Bug 581455

Resum:

SELinux is preventing /opt/google/chrome/chrome "read" access on
/opt/google/chrome/libnss3.so.1d.

Descripció detallada:

[chrome has a permissive type (chrome_sandbox_t). This access was not denied.]

SELinux denied access requested by chrome. It is not expected that this access
is required by chrome and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.

Permet l'accés:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.

Informació addicional:

Context de la font            unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c
                              0.c1023
Context de l'objectiu         unconfined_u:object_r:usr_t:s0
Objectes objectius            /opt/google/chrome/libnss3.so.1d [ lnk_file ]
Font                          chrome
Camí de la font              /opt/google/chrome/chrome
Port                          <Desconegut>
Ordinador                     (removed)
Paquests RPM font             google-chrome-beta-5.0.342.9-43360
Paquets RPM destí            
RPM de política              selinux-policy-3.6.32-110.fc12
S'ha habilitat el Selinux     True
Tipus de la política         targeted
Mode forçat                  Enforcing
Nom del connector             catchall
Nom de la màquina            (removed)
Plataforma                    Linux pau.dis.ct 2.6.32.10-90.fc12.x86_64 #1 SMP
                              Tue Mar 23 09:47:08 UTC 2010 x86_64 x86_64
Contador d'alertes            1
Vist per primera vegada       dl 12 abr 2010 10:58:02 CEST
Vist per darrera vegada       dl 12 abr 2010 10:58:02 CEST
Identificador local           f06b6a9a-d057-4753-b4ea-0344897dc92a
Número de línies            

Missatges d'auditoria sense p 

node=pau.dis.ct type=AVC msg=audit(1271062682.928:1688): avc:  denied  { read } for  pid=7689 comm="chrome" name="libnss3.so.1d" dev=dm-8 ino=148199 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:usr_t:s0 tclass=lnk_file

node=pau.dis.ct type=SYSCALL msg=audit(1271062682.928:1688): arch=c000003e syscall=2 per=400000 success=yes exit=4 a0=7fff40126db0 a1=0 a2=0 a3=6ffffdff items=0 ppid=0 pid=7689 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="chrome" exe="/opt/google/chrome/chrome" subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  catchall,chrome,chrome_sandbox_t,usr_t,lnk_file,read
audit2allow suggests:

#============= chrome_sandbox_t ==============
allow chrome_sandbox_t usr_t:lnk_file read;