Stellaris does not launch on SELinux enabled systems

[Vortex_Acherontic]

Hello there I recently moved to a SELinux enabled system, openSUSE MicroOS, and found out one of the libraries Stellaris is using is blocked by SELinux to prevent stack smashing attacks.

./stellaris: error while loading shared libraries: libpops_api.so: cannot enable executable stack as shared object requires: Permission denied

In order to play Stellaris it is required to temporarily turn off SELinux by using:

sudo setenforce 0

Afaik Fedora also uses SELinux by default so I expect this to be an issue there too. Unless they have altered the SELinux default configuration in a way to allow stacking.
Would it be possible to look into this and see if the mentioned library libpops_api can be used without requiring stacking?
Otherwise it's okay too as it is now mentioned how to solve this issue on affected systems.

 

[AndrewT]

As the only suported distro for this game is Ubuntu, I'm afraid this cannot be reported to the developers or worked on by them. Sorry about that!

 

[Vortex_Acherontic]

Yeah I expected this to be the replay

Anyway I hope others who might run SELinux on Ubuntu will stumble upon this thread and know how to still play Stellaris then.

I found another (better) solution, without turning off SELinux entirely:

sudo setsebool -P selinuxuser_execstack 1

Will allow the library to execute it's stack

 

[Modin676]

Adding to this - i found a website refering to an attribute that can be set or unset to a library - in this case to libpops_api.so.

You need to have execstack installed. Then you can run execstack -c /<path>/.../<problematic file or library>. This deletes the flag to the library in question. you can add it again with execstack -s /<path>/.../<problematic file or library>, and see what flag you have with execstack -q /<path>/.../<problematic file or library>. if the flag is there, you get an X <filename>, and if it is not set, you get - <filename>.

This helped me without needing to tinker with SELinux settings.

Hope this helps others.

 

[turjid]

Adding to this - i found a website refering to an attribute that can be set or unset to a library - in this case to libpops_api.so.

You need to have execstack installed. Then you can run execstack -c /<path>/.../<problematic file or library>. This deletes the flag to the library in question. you can add it again with execstack -s /<path>/.../<problematic file or library>, and see what flag you have with execstack -q /<path>/.../<problematic file or library>. if the flag is there, you get an X <filename>, and if it is not set, you get - <filename>.

This helped me without needing to tinker with SELinux settings.

Hope this helps others.

Thanks this helped me a lot! Just adding to expand on this further to help others with a step-by-step to find, install, and change permissions on `libpops_api.so`.

First, to find the right file. This searches by name your entire PC (using the root folder, /).

sudo find / -name libpops_api.so

I got a few lines but this one was the most relevant as it has /Steam and Stellaris in it, so is probably what we're looking for, where `turjid` is my username but it will be whatever your username is. Don't presume that this is where your `libpops_api.so` will be, as it may be different on your PC, so definitely find it on your machine using `find` above.

/home/turjid/.local/share/Steam/steamapps/common/Stellaris/libpops_api.so

Next, to install execstack. I am on openSUSE Tumbleweed so I installed it via `zypper`, but this might be different on different distros. If in doubt, try searching using your package manager's search function.

sudo zypper in execstack

Lastly, once installed, run the following (changing your username).

execstack -c /home/turjid/.local/share/Steam/steamapps/common/Stellaris/libpops_api.so

After this, I was immediately able to run Stellaris, no problems at all! Didn't even need to close the launcher or anything.

 

[Modin676]

Glad to hear it. I almost did not think I'll find a solution, but others were smarter than me, and I just wanted to share the result. And I like your step by step instruction. I am sure that will help many more with the same problem.