| Summary: | SELinux is preventing java from 'read' accesses on the file profiles.ini. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | padrebrunoalmeida <padrebrunoalmeida> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED NOTABUG | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 23 | CC: | dominick.grift, dwalsh, lvrabec, mgrepl, plautrba |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:65f4aa1940fe8db1e9d2601fb7111abba026431796041dee675cc19966cd6248;VARIANT_ID=workstation; | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-04-21 14:14:27 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
Did you run firefox as root? This is not a good idea. I would like to suggest run firefox as user and use SELinux boolean from report to fix your issue. ***** Plugin mozplugger (99.1 confidence) suggests ************************ If você deseja usar o pacote plugin Then você deve desligar os controles SELinux nos plugins do Firefox. Do # setsebool -P unconfined_mozilla_plugin_transition 0 Running firefox as root is not supported. |
Description of problem: SELinux is preventing java from 'read' accesses on the file profiles.ini. ***** Plugin mozplugger (99.1 confidence) suggests ************************ If você deseja usar o pacote plugin Then você deve desligar os controles SELinux nos plugins do Firefox. Do # setsebool -P unconfined_mozilla_plugin_transition 0 ***** Plugin catchall (1.81 confidence) suggests ************************** If você acredita que o java deva ser permitido acesso de read em profiles.ini file por default. Then você precisa reportar este como um erro. Você pode gerar um módulo de política local para permitir este acesso. Do permitir este acesso agora executando: # grep java /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c 0.c1023 Target Context unconfined_u:object_r:admin_home_t:s0 Target Objects profiles.ini [ file ] Source java Source Path java Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-152.fc23.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.2.3-300.fc23.x86_64 #1 SMP Mon Oct 5 15:42:54 UTC 2015 x86_64 x86_64 Alert Count 1 First Seen 2016-04-19 11:27:47 BRT Last Seen 2016-04-19 11:27:47 BRT Local ID a483ef48-80e3-4899-87b5-019c627c1575 Raw Audit Messages type=AVC msg=audit(1461076067.307:623): avc: denied { read } for pid=3251 comm="java" name="profiles.ini" dev="dm-0" ino=1459360 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file permissive=0 Hash: java,mozilla_plugin_t,admin_home_t,file,read Version-Release number of selected component: selinux-policy-3.13.1-152.fc23.noarch Additional info: reporter: libreport-2.6.3 hashmarkername: setroubleshoot kernel: 4.2.3-300.fc23.x86_64 type: libreport