# grsec denied RWX  - plex

## plice

Hi,

I've installed plex from overlay and tried to run it, but it crashes:

[1010112.246172] grsec: From xx.xxx.xx: denied RWX mprotect of <anonymous mapping> by /usr/lib/plexmediaserver/Plex Media Server[Plex Media Serv:5990] uid/euid:110/110 gid/egid:103/103, parent /usr/sbin/start_pms[start_pms:5989] uid/euid:110/110 gid/egid:103/103

How do I fix it?

Thank you.

----------

## Tractor Girl

Try to disable mprotect for the binary that causes the problem:

```
paxctl-ng -m /usr/bin/some_binary
```

This decreases protection, but with some poorly writen programs there's no other choice.

----------

## SirRobin2318

I haven't used grsec in a looong while, so I'm genuinely asking the question: did you run gradm in learn mode and run plex? 

I know gradm will generate the rbac rules for file access, curious to know if it would also detect that the program needs a stack with write & execute.

----------

## plice

Hi,

yes, i've tried -m option and i did the 'learning' process. Still got issues. I think it's actually plex and not the pax :/

edit:

looks like plex doesn't have headers " If you run grsecurity you're going to need to create new headers and except them otherwise you'll run into all sorts of library update issues."  few ppl managed to get around it. 

Any help would be useful

thank you  :Smile: Last edited by plice on Wed Mar 26, 2014 2:10 pm; edited 1 time in total

----------

## SirRobin2318

You could try to build a kernel without grsec to see if plex is the sole issue.

----------

## plice

got it.

It doesn't have headers, BUT paxctl -c /bin/path  will create them  :Very Happy: 

then paxctl -m /bin/path  

I had to do for all of the following files (maybe it will help somebody else):

in /usr/lib/plexmediaserver

 Plex DLNA Server

Plex Media Scanner

Plex Media Server

and 

/usr/lib/plexmediaserver/Resources

 Plex New Transcoder

 Plex Transcoder

Plex Installed versions:  0.9.9.7^m is up and running (well at least it the process starts up and the webui works, dunno if it all will work)

thnx guys

Edit:

had to do /usr/lib/plexmediaserver/Resources/Python/bin/python as well, otherwise it won't set libraries. 

I've tested the server with a TV ... works like charm  :Very Happy: 

----------

## Hu

As Tractor Girl noted, this is a possibly intentional defect in Plex.  Running a process with RWX mappings is never a good idea for security, so if possible, this should be changed not to require a RWX mapping.

----------

## Tractor Girl

Paxctl edits the ELF directly so theoretically it can break a binary, using paxctl-ng is safer.

PaX_flag_migration_from_PT_PAX_to_XATTR_PAX

----------

