Bug 1119176

Summary: RFE: pipelight is not able to run it's browser-plugins properly, missing selinux-module
Product: [Fedora] Fedora Reporter: Björn Esser (besser82) <besser82>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: rawhideCC: andreas.bierfert, dominick.grift, dwalsh, lvrabec, mgrepl, mike
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-07-14 12:44:29 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Björn Esser (besser82) 2014-07-14 08:33:21 UTC 
Description of problem:

  I am the maintainer of pipelight.  The browser-plugins loaded / managed by
  pipelight don't work properly, because of a missing selinux-module.


Version-Release number of selected component (if applicable):

  all relased selinux-policy


How reproducible:

  100%


Steps to Reproduce:
1.  install pipelight: sudo yum install pipelight
2.  pipelight-plugin --enable flash  &&  remove abobe's flash-plugin
3.  restart browser
4.  open a webpage using flash, e.g. http://speedtest.net/


Actual results:

  Pipelight's plugin get's detected, but the browser stalls because of
  avc-denials.  Lot's of avc-denials are reported.


Expected results:

  Pipelight's plugin should work like any other browser-plugin and
  don't produce avc-denials or lock-up the browser.


Additional info:

  I prepared a selinux-module with the needed rules to run everything without
  any avc-alerts/denials.  You can find it here:
  https://github.com/besser82/pipelight-selinux/

  Please backport that module to fc19+, because there are plans for backporting
  pipelight to those releases.

  Many thanks in advance!  ^^
Comment 1 Björn Esser (besser82) 2014-07-14 12:44:29 UTC 
I decided to package this selinux-module as a seperated package.  Having these rules available and enabled by default makes no real sense.

*** This bug has been marked as a duplicate of bug 1119288 ***