Bug 441620
| Summary: | selinux policy for npviewer.bin breaks file/network access | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Sean Middleditch <sean> |
| Component: | nspluginwrapper | Assignee: | Martin Stransky <stransky> |
| Status: | CLOSED NOTABUG | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | rawhide | CC: | caillon, cra, wtogami |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2008-04-17 12:09:55 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
You can setsebool allow_ns_plugin_execmem=1 Why should that be necessary? If you know that the common use for npviewer requires it to be on, turn it on by default. |
Flash and Java applets running inside of npviewer.bin are cause SELinux access denials, causing the applets to fail to function properly. For example, the Flash image uploader for Facebook fails to work. (Using proprietary Flash plugin.) The usual denied message is this one: type=AVC msg=audit(1207708459.489:321): avc: denied { execmem } for pid=28566 comm="npviewer.bin" scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tclass=process execmem may be icky, but npviewer.bin needs it in order to actually properly run the (essentially) two programs it was written for.