Bug 1204307

Summary: SELinux prevents google-chrome from reading the /etc/passwd file
Product: Red Hat Enterprise Linux 7 Reporter: Alan <phantom>
Component: selinux-policyAssignee: Lukas Vrabec <lvrabec>
Status: CLOSED ERRATA QA Contact: Milos Malik <mmalik>
Severity: high Docs Contact:
Priority: high    
Version: 7.0CC: ashermartin, bgollahe, isenfeld, jir2023178, jreznik, jsvarova, kylesch, lvrabec, mgrepl, mmalik, mvermaes, pasqual.milvaques, phantom, plautrba, pvrabec, ssekidde, thomas.oulevey
Target Milestone: rcKeywords: ZStream
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: selinux-policy-3.13.1-30.el7 Doc Type: Bug Fix
Doc Text:
Prior to this update, SELinux in permissive mode prevented the Google Chrome browser from reading the /etc/passwd file. Consequently, SELinux Access Vector Cache (AVC) denial messages were returned during Google Chrome runtime. SELinux policy rules have been updated with the "dontaudit" rule, thus fixing this bug.
 Story Points: ---
Clone Of:
: 1257816 (view as bug list) Environment:
Last Closed: 2015-11-19 10:27:30 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1154209, 1257816    

Description Alan 2015-03-20 22:18:27 UTC 
Description of problem:Chrome requesting access to /etc/passwd file. Being stopped by Selinux - why should chrome be wanting access to /etc/passwd - possible security risk.


Version-Release number of selected component (if applicable)

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.101 

How reproducible:

Start chrome browser.

Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:
Comment 2 Milos Malik 2015-03-23 07:51:26 UTC 
Please, attach SELinux denials, which appeared during the chrome browser runtime:

# ausearch -m avc -m user_avc -m selinux_err -i -ts today
Comment 3 k 2015-04-02 16:53:01 UTC 
I have the same issue.  

Here is my output from:
ausearch -m avc -m user_avc -m selinux_err -i -ts today


type=SYSCALL msg=audit(04/02/2015 11:31:20.678:97756) : arch=x86_64 syscall=stat success=no exit=-13(Permission denied) a0=0x7f8601a099f8 a1=0x7fffda6aec70 a2=0x7fffda6aec70 a3=0x7f86109bb6b0 items=0 ppid=0 pid=6176 auid=k uid=k gid=k euid=k suid=k fsuid=k egid=k sgid=k fsgid=k tty=(none) ses=1 comm=chrome exe=/opt/google/chrome-beta/chrome subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(04/02/2015 11:31:20.678:97756) : avc:  denied  { getattr } for  pid=6176 comm=chrome path=/etc/passwd dev="sda4" ino=784994 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file
Comment 4 Alex J Sir 2015-04-07 04:44:21 UTC 
I have noticed the same today after running updates. 

Here is a copy of the SE Linux denial obtained using command you have posted above. 

type=USER_AVC msg=audit(04/06/2015 20:32:51.897:1151) : pid=1 uid=root auid=unset ses=unset subj=system_u:system_r:init_t:s0 msg='avc:  denied  { disable } for auid=unset uid=root gid=root scontext=system_u:system_r:rpm_script_t:s0-s0:c0.c1023 tcontext=system_u:system_r:init_t:s0 tclass=service  exe=/usr/lib/systemd/systemd sauid=root hostname=? addr=? terminal=?' 
----
type=USER_AVC msg=audit(04/06/2015 20:38:00.112:1167) : pid=1 uid=root auid=unset ses=unset subj=system_u:system_r:init_t:s0 msg='avc:  received policyload notice (seqno=2)  exe=/usr/lib/systemd/systemd sauid=root hostname=? addr=? terminal=?' 
----
type=SYSCALL msg=audit(04/06/2015 20:54:18.741:395) : arch=x86_64 syscall=stat success=no exit=-13(Permission denied) a0=0x7fd52f1f69f8 a1=0x7fff5bbfe440 a2=0x7fff5bbfe440 a3=0x7fd533abcd00 items=0 ppid=23290 pid=23291 auid=cube uid=cube gid=cube euid=cube suid=cube fsuid=cube egid=cube sgid=cube fsgid=cube tty=(none) ses=1 comm=nacl_helper exe=/opt/google/chrome/nacl_helper subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(04/06/2015 20:54:18.741:395) : avc:  denied  { getattr } for  pid=23291 comm=nacl_helper path=/etc/passwd dev="dm-2" ino=134958057 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file 
----
type=SYSCALL msg=audit(04/06/2015 20:54:18.798:396) : arch=x86_64 syscall=stat success=no exit=-13(Permission denied) a0=0x7f678c02c9f8 a1=0x7fffa2e30ac0 a2=0x7fffa2e30ac0 a3=0xfffffffffffffa09 items=0 ppid=23284 pid=23285 auid=cube uid=cube gid=cube euid=cube suid=cube fsuid=cube egid=cube sgid=cube fsgid=cube tty=(none) ses=1 comm=chrome exe=/opt/google/chrome/chrome subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(04/06/2015 20:54:18.798:396) : avc:  denied  { getattr } for  pid=23285 comm=chrome path=/etc/passwd dev="dm-2" ino=134958057 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file 
----
type=SYSCALL msg=audit(04/06/2015 21:22:48.277:413) : arch=x86_64 syscall=stat success=no exit=-13(Permission denied) a0=0x7f893c8139f8 a1=0x7fffb5e93cc0 a2=0x7fffb5e93cc0 a3=0x7f89410d9d00 items=0 ppid=5909 pid=5910 auid=cube uid=cube gid=cube euid=cube suid=cube fsuid=cube egid=cube sgid=cube fsgid=cube tty=(none) ses=3 comm=nacl_helper exe=/opt/google/chrome/nacl_helper subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(04/06/2015 21:22:48.277:413) : avc:  denied  { getattr } for  pid=5910 comm=nacl_helper path=/etc/passwd dev="dm-2" ino=134958057 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file 
----
type=SYSCALL msg=audit(04/06/2015 21:22:48.342:414) : arch=x86_64 syscall=stat success=no exit=-13(Permission denied) a0=0x7ff4ddd5c9f8 a1=0x7fffd0729c10 a2=0x7fffd0729c10 a3=0xfffffffffffffa09 items=0 ppid=5903 pid=5904 auid=cube uid=cube gid=cube euid=cube suid=cube fsuid=cube egid=cube sgid=cube fsgid=cube tty=(none) ses=3 comm=chrome exe=/opt/google/chrome/chrome subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(04/06/2015 21:22:48.342:414) : avc:  denied  { getattr } for  pid=5904 comm=chrome path=/etc/passwd dev="dm-2" ino=134958057 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file
Comment 5 Milos Malik 2015-04-09 08:12:20 UTC 
# rpm -qa selinux-policy\*
selinux-policy-mls-3.13.1-24.el7.noarch
selinux-policy-sandbox-3.13.1-24.el7.noarch
selinux-policy-minimum-3.13.1-24.el7.noarch
selinux-policy-devel-3.13.1-24.el7.noarch
selinux-policy-doc-3.13.1-24.el7.noarch
selinux-policy-targeted-3.13.1-24.el7.noarch
selinux-policy-3.13.1-24.el7.noarch
# ausearch -m avc -m user_avc -m selinux_err -i -ts today
----
type=PATH msg=audit(04/09/2015 10:09:27.179:343) : item=0 name=/etc/passwd inode=17588911 dev=fd:02 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:passwd_file_t:s0 objtype=NORMAL 
type=CWD msg=audit(04/09/2015 10:09:27.179:343) :  cwd=/home/unconfined-user 
type=SYSCALL msg=audit(04/09/2015 10:09:27.179:343) : arch=x86_64 syscall=stat success=no exit=-13(Permission denied) a0=0x7f30379aa9f8 a1=0x7fffd09fccc0 a2=0x7fffd09fccc0 a3=0x7f303c1b88d0 items=1 ppid=5137 pid=5138 auid=unconfined-user uid=unconfined-user gid=unconfined-user euid=unconfined-user suid=unconfined-user fsuid=unconfined-user egid=unconfined-user sgid=unconfined-user fsgid=unconfined-user tty=pts1 ses=27 comm=nacl_helper exe=/opt/google/chrome/nacl_helper subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(04/09/2015 10:09:27.179:343) : avc:  denied  { getattr } for  pid=5138 comm=nacl_helper path=/etc/passwd dev="vda2" ino=17588911 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file 
----
Comment 6 Milos Malik 2015-04-09 08:17:45 UTC 
Following AVCs appeared in permissive mode:
----
type=PATH msg=audit(04/09/2015 10:12:30.045:502) : item=0 name=/etc/passwd inode=17588911 dev=fd:02 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:passwd_file_t:s0 objtype=NORMAL 
type=CWD msg=audit(04/09/2015 10:12:30.045:502) :  cwd=/home/unconfined-user 
type=SYSCALL msg=audit(04/09/2015 10:12:30.045:502) : arch=x86_64 syscall=stat success=yes exit=0 a0=0x7ffe54f199f8 a1=0x7fffd793ccb0 a2=0x7fffd793ccb0 a3=0xfffffffffffffa09 items=1 ppid=7650 pid=7652 auid=unconfined-user uid=unconfined-user gid=unconfined-user euid=unconfined-user suid=unconfined-user fsuid=unconfined-user egid=unconfined-user sgid=unconfined-user fsgid=unconfined-user tty=pts1 ses=27 comm=chrome exe=/opt/google/chrome/chrome subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(04/09/2015 10:12:30.045:502) : avc:  denied  { getattr } for  pid=7652 comm=chrome path=/etc/passwd dev="vda2" ino=17588911 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file 
----
type=PATH msg=audit(04/09/2015 10:12:30.046:503) : item=0 name=/etc/passwd inode=17588911 dev=fd:02 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:passwd_file_t:s0 objtype=NORMAL 
type=CWD msg=audit(04/09/2015 10:12:30.046:503) :  cwd=/home/unconfined-user 
type=SYSCALL msg=audit(04/09/2015 10:12:30.046:503) : arch=x86_64 syscall=open success=yes exit=15 a0=0x7ffe54f199f8 a1=O_RDONLY a2=0x1b6 a3=0xfffffffffffffa09 items=1 ppid=7650 pid=7652 auid=unconfined-user uid=unconfined-user gid=unconfined-user euid=unconfined-user suid=unconfined-user fsuid=unconfined-user egid=unconfined-user sgid=unconfined-user fsgid=unconfined-user tty=pts1 ses=27 comm=chrome exe=/opt/google/chrome/chrome subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(04/09/2015 10:12:30.046:503) : avc:  denied  { open } for  pid=7652 comm=chrome path=/etc/passwd dev="vda2" ino=17588911 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file 
type=AVC msg=audit(04/09/2015 10:12:30.046:503) : avc:  denied  { read } for  pid=7652 comm=chrome name=passwd dev="vda2" ino=17588911 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file 
----
Comment 7 Miroslav Grepl 2015-04-09 09:08:56 UTC 
How is labeled nacl_helper in your case?
Comment 8 Milos Malik 2015-04-09 09:24:41 UTC 
# rpm -ql google-chrome-stable | grep nacl | xargs matchpathcon
/opt/google/chrome/nacl_helper	system_u:object_r:bin_t:s0
/opt/google/chrome/nacl_helper_bootstrap	system_u:object_r:chrome_sandbox_nacl_exec_t:s0
/opt/google/chrome/nacl_irt_x86_64.nexe	system_u:object_r:bin_t:s0
#
Comment 9 Miroslav Grepl 2015-04-09 14:35:27 UTC 
We should dontaudit it.
Comment 10 Siddharth Nagar 2015-04-24 15:29:37 UTC 
Miroslave, do we have a workaround in the interim? Is it safe to do the following as setroubleshoot advises:

# setsebool -P unconfined_chrome_sandbox_transition 0
Comment 11 Miroslav Grepl 2015-05-13 13:20:38 UTC 
It turns the protection off.

We could add a local policy with dontaudit rule.
Comment 12 Lukas Vrabec 2015-06-29 09:03:40 UTC 
Definitely we should dontallow this action. I'll add fix for this.
Comment 13 Lukas Vrabec 2015-06-29 09:19:52 UTC 
commit e3e6a65eaeb8a1000acab343c64804f387e144c1
Author: Lukas Vrabec <lvrabec>
Date:   Mon Jun 29 11:07:34 2015 +0200

    Dontaudit chrome to read passwd file. BZ(1204307)
Comment 15 asolar 2015-08-04 17:04:49 UTC 
Hi,

Interesting.  Does anyone know why Chrome/Chomium accesses the /etc/passwd file?  I did a search in the Chromium code and couldn't find a solid reason why other then some internal test or maybe finding the user id?  I also did a compare on Mozilla Firefox code with "grep -r "passwd" *"

Chrome Search:
==============
https://code.google.com/p/chromium/codesearch#search/&q=etc/passwd&sq=package:chromium&type=cs 
 
Firefox Search:
===============
https://dxr.mozilla.org/mozilla-central/search?q=passwd&redirect=true

selinux-policy screenshot at:
=============================
https://code.google.com/p/chromium/issues/detail?id=515959
Comment 18 k 2015-09-01 02:57:32 UTC 
(In reply to asolar from comment #15)
> Hi,
> 
> Interesting.  Does anyone know why Chrome/Chomium accesses the /etc/passwd
> file?  I did a search in the Chromium code and couldn't find a solid reason
> why other then some internal test or maybe finding the user id?  I also did
> a compare on Mozilla Firefox code with "grep -r "passwd" *"


/etc/passwd hasn't contained any actually password-related data in quite some time.  I'm guessing it's for getting a user's home directory or other such metadata for a user's account.  A quick search did turn up items related to getpwent(), which of course parses /etc/passwd.
Comment 20 errata-xmlrpc 2015-11-19 10:27:30 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2300.html