CentOS - Oct 2008 - ejabberd 2.0.2 vs SELinux vs CentOS 5

Lordy, I've been having problems with this darn thing, so I hope someone
can help me. :s


My troubles started when I downloaded the latest erlang and ejabberd
packages. I crashed and burned very quickly, trying two or three
different versions of erlang along with several of ejabberd 2.0.x.


Finally, after a week of pain, I admitted defeat, wiped the whole lot
and installed the binary on the process-one website.
Initially, the binary worked well, but mysteriously stopped working
whenever I changed the config file and restarted the file.


Anyway, to cut a long story short, I have discovered that SELinux is
preventing erlang from accessing its crypto libs.
This message appears in the SELinux audit logs:
type=AVC msg=audit(1223133076.770:102): avc:  denied  { execmod } for
pid=3878 comm="beam.smp"
path="/opt/ejabberd-2.0.2_2/lib/crypto-1.5.2/priv/linux-x86/lib/crypto_drv.so"
dev=dm-0 ino=26738869 scontext=user_u:system_r:unconfined_t:s0
tcontext=user_u:object_r:usr_t:s0 tclass=file


What do I need to do, for selinux to allow this?
(Or should I take this question to an SELinux list?)

FWIW, ejabberd seems to run fine while selinux is enabled. Its just when
starting up, that it needs selinux to stay out of the way.

To answer my question, I have found the allow_execmem boolean, and set
it.

So, should I file a bug with someone?

Also, I'm thinking I might run into more problems with SELinux silently
interfering with ejabberd later on, so maybe I should disable SELinux
and be done with it.

Does anyone here run ejabberd with SELinux enabled?

On Sun, 2008-10-05 at 03:02 +1100, Damian S wrote:
> Anyway, to cut a long story short, I have discovered that SELinux is
> preventing erlang from accessing its crypto libs.
> This message appears in the SELinux audit logs:
> type=AVC msg=audit(1223133076.770:102): avc:  denied  { execmod } for
> pid=3878 comm="beam.smp"
>
path="/opt/ejabberd-2.0.2_2/lib/crypto-1.5.2/priv/linux-x86/lib/crypto_drv.so"
dev=dm-0 ino=26738869 scontext=user_u:system_r:unconfined_t:s0
tcontext=user_u:object_r:usr_t:s0 tclass=file
Just one final thing (hope it helps someone in future), according to Dan
Walsh, much better (more fine-grained) than setting the allow_execmem
boolean is to do this:
chcon -t unconfined_execmem_exec_t /opt/ejabberd-2.0.2_2/bin/beam.smp