Go Back

SELinux can prevent access to libraries used by Synergy/DE

Article Number: 2043
First Published:
Modified:
Recent Activity:
Views: 27
OS: Unix
Product: xfODBC, Operating System

Firstly, we recommend that SELinux be used with a minimum of Synergy/DE 12.1.1.


If a Synergy/DE component doesn\'t work for a new Synergy/DE installation on Linux, it may be that SELinux is preventing access to a shared library. Security-Enhanced Linux (SELinux) is a Linux feature that supports access control security policies, which can prevent access to shared libraries needed by various Synergy/DE components.


For example, if you have a new Connectivity Series installation on Linux and get the following error when you attempt to use xfODBC, SELinux settings could be the cause:


USER LOGIN 

ERROR [S1000] [TOD][ODBC Driver]DLLLOAD:GDS0,/synergex/9.1.5b/connect/GDS0.so: cannot restore segment prot after reloc: Permission denied ERROR [01000] [Microsoft][ODBC Driver Manager] The driver doesn\'t support the version of ODBC behavior that the application requested (see SQLSetEnvAttr)


You can solve this by setting the SELINUX environment variable to OFF, which turns off SELinux for the environment. However, if you want to use access control security policies, instead set the SELinux context of the shared library from a regular file (file_t) to a shared library that requires text relocation (textrel_shlib_t).


So, for example, if the issue is with GDS0.so (as in the example above) and the system is Red Hat Enterprise Linux 5+, you would use a command like the following to set the shared library to textrel_shlib__t:


# chcon -t textrel_shlib_t /yourPathToSynergyDE/connect/GDS0.so


Check with your system administrator for the command line you should use.


SELinux’s behavior is to block items that it does not recognize (such as processes, IP ports, system file access, etc.) and so you\'l need to configure SELinux to work with those items.  SELinux will report activities it has blocked to a log in the web admin console along with the commands needed to allow the blocked activity. You\'ll need to repeat this process of examining the log and unblocking the desired items until all is working as expected.



THE INFORMATION PROVIDED TO YOU IN THIS SERVICE IS FOR YOUR USE ONLY. THE INFORMATION MAY HAVE BEEN DEVELOPED INTERNALLY BY SYNERGEX OR BY EXTERNAL SOURCES. SYNERGEX MAKES NO WARRANTIES, EXPRESS OR IMPLIED, REGARDING THIS INFORMATION, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL SYNERGEX BE LIABLE FOR ANY DAMAGES OR LOSSES INCURRED BY YOU IN USING OR RELYING ON THIS INFORMATION, INCLUDING WITHOUT LIMITATION GENERAL DAMAGES, DIRECT, INCIDENTAL, SPECIAL OR CONSEQUENTIAL DAMAGES, OR LOSS OF PROFITS, EVEN IF SYNERGEX HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Please log in to comment on this article.