NVIDIA driver libraries shouldn't require execstack privileges

robhancock · 11-22-09, 10:46 PM

As shown in this thread and described on RPMFusion here, the NVIDIA driver currently requires the allow_execstack SELinux boolean to be enabled to work properly on Fedora 12. Is this going to be fixed? As the SELinux Management utility lists for this option, "This should never, ever be necessary. Probably indicates a badly coded executable."

littlebird · 11-23-09, 02:59 PM

I also would like to see a fix come about that does not require relaxing security measures. I personally have held off on installing the drivers onto my Fedora 12 box until this is in some way addressed.

robhancock · 11-29-09, 10:21 AM

It looks like the RPMFusion distribution of the drivers has fixed this problem in the version in updates-testing. Looks like they rebuilt some of the binaries from source.

Quote:

* Tue Nov 24 2009 Nicolas Chauvet <kwizart@fedoraproject.org> - 190.42-4
- Use nvidia-xconfig and nvidia-settings built from sources.

* Sat Nov 14 2009 Nicolas Chauvet <kwizart@fedoraproject.org> - 190.42-3
- Remove execstack on nvidia binaries and libraries.

mooninite · 11-29-09, 11:44 AM

Quote:

Originally Posted by robhan****

It looks like the RPMFusion distribution of the drivers has fixed this problem in the version in updates-testing. Looks like they rebuilt some of the binaries from source.

Those are open source programs, but it will not fix the problem. libGL.so & libGLcore.so are closed source and contain the insecure code requiring execstack.

thefirstm · 11-29-09, 12:20 PM

Quote:

Originally Posted by mooninite

Those are open source programs, but it will not fix the problem. libGL.so & libGLcore.so are closed source and contain the insecure code requiring execstack.

I think the code isn't necessarily insecure, but requires the execstack privileges for performance reasons. If I remember correctly, one of the Nvidia people said that those libraries require the privileges so that they can execute code natively in order to increase OpenGL performance. So, removing the need for those privileges might cause an OpenGL performance hit for everyone.

robhancock · 11-29-09, 12:32 PM

Quote:

Originally Posted by mooninite

Those are open source programs, but it will not fix the problem. libGL.so & libGLcore.so are closed source and contain the insecure code requiring execstack.

Well, I have allow_execstack turned off with this version and 3D seems to be working fine on my system..

mooninite · 11-29-09, 01:45 PM

Quote:

Originally Posted by robhan****

Well, I have allow_execstack turned off with this version and 3D seems to be working fine on my system..

nvidia-settings has nothing to do with 3D rendering.

Quote:

If I remember correctly, one of the Nvidia people said that those libraries require the privileges so that they can execute code natively in order to increase OpenGL performance.

It would be nice to dig up that quote.

robhancock · 11-29-09, 03:49 PM

Quote:

Originally Posted by mooninite

nvidia-settings has nothing to do with 3D rendering.

You were saying that the GL libraries require execstack, I'm saying that GL seems to be working fine with allow_execstack turned off.

Milena · 11-29-09, 08:37 PM

I installed the Nvidia .run driver on Fedora 12 just like I did on F10+11 before, never used the RPMFusion one and there is no need at all for the allow_execstack boolean, everything works as intended.

xorbe · 11-30-09, 08:09 PM

I remember reading somewhere that the driver uses self modifying code for speed.

11-22-09, 10:46 PM	#1
robhancock Registered User Join Date: Dec 2004 Posts: 31	NVIDIA driver libraries shouldn't require execstack privileges As shown in this thread and described on RPMFusion here, the NVIDIA driver currently requires the allow_execstack SELinux boolean to be enabled to work properly on Fedora 12. Is this going to be fixed? As the SELinux Management utility lists for this option, "This should never, ever be necessary. Probably indicates a badly coded executable."

11-23-09, 02:59 PM	#2
littlebird Registered User Join Date: Nov 2009 Posts: 3	Re: NVIDIA driver libraries shouldn't require execstack privileges I also would like to see a fix come about that does not require relaxing security measures. I personally have held off on installing the drivers onto my Fedora 12 box until this is in some way addressed.

11-29-09, 08:37 PM	#9
Milena Registered User Join Date: Mar 2009 Posts: 36	Re: NVIDIA driver libraries shouldn't require execstack privileges I installed the Nvidia .run driver on Fedora 12 just like I did on F10+11 before, never used the RPMFusion one and there is no need at all for the allow_execstack boolean, everything works as intended.

11-30-09, 08:09 PM	#10
xorbe Unbuffered User Join Date: Jun 2005 Posts: 388	Re: NVIDIA driver libraries shouldn't require execstack privileges I remember reading somewhere that the driver uses self modifying code for speed.