lxrun: Why SELinux Killed My Linux Emulator

Published on August 30, 2026

Tags: selinux, lxrun, linux

After working on a linux emulation project and getting burnt out on it, I put it aside for 3 months, and only recently I came back to it only to discover that it does not work any more:

ben@box5:~/Projects/lxrun$ LXRUN_ROOT=$PWD/root ./lxrun root/bin/ls [lxrun] PIE guest, load_base=0xf1cba000 [lxrun] loading interpreter: /home/ben/Projects/lxrun/root/lib/ld-linux.so.2 [lxrun] interpreter base=0xf1c82000 entry=0xf1c9e6a0 r=0 Segmentation fault

I spent a few hours going over the code, and found nothing, at first I thought I may have put in code to cause a segfault for the purpose of tracking down certain bugs I was working on at that time, but I searched, and searched but to no avail, but then I thought maybe it's related to selinux?, and so I checked the audit logs:

sudo tail -f /var/log/audit/audit.log | grep AVC type=AVC msg=audit(1788094933.703:4180): avc: denied { execmod } for pid=417401 comm="lxrun" path="/usr/lib/i386-linux-gnu/libc.so.6" dev="sda1" ino=1060159 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lib_t:s0 tclass=file permissive=0

And there it was, all I needed was to make a new rule for lxrun, or to temporarily disable enforcing mode, I decided to do the former (As a side note, this fix also allows any other programs running in the 'unconfined_t' domain to use execmod):

ben@box5:~$ sudo ausearch -m avc -c lxrun | audit2allow -M lxrun_execmod_fix ******************** IMPORTANT *********************** To make this policy package active, execute: semodule -i lxrun_execmod_fix.pp ben@box5:~$ cat lxrun_execmod_fix.te module lxrun_execmod_fix 1.0; require { type lib_t; type unconfined_t; class file execmod; } #============= unconfined_t ============== #!!!! This avc can be allowed using the boolean 'allow_execmod' allow unconfined_t lib_t:file execmod; ben@box5:~$ sudo semodule -i lxrun_execmod_fix.pp

And to verify that lxrun works now:

ben@box5:~/Projects/lxrun$ LXRUN_ROOT=$PWD/root ./lxrun root/bin/ls [lxrun] PIE guest, load_base=0xf1cb9000 [lxrun] loading interpreter: /home/ben/Projects/lxrun/root/lib/ld-linux.so.2 [lxrun] interpreter base=0xf1c81000 entry=0xf1c9d6a0 r=0 include lxrun Makefile root solaris.map src ben@box5:~/Projects/lxrun$

It works!, and now you may be wondering what was the problem, and why was SELinux blocking lxrun? It comes down to execmod, which stops programs modifying executable memory and then executing it.