Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Short version: What is the most secure way to allow Java 7 to run on (with?) SELinux?

Long version:

Sorry in advance if I use incorrect terminology. I'm really just a Java developer with a meager smattering of Linux skills.

I just installed Java 7 on CentOS release 5.3 (Final) that is apparently has Security Enhanced Linux. After the install was complete (which I "installed" by unzipping the tar.gz file from Oracle in /usr/java/jdk/jdk1.7.0_25), I ran java -version and got this error:

Error: dl failure on line 864
Error: failed /usr/java/jdk1.7.0_25/jre/lib/i386/server/libjvm.so,
      because /usr/java/jdk1.7.0_25/jre/lib/i386/server/libjvm.so:
      cannot restore segment prot after reloc: Permission denied`

I found a few articles stating this can be due to SELinux and to try setenforce 0 and see if the problem goes away. I ran that command and Java worked. But these same articles say that leaving setenforce 0 on an Internet connected host is dangerous, and my host is connected to the Internet.

There are other articles that suggest this next approach, but also say it can be dangerous, so I haven't tried it yet.

chcon -t textrel_shlib_t /usr/jre1.7.0_10/lib/i386/client/libjvm.so

...in the above command the path at the end of the command is replaced with the path of my JDK.

What I can't find is something "official" (which can mean many things) on how to run Java 7 on (with?) SELinux safely. Does anyone have any information for me?

Edit: I discovered an article that referred to editing /etc/selinux/config. I have set as shown in the sample below. This allows Java to run but I assume I now have some security holes.

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#       enforcing - SELinux security policy is enforced.
#       permissive - SELinux prints warnings instead of enforcing.
#       disabled - SELinux is fully disabled.
SELINUX=permissive
# SELINUXTYPE= type of policy in use. Possible values are:
#       targeted - Only targeted network daemons are protected.
#       strict - Full SELinux protection.
SELINUXTYPE=targeted
share|improve this question
    
The chcon solution looks reasonable. The last solution isn't much different than setenforce 0. –  jordanm Aug 2 '13 at 15:06
    
Can you just install it in your home directory instead? –  Thorbjørn Ravn Andersen Aug 6 '13 at 9:55
    
@ThorbjørnRavnAndersen: Well, I suppose I could, but it runs as a daemon, a Tomcat server to be more specific, and somehow it feels a little sloppy to have a Tomcat server running from my home directory. –  John Fitzpatrick Aug 6 '13 at 20:37

1 Answer 1

  1. Clean up the current installation

  2. Download the RPM file (http://www.oracle.com/technetwork/java/javase/downloads/jdk7-downloads-1880260.html)

    yum -y localinstall /path/to/downloaded-java.rpm
    

rest will be taken care.

share|improve this answer
    
Thanks. Can you elaborate on "Clean up the current installation"? Do you mean remove what I installed? –  John Fitzpatrick Aug 6 '13 at 20:34
    
Yes, that's right! Remove your current Oracle Java installation. Please follow "Self-extracting file uninstall" java.com/en/download/help/linux_uninstall.xml#self –  user44441 Aug 7 '13 at 11:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.