Attachment 236181 Details for Bug 350411 – selinux_alert

selinux_alert

selinux_alert.txt (text/plain), 2.56 KB, created by Martin Jürgens on 2007-10-24 12:38:37 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Jürgens

Created: 2007-10-24 12:38:37 UTC

Size: 2.56 KB

patch

obsolete

>Summary
>    SELinux is preventing /usr/lib/firefox-2.0.0.5/firefox-bin from loading
>    /usr/lib/firefox-2.0.0.5/plugins/nppdf.so which requires text relocation.
>
>Detailed Description
>    The /usr/lib/firefox-2.0.0.5/firefox-bin application attempted to load
>    /usr/lib/firefox-2.0.0.5/plugins/nppdf.so which requires text relocation.
>    This is a potential security problem. Most libraries do not need this
>    permission. Libraries are sometimes coded incorrectly and request this
>    permission.  The http://people.redhat.com/drepper/selinux-mem.html web page
>    explains how to remove this requirement.  You can configure SELinux
>    temporarily to allow /usr/lib/firefox-2.0.0.5/plugins/nppdf.so to use
>    relocation as a workaround, until the library is fixed. Please file a
>    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
>
>Allowing Access
>    If you trust /usr/lib/firefox-2.0.0.5/plugins/nppdf.so to run correctly, you
>    can change the file context to textrel_shlib_t. "chcon -t textrel_shlib_t
>    /usr/lib/firefox-2.0.0.5/plugins/nppdf.so"
>
>    The following command will allow this access:
>    chcon -t textrel_shlib_t /usr/lib/firefox-2.0.0.5/plugins/nppdf.so
>
>Additional Information        
>
>Source Context                user_u:system_r:unconfined_t
>Target Context                user_u:object_r:lib_t
>Target Objects                /usr/lib/firefox-2.0.0.5/plugins/nppdf.so [ file ]
>Affected RPM Packages         firefox-2.0.0.5-1.fc7 [application]
>Policy RPM                    selinux-policy-2.6.4-48.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.allow_execmod
>Host Name                     medora-desktop
>Platform                      Linux medora-desktop 2.6.22.9-91.fc7 #1 SMP Thu
>                              Sep 27 23:10:59 EDT 2007 i686 athlon
>Alert Count                   4
>First Seen                    Mi 24 Okt 2007 14:34:44 CEST
>Last Seen                     Mi 24 Okt 2007 14:34:44 CEST
>Local ID                      db7150fa-45dc-4634-9792-aed1d6ebbdcb
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { execmod } for comm="firefox-bin" dev=dm-0 egid=502 euid=502
>exe="/usr/lib/firefox-2.0.0.5/firefox-bin" exit=-13 fsgid=502 fsuid=502 gid=502
>items=0 name="nppdf.so" path="/usr/lib/firefox-2.0.0.5/plugins/nppdf.so"
>pid=3276 scontext=user_u:system_r:unconfined_t:s0 sgid=502
>subj=user_u:system_r:unconfined_t:s0 suid=502 tclass=file
>tcontext=user_u:object_r:lib_t:s0 tty=(none) uid=502
>

Actions: View

Attachments on bug 350411: 236181