Bug 1254565

Summary:	SELinux is preventing Google Chrome from using the setcap access on a process
Product:	Red Hat Enterprise Linux 7	Reporter:	Jan Kurik <jkurik>
Component:	selinux-policy	Assignee:	Lukas Vrabec <lvrabec>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	unspecified	Docs Contact:
Priority:	high
Version:	7.1	CC:	bgollahe, jsvarova, lvrabec, mgrepl, mmalik, plautrba, pvrabec, ssekidde, tpopela
Target Milestone:	rc	Keywords:	ZStream
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-3.13.1-23.el7_1.14	Doc Type:	Bug Fix
Doc Text:	Due to SELinux preventing /opt/google/chrome-beta/chrome from using the setcap access on a process, the Google Chrome process previously terminated unexpectedly and the sandbox initialization failed. This update adds the chrome_sandbox_t SELinux policy, and Google Chrome no longer crashes in the described scenario.	Story Points:	---
Clone Of:	1251996	Environment:
Last Closed:	2015-09-02 08:46:04 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1251996
Bug Blocks:

Description Jan Kurik 2015-08-18 12:03:49 UTC

This bug has been copied from bug #1251996 and has been proposed
to be backported to 7.1 z-stream (EUS).

Comment 4 Lukas Vrabec 2015-08-18 12:18:50 UTC

commit 29679ccc9b2bce7a16cb895c4eae3d8c0bc54931
Author: Lukas Vrabec <lvrabec>
Date:   Tue Aug 18 09:57:50 2015 +0200

    Allow chrome setcap to itself.
    Resolves: #1254565

Comment 8 errata-xmlrpc 2015-09-02 08:46:04 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-1701.html