Fix SELinux warnings when running on Fedora....

sandbox/linux/seccomp/library.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #define XOPEN_SOURCE 500
 #include <algorithm>
 #include <elf.h>
 #include <errno.h>
 #include <errno.h>
 #include <fcntl.h>
@@ skipping 70 matching lines @@
 char* Library::__kernel_vsyscall;
 char* Library::__kernel_sigreturn;
 char* Library::__kernel_rt_sigreturn;
 
 Library::~Library() {
   if (image_size_) {
     // We no longer need access to a full mapping of the underlying library
     // file. Move the temporarily extended mapping back to where we originally
     // found. Make sure to preserve any changes that we might have made since.
     Sandbox::SysCalls sys;
-    sys.mprotect(image_, 4096, PROT_READ | PROT_WRITE);
+    sys.mprotect(image_, 4096, PROT_READ | PROT_WRITE | PROT_EXEC);
     if (memcmp(image_, memory_ranges_.rbegin()->second.start, 4096)) {
       // Only copy data, if we made any changes in this data. Otherwise there
       // is no need to create another modified COW mapping.
       memcpy(image_, memory_ranges_.rbegin()->second.start, 4096);
     }
     sys.mprotect(image_, 4096, PROT_READ | PROT_EXEC);
     sys.mremap(image_, image_size_, 4096, MREMAP_MAYMOVE | MREMAP_FIXED,
                memory_ranges_.rbegin()->second.start);
   }
 }
@@ skipping 133 matching lines @@
                                                  MREMAP_MAYMOVE));
     if (image_size_ == 8192 && image_ == start) {
       // We really mean it, when we say we want the memory to be moved.
       image_ = reinterpret_cast<char *>(sys.mremap(start, 4096, image_size_,
                                                    MREMAP_MAYMOVE));
       sys.munmap(reinterpret_cast<char *>(start) + 4096, 4096);
     }
     if (image_ == MAP_FAILED) {
       image_ = NULL;
     } else {
-      sys.MMAP(start, 4096, PROT_READ | PROT_WRITE,
+      sys.MMAP(start, 4096, PROT_READ | PROT_WRITE | PROT_EXEC,
                MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0);
       for (int i = 4096 / sizeof(long); --i;
            reinterpret_cast<long *>(start)[i] =
              reinterpret_cast<long *>(image_)[i]);
     }
   }
 
   if (image_) {
     if (offset + len > image_size_) {
       // It is quite likely that we initially did not map the entire file as
@@ skipping 612 matching lines @@
   #if defined(__x86_64__)
   // VSyscalls live in a shared 4kB page at the top of the address space. This
   // page cannot be unmapped nor remapped. We have to create a copy within
   // 2GB of the page, and rewrite all IP-relative accesses to shared variables.
   // As the top of the address space is not accessible by mmap(), this means
   // that we need to wrap around addresses to the bottom 2GB of the address
   // space.
   // Only x86-64 has VSyscalls.
   if (maps_->vsyscall()) {
     char* copy = maps_->allocNearAddr(maps_->vsyscall(), 0x1000,
-                                    PROT_READ|PROT_WRITE);
+                                      PROT_READ|PROT_WRITE|PROT_EXEC);
     char* extraSpace = copy;
     int extraLength = 0x1000;
     memcpy(copy, maps_->vsyscall(), 0x1000);
     long adjust = (long)maps_->vsyscall() - (long)copy;
     for (int vsys = 0; vsys < 0x1000; vsys += 0x400) {
       char* start = copy + vsys;
       char* end   = start + 0x400;
 
       // There can only be up to four VSyscalls starting at an offset of
       // n*0x1000, each. VSyscalls are invoked by functions in the VDSO
@@ skipping 313 matching lines @@
   }
   iter = symbols_.find("__kernel_rt_sigreturn");
   if (iter != symbols_.end() && iter->second.st_value) {
     __kernel_rt_sigreturn = asr_offset_ + iter->second.st_value;
   }
 
   return true;
 }
 
 } // namespace