Issue Fix on 11g ($ORACLE_HOME/libnnz11.so)

环境：
Oracle Linux 5.2 32bit
Oracle Database 11g 11.1.0.7.0

现象：
执行sqlplus报错，
sqlplus: error while loading shared libraries: $ORACLE_HOME/lib/libnnz11.so: cannot restore segment prot after reloc: Permission denied

解决过程：
# tail -f /var/log/message
Sep 12 12:50:33 node1 setroubleshoot: SELinux is preventing sqlplus from loading /u01/app/oracle/product/11.1.0/dbhome_1/lib/libnnz11.so which requires text relocation. For complete SELinux messages. run sealert -l 3485ff82- 7fb5- 4150-b246- 2dd3e2cf679e

根据提示，执行：
# sealert -l 3485ff82-7fb5-4150-b246-2dd3e2cf679e
得到进一步信息

点击(此处)折叠或打开

1. Summary:
3. SELinux is preventing sqlplus from loading
4. /u01/app/oracle/product/11.1.0/dbhome_1/lib/libnnz11.so which requires text
5. relocation.
7. Detailed Description:
9. The sqlplus application attempted to load
10. /u01/app/oracle/product/11.1.0/dbhome_1/lib/libnnz11.so which requires text
11. relocation. This is a potential security problem. Most libraries do not need
12. this permission. Libraries are sometimes coded incorrectly and request this
13. permission. The SELinux Memory Protection Tests
14. (http://people.redhat.com/drepper/selinux-mem.html) web page explains how to
15. remove this requirement. You can configure SELinux temporarily to allow
16. /u01/app/oracle/product/11.1.0/dbhome_1/lib/libnnz11.so to use relocation as a
17. workaround, until the library is fixed. Please file a bug report
18. (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package.
20. Allowing Access:
22. If you trust /u01/app/oracle/product/11.1.0/dbhome_1/lib/libnnz11.so to run
23. correctly, you can change the file context to textrel_shlib_t. \"chcon -t
24. textrel_shlib_t \'/u01/app/oracle/product/11.1.0/dbhome_1/lib/libnnz11.so\'\" You
25. must also change the default file context files on the system in order to
26. preserve them even on a full relabel. \"semanage fcontext -a -t textrel_shlib_t
27. \'/u01/app/oracle/product/11.1.0/dbhome_1/lib/libnnz11.so\'\"
29. The following command will allow this access:
31. chcon -t textrel_shlib_t \'/u01/app/oracle/product/11.1.0/dbhome_1/lib/libnnz11.so\'
33. Additional Information:
35. Source Context user_u:system_r:unconfined_t
36. Target Context user_u:object_r:default_t
37. Target Objects /u01/app/oracle/product/11.1.0/dbhome_1/lib/libnnz
38. 11.so [ file ]
39. Source sqlplus
40. Source Path /u01/app/oracle/product/11.1.0/dbhome_1/bin/sqlplu
41. s
42. Port
43. Host node1.ocm.com
44. Source RPM Packages
45. Target RPM Packages
46. Policy RPM selinux-policy-2.4.6-137.el5
47. Selinux Enabled True
48. Policy Type targeted
49. MLS Enabled True
50. Enforcing Mode Enforcing
51. Plugin Name allow_execmod
52. Host Name node1.ocm.com
53. Platform Linux node1.ocm.com 2.6.18-92.el5PAE #1 SMP Fri
54. May 23 22:26:05 EDT 2008 i686 i686
55. Alert Count 2
56. First Seen Fri Sep 12 12:47:19 2014
57. Last Seen Fri Sep 12 12:50:31 2014
58. Local ID 3485ff82-7fb5-4150-b246-2dd3e2cf679e
59. Line Numbers
61. Raw Audit Messages
63. host=node1.ocm.com type=AVC msg=audit(1410497431.868:19): avc: denied { execmod } for pid=7697 comm=\"sqlplus\" path=\"/u01/app/oracle/product/11.1.0/dbhome_1/lib/libnnz11.so\" dev=dm-0 ino=8647328 scontext=user_u:system_r:unconfined_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=file
65. host=node1.ocm.com type=SYSCALL msg=audit(1410497431.868:19): arch=40000003 syscall=125 success=no exit=-13 a0=308000 a1=184000 a2=5 a3=bf9df450 items=0 ppid=7671 pid=7697 auid=500 uid=500 gid=12000 euid=500 suid=500 fsuid=500 egid=12000 sgid=12000 fsgid=12000 tty=pts1 ses=2 comm=\"sqlplus\" exe=\"/u01/app/oracle/product/11.1.0/dbhome_1/bin/sqlplus\" subj=user_u:system_r:unconfined_t:s0 key=(null)

根据以上信息逐步修改后的后续提示执行下列指令：
$ chcon -t textrel_shlib_t '/u01/app/oracle/product/11.1.0/dbhome_1/lib/libnnz11.so'
$ chcon -t textrel_shlib_t '/u01/app/oracle/product/11.1.0/dbhome_1/lib/libclntsh.so.11.1'
$ chcon -t textrel_shlib_t '/u01/app/oracle/product/11.1.0/dbhome_1/lib/libsqlplus.so'
$ chcon -t textrel_shlib_t '/u01/app/oracle/product/11.1.0/dbhome_1/lib/libnque11.so'

关闭SELinux也可以解决：
# getenforce
Enforcing
# setenforce 0
# getenforce
Permissive

也可永久关闭SELinux：
# vim /etc/sysconfig/selinux
SELINUX=disabled

附，SELinux的三种状态：

1. enforcing     检测并执行SELinux条目值
2. permissive    检测SELinux条目值，不执行，但会弹出警告
3. disabled      彻底关闭SELinux

来自 “ ITPUB博客 ” ，链接：http://blog.itpub.net/24644775/viewspace-1268413/，如需转载，请注明出处，否则将追究法律责任。

转载于:http://blog.itpub.net/24644775/viewspace-1268413/