ldconfig: cannot lstat - permission denied

Question

I copied some libraries (libncurses, version 5.9) from a machine with architecture x86 to another machine with same architecture.

Still, when running ldconfig, I got permission denial messages:

bash-3.2# ldconfig
ldconfig: Cannot lstat /lib/libncursesw.so.5.9: Permission denied
ldconfig: Cannot lstat /lib/libncurses.so.5.9: Permission denied

Note: /lib is a symlink to /usr/lib.

Here is a list of these libs (I put some !!! marks in):

bash-3.2# ls -all /usr/lib | grep libncurses*
lrwxrwxrwx  1 root         root               19 Nov  3 10:15 libncurses++.so.6 -> libncurses++.so.6.1
-rwxr-xr-x  1 root         root            71696 Oct 23 22:27 libncurses++.so.6.1
lrwxrwxrwx  1 root         root               20 Nov  3 10:15 libncurses++w.so.6 -> libncurses++w.so.6.1
-rwxr-xr-x  1 root         root            71696 Oct 23 22:27 libncurses++w.so.6.1
lrwxrwxrwx  1 root         root               17 Mar 17 15:01 libncurses.so.5 -> libncurses.so.5.9
-rwxr-xr-x  1 root         root     !!!   158528 Mar 17 14:56 libncurses.so.5.9
lrwxrwxrwx  1 root         root               17 Nov  3 10:15 libncurses.so.6 -> libncurses.so.6.1
-rwxr-xr-x  1 root         root           169780 Oct 23 22:27 libncurses.so.6.1
lrwxrwxrwx  1 root         root               18 Mar 17 15:00 libncursesw.so.5 -> libncursesw.so.5.9
-rwxr-xr-x  1 root         root     !!!   225240 Mar 17 14:56 libncursesw.so.5.9
lrwxrwxrwx  1 root         root               18 Nov  3 10:15 libncursesw.so.6 -> libncursesw.so.6.1
-rwxr-xr-x  1 root         root           247700 Oct 23 22:27 libncursesw.so.6.1

You can see, that my copied 5.9 version has the very same permissions as their 6.1.

Also, I tried changing the permission to 777, but didn't help.

How can I make ldconfig to take into account these libs?

This is a tiny RedHat-based OS, not too much commands are available by default.

@user1686's comment helped a lot, indeed copied libraries are different:

Now, to save some space on internet: how can I change User::Shell to _ for those files? (I found something with semanage but that command is not available).

Answer 1

The files differ in their security context, which is used by several Mandatory Access Control systems – most commonly SELinux, but in your case it actually looks more like SMACK.

Security contexts are stored in extended attributes (xattrs) and in SMACK's case it's just a plain text value that you can change using attr or getfattr/setfattr.

In SMACK, _ ("floor") is a built-in label used for publicly readable data. However, I'm not sure whether it's stored as an explicit label, or whether it's just the default in absence of any label. So just use whatever is necessary to make the 'getfattr' output look identical on both.

List:   # getfattr -d -m - libncurses.so.5
Set:    # setfattr -n security.SMACK64 -v _ libncurses*.so.5*
Remove: # setfattr -x security.SMACK64 libncurses*.so.5*

List:   # attr -S -l libncurses.so.6.1
Get:    # attr -S -g SMACK64 libncurses.so.5
Set:    # attr -S -s SMACK64 -V _ libncurses.so.5
Remove: # attr -S -r SMACK64 libncurses.so.5

#include <sys/types.h>
#include <sys/xattr.h>
#include <err.h>

main(int argc, char *argv[]) {
    for (int i=1; i<argc; i++)
        if (setxattr(argv[i], "security.SMACK64", "_", sizeof("_"), 0))
            warn("setxattr(%s) failed", argv[i]);
}

Note that you must have CAP_MAC_ADMIN to change this attribute.