhole.so.0.0.0
lrwxrwxrwx. root root system_u:object_r:lib_t:s0 ha_example.so -> ha_example.so.0.0.0
lrwxrwxrwx. root root system_u:object_r:lib_t:s0 ha_example.so.0 -> ha_example.so.0.0.0
-rwxr-xr-x. root root system_u:object_r:lib_t:s0 ha_example.so.0.0.0
lrwxrwxrwx. root root system_u:object_r:lib_t:s0 ha_federated.so -> ha_federated.so.0.0.0
lrwxrwxrwx. root root system_u:object_r:lib_t:s0 ha_federated.so.0 -> ha_federated.so.0.0.0
-rwxr-xr-x. root root system_u:object_r:lib_t:s0 ha_federated.so.0.0.0
-rwxr-xr-x. root root system_u:object_r:lib_t:s0 udf_staticexample.so
[/sourcecode]

All is well afterwards.

[sourcecode language=”text”]
mysql> create function udf_staticexample returns integer soname ‘udf_staticexample.so’;
Query OK, 0 rows affected (0.00 sec)

mysql> select udf_staticexample();
+———————+
| udf_staticexample() |
+———————+
| 318749 |
+———————+
1 row in set (0.00 sec)
[/sourcecode]

, ,

Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.