Attachment 574906 Details for Bug 809569 – File: description

File: description

description (text/plain), 5.29 KB, created by Mikhail on 2012-04-03 16:37:06 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Mikhail

Created: 2012-04-03 16:37:06 UTC

Size: 5.29 KB

patch

obsolete

>SELinux is preventing /opt/google/chrome/chrome from 'read' accesses on the file /home/eva/.config/google-chrome/Default/Pepper Data/Shockwave Flash/WritableRoot/macromedia.com/support/flashplayer/sys/settings.sol.
>
>*****  Plugin restorecon (82.4 confidence) suggests  *************************
>
>If you want to fix the label. 
>/home/eva/.config/google-chrome/Default/Pepper Data/Shockwave Flash/WritableRoot/macromedia.com/support/flashplayer/sys/settings.sol default label should be config_home_t.
>Then you can run restorecon.
>Do
># /sbin/restorecon -v /home/eva/.config/google-chrome/Default/Pepper Data/Shockwave Flash/WritableRoot/macromedia.com/support/flashplayer/sys/settings.sol
>
>*****  Plugin file (7.05 confidence) suggests  *******************************
>
>If you think this is caused by a badly mislabeled machine.
>Then you need to fully relabel.
>Do
>touch /.autorelabel; reboot
>
>*****  Plugin file (7.05 confidence) suggests  *******************************
>
>If you think this is caused by a badly mislabeled machine.
>Then you need to fully relabel.
>Do
>touch /.autorelabel; reboot
>
>*****  Plugin catchall_labels (4.59 confidence) suggests  ********************
>
>If you want to allow chrome to have read access on the settings.sol file
>Then you need to change the label on /home/eva/.config/google-chrome/Default/Pepper.Data/Shockwave.Flash/WritableRoot/macromedia.com/support/flashplayer/sys/settings.sol
>Do
># semanage fcontext -a -t FILE_TYPE '/home/eva/.config/google-chrome/Default/Pepper.Data/Shockwave.Flash/WritableRoot/macromedia.com/support/flashplayer/sys/settings.sol'
>where FILE_TYPE is one of the following: cgroup_t, sysctl_crypto_t, xguest_t, bin_t, cert_t, locale_t, etc_t, fonts_t, staff_t, proc_t, sysfs_t, user_t, usr_t, auditadm_usertype, config_home_t, user_fonts_cache_t, user_fonts_t, user_tmpfs_t, xserver_tmpfs_t, iceauth_home_t, xauth_home_t, fonts_cache_t, chrome_sandbox_tmpfs_t, sandbox_web_type, abrt_t, user_fonts_config_t, lib_t, ld_so_t, cpu_online_t, afs_cache_t, abrt_helper_exec_t, chrome_sandbox_nacl_exec_t, chrome_sandbox_tmp_t, secadm_usertype, sysadm_usertype, textrel_shlib_t, xdm_tmp_t, user_home_type, gnome_home_type, rpm_script_tmp_t, xdm_var_run_t, net_conf_t, chrome_sandbox_t, ld_so_cache_t, sysctl_kernel_t, home_cert_t, user_usertype, chrome_sandbox_nacl_t, abrt_var_run_t, chrome_sandbox_exec_t, staff_usertype, user_cron_spool_t, unconfined_t. 
>Then execute: 
>restorecon -v '/home/eva/.config/google-chrome/Default/Pepper.Data/Shockwave.Flash/WritableRoot/macromedia.com/support/flashplayer/sys/settings.sol'
>
>
>*****  Plugin catchall (1.31 confidence) suggests  ***************************
>
>If you believe that chrome should be allowed read access on the settings.sol file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep Chrome_ChildIOT /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>Additional Information:
>Source Context                unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c
>                              0.c1023
>Target Context                system_u:object_r:file_t:s0
>Target Objects                /home/eva/.config/google-chrome/Default/Pepper
>                              Data/Shockwave Flash/WritableRoot/macromedia.com/s
>                              upport/flashplayer/sys/settings.sol [ file ]
>Source                        Chrome_ChildIOT
>Source Path                   /opt/google/chrome/chrome
>Port                          <Unknown>
>Host                          (removed)
>Source RPM Packages           google-chrome-unstable-19.0.1084.1-129459.i386
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.10.0-106.fc17.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Enforcing
>Host Name                     (removed)
>Platform                      Linux (removed) 3.3.0-8.fc17.i686.PAE #1 SMP Thu Mar 29
>                              18:26:56 UTC 2012 i686 i686
>Alert Count                   3
>First Seen                    Mon 02 Apr 2012 08:26:54 AM YEKT
>Last Seen                     Mon 02 Apr 2012 08:27:10 AM YEKT
>Local ID                      67d66358-cc03-4299-ad5d-bc52d10385d8
>
>Raw Audit Messages
>type=AVC msg=audit(1333333630.570:125): avc:  denied  { read } for  pid=2603 comm="Chrome_ChildIOT" path=2F686F6D652F6576612F2E636F6E6669672F676F6F676C652D6368726F6D652F44656661756C742F50657070657220446174612F53686F636B7761766520466C6173682F5772697461626C65526F6F742F6D6163726F6D656469612E636F6D2F737570706F72742F666C617368706C617965722F7379732F73657474696E67732E736F6C dev="sdb1" ino=34998172 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1333333630.570:125): arch=i386 syscall=socketcall success=yes exit=EPERM a0=11 a1=afde4af0 a2=b787eff4 a3=0 items=0 ppid=2 pid=2603 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=4 comm=Chrome_ChildIOT exe=/opt/google/chrome/chrome subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 key=(null)
>
>Hash: Chrome_ChildIOT,chrome_sandbox_t,file_t,file,read
>
>audit2allowunable to open /sys/fs/selinux/policy:  Permission denied
>
>
>audit2allow -Runable to open /sys/fs/selinux/policy:  Permission denied
>
>

Actions: View

Attachments on bug 809569: 574906