Bug 1036360

Summary: SELinux is preventing /opt/google/chrome/chrome from 'open' accesses on the file /home/moussera/.nv/nvidia-application-profile-globals-rc.
Product: [Fedora] Fedora Reporter: Fábio <f>
Component: selinux-policyAssignee: Lukas Vrabec <lvrabec>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 18CC: dominick.grift, dwalsh, lvrabec, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard: abrt_hash:dc4bc1a9ed7b3bb8b8640f4a4bdd6f4a7d9e66cfc7d15ee4f18a0de3ac97c556
Fixed In Version: selinux-policy-3.11.1-108.fc18 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-01-05 06:08:49 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Fábio 2013-12-01 12:46:24 UTC 
Description of problem:
Dear Admin:

The error message appears every time I open google chrome.

I have installed the key provide by google before installing chrome. 

wget https://dl-ssl.google.com/linux/linux_signing_key.pub
sudo rpm --import linux_signing_key.pub

Then the user agent.

su -

wget https://dl.google.com/linux/direct/google-chrome-stable_current_x86_64.rpm;sudo yum --nogpgcheck install google-chrome-stable_current_x86_64.rpm;rm google-chrome-stable_current_x86_64.rpm

The command...

# grep chrome /var/log/audit/audit.log | audit2allow -M mypol

returns

#  bash: audit2allow: command not found...

Every time I open google chrome on this desktop—just installed spherical caw—SELinux show the warning bellow. I use the creative workstation and I am still tweaking this machine. I am studying Linux—LPI, CompTIA Linux+— and expect to be able to both solve my own problems and contribute in the near future.

Sincerely,
Fábio Tavares da Costa

==============================================================================

SELinux is preventing /opt/google/chrome/chrome from open access on the file /home/user/.nv/nvidia-application-profile-globals-rc.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that chrome should be allowed open access on the nvidia-application-profile-globals-rc file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep chrome /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c
                              0.c1023
Target Context                unconfined_u:object_r:cache_home_t:s0
Target Objects                /home/user/.nv/nvidia-application-profile-
                              globals-rc [ file ]
Source                        chrome
Source Path                   /opt/google/chrome/chrome
Port                          <Unknown>
Host                          pan.local
Source RPM Packages           google-chrome-stable-31.0.1650.57-1.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.11.1-106.fc18.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     pan.local
Platform                      Linux pan.local 3.11.9-100.fc18.x86_64 #1 SMP Wed
                              Nov 20 21:22:39 UTC 2013 x86_64 x86_64
Alert Count                   4
First Seen                    2013-11-30 09:51:56 BRST
Last Seen                     2013-12-01 08:20:40 BRST
Local ID                      0e5d66c6-65df-425e-b02b-4b93ec867edc

Raw Audit Messages
type=AVC msg=audit(1385893240.641:321): avc:  denied  { open } for  pid=1808 comm="nacl_helper" path="/home/user/.nv/nvidia-application-profile-globals-rc" dev="dm-2" ino=4981102 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:cache_home_t:s0 tclass=file


type=SYSCALL msg=audit(1385893240.641:321): arch=x86_64 syscall=open success=no exit=EACCES a0=7f8cc6189f40 a1=0 a2=1b6 a3=7f8cc618c000 items=0 ppid=1 pid=1808 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=2 tty=(none) comm=nacl_helper exe=/opt/google/chrome/nacl_helper subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 key=(null)

Hash: chrome,chrome_sandbox_t,cache_home_t,file,open

audit2allow
audit2allow -R
SELinux is preventing /opt/google/chrome/chrome from 'open' accesses on the file /home/moussera/.nv/nvidia-application-profile-globals-rc.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that chrome should be allowed open access on the nvidia-application-profile-globals-rc file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep chrome /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c
                              0.c1023
Target Context                unconfined_u:object_r:cache_home_t:s0
Target Objects                /home/user/.nv/nvidia-application-profile-
                              globals-rc [ file ]
Source                        chrome
Source Path                   /opt/google/chrome/chrome
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           google-chrome-stable-31.0.1650.57-1.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.11.1-106.fc18.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.11.9-100.fc18.x86_64 #1 SMP Wed
                              Nov 20 21:22:39 UTC 2013 x86_64 x86_64
Alert Count                   4
First Seen                    2013-11-30 09:51:56 BRST
Last Seen                     2013-12-01 08:20:40 BRST
Local ID                      0e5d66c6-65df-425e-b02b-4b93ec867edc

Raw Audit Messages
type=AVC msg=audit(1385893240.641:321): avc:  denied  { open } for  pid=1808 comm="nacl_helper" path="/home/moussera/.nv/nvidia-application-profile-globals-rc" dev="dm-2" ino=4981102 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:cache_home_t:s0 tclass=file


type=SYSCALL msg=audit(1385893240.641:321): arch=x86_64 syscall=open success=no exit=EACCES a0=7f8cc6189f40 a1=0 a2=1b6 a3=7f8cc618c000 items=0 ppid=1 pid=1808 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=2 tty=(none) comm=nacl_helper exe=/opt/google/chrome/nacl_helper subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 key=(null)

Hash: chrome,chrome_sandbox_t,cache_home_t,file,open

audit2allow
audit2allow -R

Additional info:
reporter:       libreport-2.1.9
hashmarkername: setroubleshoot
kernel:         3.11.9-100.fc18.x86_64
type:           libreport
Comment 1 Fábio 2013-12-03 15:32:25 UTC 
Description of problem:
Opening Google Chrome.

Additional info:
reporter:       libreport-2.1.9
hashmarkername: setroubleshoot
kernel:         3.11.9-100.fc18.x86_64
type:           libreport
Comment 2 Daniel Walsh 2013-12-04 14:20:24 UTC 
b55c0c7754736f6c78d69475addc32229889e8bd fixes this in git.  SHould be back ported to F18,F19,F20 and RHEL7.
Comment 3 Miroslav Grepl 2013-12-04 16:56:18 UTC 
back ported to f20.
Comment 4 Miroslav Grepl 2013-12-05 13:53:21 UTC 
commit 59179b358e9bc3699e0fe5eb1f26e76e42c9f8cf
Author: Dan Walsh <dwalsh>
Date:   Wed Dec 4 09:19:45 2013 -0500

    Allow chrome sandbox to read generic cache files in homedir


added also to F18.
Comment 5 Fedora Update System 2013-12-20 00:00:48 UTC 
selinux-policy-3.11.1-108.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-108.fc18
Comment 6 Fedora Update System 2013-12-21 02:19:07 UTC 
Package selinux-policy-3.11.1-108.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.11.1-108.fc18'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-23716/selinux-policy-3.11.1-108.fc18
then log in and leave karma (feedback).
Comment 7 Fedora End Of Life 2013-12-21 15:48:46 UTC 
This message is a reminder that Fedora 18 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 18. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '18'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 18's end of life.

Thank you for reporting this issue and we are sorry that we may not be 
able to fix it before Fedora 18 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior to Fedora 18's end of life.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.
Comment 8 Fedora Update System 2014-01-05 06:08:49 UTC 
selinux-policy-3.11.1-108.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.