Sign up ×

Short version: What is the most secure way to allow Java 7 to run on (with?) SELinux?

Long version:

Sorry in advance if I use incorrect terminology. I'm really just a Java developer with a meager smattering of Linux skills.

I just installed Java 7 on CentOS release 5.3 (Final) that is apparently has Security Enhanced Linux. After the install was complete (which I "installed" by unzipping the tar.gz file from Oracle in /usr/java/jdk/jdk1.7.0_25), I ran java -version and got this error:

Error: dl failure on line 864
Error: failed /usr/java/jdk1.7.0_25/jre/lib/i386/server/,
      because /usr/java/jdk1.7.0_25/jre/lib/i386/server/
      cannot restore segment prot after reloc: Permission denied`

I found a few articles stating this can be due to SELinux and to try setenforce 0 and see if the problem goes away. I ran that command and Java worked. But these same articles say that leaving setenforce 0 on an Internet connected host is dangerous, and my host is connected to the Internet.

There are other articles that suggest this next approach, but also say it can be dangerous, so I haven't tried it yet.

chcon -t textrel_shlib_t /usr/jre1.7.0_10/lib/i386/client/ the above command the path at the end of the command is replaced with the path of my JDK.

What I can't find is something "official" (which can mean many things) on how to run Java 7 on (with?) SELinux safely. Does anyone have any information for me?

Edit: I discovered an article that referred to editing /etc/selinux/config. I have set as shown in the sample below. This allows Java to run but I assume I now have some security holes.

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#       enforcing - SELinux security policy is enforced.
#       permissive - SELinux prints warnings instead of enforcing.
#       disabled - SELinux is fully disabled.
#       targeted - Only targeted network daemons are protected.
#       strict - Full SELinux protection.
share|improve this question
The chcon solution looks reasonable. The last solution isn't much different than setenforce 0. –  jordanm Aug 2 '13 at 15:06
Can you just install it in your home directory instead? –  Thorbjørn Ravn Andersen Aug 6 '13 at 9:55
@ThorbjørnRavnAndersen: Well, I suppose I could, but it runs as a daemon, a Tomcat server to be more specific, and somehow it feels a little sloppy to have a Tomcat server running from my home directory. –  John Fitzpatrick Aug 6 '13 at 20:37

1 Answer 1

  1. Clean up the current installation

  2. Download the RPM file (

    yum -y localinstall /path/to/downloaded-java.rpm

rest will be taken care.

share|improve this answer
Thanks. Can you elaborate on "Clean up the current installation"? Do you mean remove what I installed? –  John Fitzpatrick Aug 6 '13 at 20:34
Yes, that's right! Remove your current Oracle Java installation. Please follow "Self-extracting file uninstall" –  user44441 Aug 7 '13 at 11:21

Your Answer


