SELinux error when using pgf95 executables with valgrind

Accelerated Computing HPC Compilers Legacy PGI Compilers
1

Hello,

Not sure if this is the right forum, so apologies in advance if not.

I run pgf95 7.2-4 on a RHE5.0 system and when I use pgf95-generated executable with the valgrind memcheck tool, SELinux gives me a warning:

Summary:
SELinux is preventing memcheck from loading /usr/local/pgi/linux86/7.2-4/lib/libpgc.so which requires text relocation.

Detailed Description:
The memcheck application attempted to load /usr/local/pgi/linux86/7.2-4/lib/libpgc.so which requires text relocation. This is a potential security problem. Most libraries do not need this permission. Libraries are sometimes coded incorrectly and request this permission. The SELinux Memory Protection Tests web page explains how to remove this requirement. You can configure SELinux temporarily to allow /usr/local/pgi/linux86/7.2-4/lib/libpgc.so to use relocation as a workaround, until the library is fixed. Please file a bug report against this package.

Is this issue with text relocation something PGI is aware of and looking to fix (assuming the above assessment is accurate)? Fixed in a later version?

FWIW, g95 and gfortran don’t exhibit the problem when their executables are run through valgrind

cheers,

paulv

2

Hi Paul,

We are aware of this issue (see pgf77 and selinux issue - solution found (please fix)) and have a feature request pending. However after investigating the issue, we have determined that the solution of adding PIC code to the 32-bit libraries would cause a severe performance penalty. So we’re concerned that the fix for 32-bit SELinux would have a detrimental impact on rest of our 32-bit users.

How critical of an issue is this? Would you be able to statically link your code (-Bstatic_pgi)?

Thanks,
Mat

3

Hi Mat,

Thanks for the quick reply.

Right now it’s not critical. However, IT security being what it is, I can imagine someone will soon decide that SELinux running in permissive mode is bad and, thus, bugger up my current setup.

If statically linking the code will allow me to compile and test with an anal SELinux setup, I’ll do that.

Thanks for the info.

cheers,

paulv