Problems with snmpd following update.

[Stephen Smalley]

On Wed, 2006-02-01 at 18:54 +0000, David Rye wrote:
> Which on my limited understanding looks correct and I think means that
> snmpd executes with a
> custom policy indicated by the snmpd_exec_t bit.
> 
> Does this mean that there is a bug in the policy for snmpd defined by
> the rpm
> selinux-policy-targeted-1.17.30-3.19 ?

No, it means that libbeecrypt.so.6 is incorrectly marked by the
toolchain as requiring an executable stack.  This was corrected in FC4.
Use execstack -c to clear the marking to avoid triggering an executable
stack there so that you don't have to allow it in policy (which would
expose you to risk).  The /etc/selinux/config denials are just noise;
libselinux always tries to open it from constructor, so any program that
happens to link with it triggers attempts there, which are normally
silenced in enforcing mode by dontaudit rules.
 
-- 
Stephen Smalley
National Security Agency