lxrun: Why SELinux Killed My Linux Emulator

August 30, 2026

After working on a linux emulation project and getting burnt out on it, I put it aside for 3 months, and only recently I came back to it only to discover that it does not work any more:

ben@box5:~/Projects/lxrun$ LXRUN_ROOT=$PWD/root ./lxrun  root/bin/ls 
[lxrun] PIE guest, load_base=0xf1cba000
[lxrun] loading interpreter: /home/ben/Projects/lxrun/root/lib/ld-linux.so.2
[lxrun] interpreter base=0xf1c82000 entry=0xf1c9e6a0
r=0
Segmentation fault

I spent a few hours going over the code, and found nothing, at first I thought I may have put in code to cause a segfault for the purpose of tracking down certain bugs I was working on at that time, but I searched, and searched but to no avail, but then I thought maybe it's related to selinux?, and so I checked the audit logs:

sudo tail -f /var/log/audit/audit.log | grep AVC
type=AVC msg=audit(1788094933.703:4180): avc:  denied  { execmod } for  pid=417401 comm="lxrun" path="/usr/lib/i386-linux-gnu/libc.so.6" dev="sda1" ino=1060159 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lib_t:s0 tclass=file permissive=0

And there it was, all I needed was to make a new rule for lxrun, or to temporarily disable enforcing mode, I decided to do the former (As a side note, this fix also allows any other programs running in the 'unconfined_t' domain to use execmod):

ben@box5:~$ sudo ausearch -m avc -c lxrun | audit2allow -M lxrun_execmod_fix
******************** IMPORTANT ***********************
To make this policy package active, execute:

semodule -i lxrun_execmod_fix.pp

ben@box5:~$ cat lxrun_execmod_fix.te

module lxrun_execmod_fix 1.0;

require {
	type lib_t;
	type unconfined_t;
	class file execmod;
}

#============= unconfined_t ==============

#!!!! This avc can be allowed using the boolean 'allow_execmod'
allow unconfined_t lib_t:file execmod;
ben@box5:~$ sudo semodule -i lxrun_execmod_fix.pp

And to verify that lxrun works now:

ben@box5:~/Projects/lxrun$ LXRUN_ROOT=$PWD/root ./lxrun  root/bin/ls 
[lxrun] PIE guest, load_base=0xf1cb9000
[lxrun] loading interpreter: /home/ben/Projects/lxrun/root/lib/ld-linux.so.2
[lxrun] interpreter base=0xf1c81000 entry=0xf1c9d6a0
r=0
include  lxrun	Makefile  root	solaris.map  src
ben@box5:~/Projects/lxrun$

It works!, and now you may be wondering what was the problem, and why was SELinux blocking lxrun? It comes down to execmod, which stops programs modifying executable memory and then executing it.

Blogging: Why I decided to start afresh

August 17, 2026

As you can see by the title I started afresh with my blog. Here what I learned with the old blog, for one I should express myself (The post about the Spokane wildfires is one example, of me not expressing my ideas, or thoughts about it), a blog is generally the authors thoughts on some topic, or about what they learned/did.

Another thing is there is almost no point of writing the posts in a very formal manner, since it generally serves no purpose, and people may think, "this blog post is very formal and the author did not express their thoughts about anything", hmm, it must be AI generated/assisted. Most of my posts were very formal. Several people recomended that I write Wikipedia articles instead.

And one last thing don't be determined to write a long post unless you have enough information ready and drafted (like notes about what you did or learned), plus you don't even have to post regularly.

The old blog can be found here.

~cartwright's Minimalist Blog

lxrun: Why SELinux Killed My Linux Emulator

Blogging: Why I decided to start afresh