Bug 539750
| Summary: | SELinux is preventing the /usr/lib/chromium-browser/chromium-browser from using potentially mislabeled files (/home/akshay/.config/chromium/Dictionaries/en-US-1-2.bdic). | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Akshay Dua <dakshay> |
| Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 12 | CC: | 147spam147, bub181, dlesage, dwalsh, geslinux, jayce.net, mgrepl, scottt.tw |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | i386 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:11dafec3004eed9801d3c13e3b82a8e3ca96bab00711986db6f342af1c810186 | ||
| Fixed In Version: | 3.6.32-49.fc12 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2009-11-30 20:56:56 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
You can add these rules for now using # grep avc /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Fixed in selinux-policy-3.6.32-48.fc12.noarch - selinux-policy-3.6.32-49.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-49.fc12 selinux-policy-3.6.32-49.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2009-12131 I don't have this problem with the new package of selinux (selinux-policy-3.6.32-49.fc12) Click the link above and update the karma please. And how can i update the Karma? thx Just click on http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-49.fc12 And add a comment. Then click works for me, and that ups the Karma. I have released the package anyways. I have already done this. Can you close this bug? selinux-policy-3.6.32-49.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report. |
Summary: SELinux is preventing the /usr/lib/chromium-browser/chromium-browser from using potentially mislabeled files (/home/akshay/.config/chromium/Dictionaries/en-US-1-2.bdic). Detailed Description: [chromium-browse has a permissive type (chrome_sandbox_t). This access was not denied.] SELinux has denied chromium-browse access to potentially mislabeled file(s) (/home/akshay/.config/chromium/Dictionaries/en-US-1-2.bdic). This means that SELinux will not allow chromium-browse to use these files. It is common for users to edit files in their home directory or tmp directories and then move (mv) them to system directories. The problem is that the files end up with the wrong file context which confined applications are not allowed to access. Allowing Access: If you want chromium-browse to access this files, you need to relabel them using restorecon -v '/home/akshay/.config/chromium/Dictionaries/en-US-1-2.bdic'. You might want to relabel the entire directory using restorecon -R -v '/home/akshay/.config/chromium/Dictionaries'. Additional Information: Source Context unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c 0.c1023 Target Context unconfined_u:object_r:gnome_home_t:s0 Target Objects /home/akshay/.config/chromium/Dictionaries/en- US-1-2.bdic [ file ] Source chromium-browse Source Path /usr/lib/chromium-browser/chromium-browser Port <Unknown> Host (removed) Source RPM Packages chromium-4.0.252.0-0.1.20091119svn32498.fc12 Target RPM Packages Policy RPM selinux-policy-3.6.32-41.fc12 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name home_tmp_bad_labels Host Name (removed) Platform Linux (removed) 2.6.31.5-127.fc12.i686.PAE #1 SMP Sat Nov 7 21:25:57 EST 2009 i686 i686 Alert Count 1 First Seen Fri 20 Nov 2009 03:38:43 PM PST Last Seen Fri 20 Nov 2009 03:38:43 PM PST Local ID 3825e569-effc-4d80-9a72-e3e858cb1d22 Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1258760323.176:26493): avc: denied { read } for pid=3713 comm="chromium-browse" path="/home/akshay/.config/chromium/Dictionaries/en-US-1-2.bdic" dev=dm-3 ino=577765 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:gnome_home_t:s0 tclass=file node=(removed) type=SYSCALL msg=audit(1258760323.176:26493): arch=40000003 syscall=192 per=400000 success=yes exit=35745792 a0=0 a1=8600a a2=1 a3=1 items=0 ppid=1 pid=3713 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="chromium-browse" exe="/usr/lib/chromium-browser/chromium-browser" subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 key=(null) Hash String generated from selinux-policy-3.6.32-41.fc12,home_tmp_bad_labels,chromium-browse,chrome_sandbox_t,gnome_home_t,file,read audit2allow suggests: #============= chrome_sandbox_t ============== allow chrome_sandbox_t gnome_home_t:file read;