Bug 581458

Resum:

SELinux is preventing /opt/google/chrome/chrome "getattr" access on
/opt/google/chrome/chrome.pak.

Descripció detallada:

[chrome has a permissive type (chrome_sandbox_t). This access was not denied.]

SELinux denied access requested by chrome. It is not expected that this access
is required by chrome and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.

Permet l'accés:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.

Informació addicional:

Context de la font            unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c
                              0.c1023
Context de l'objectiu         system_u:object_r:usr_t:s0
Objectes objectius            /opt/google/chrome/chrome.pak [ file ]
Font                          chrome
Camí de la font              /opt/google/chrome/chrome
Port                          <Desconegut>
Ordinador                     (removed)
Paquests RPM font             google-chrome-beta-5.0.342.9-43360
Paquets RPM destí            google-chrome-beta-5.0.342.9-43360
RPM de política              selinux-policy-3.6.32-110.fc12
S'ha habilitat el Selinux     True
Tipus de la política         targeted
Mode forçat                  Enforcing
Nom del connector             catchall
Nom de la màquina            (removed)
Plataforma                    Linux (removed) 2.6.32.10-90.fc12.x86_64 #1 SMP
                              Tue Mar 23 09:47:08 UTC 2010 x86_64 x86_64
Contador d'alertes            1
Vist per primera vegada       dl 12 abr 2010 10:58:02 CEST
Vist per darrera vegada       dl 12 abr 2010 10:58:02 CEST
Identificador local           4519cfa8-e595-4639-8669-a668498c19bc
Número de línies            

Missatges d'auditoria sense p 

node=(removed) type=AVC msg=audit(1271062682.957:1690): avc:  denied  { getattr } for  pid=7689 comm="chrome" path="/opt/google/chrome/chrome.pak" dev=dm-8 ino=147760 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usr_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1271062682.957:1690): arch=c000003e syscall=5 per=400000 success=yes exit=68719476864 a0=9 a1=7fff40125e10 a2=7fff40125e10 a3=7fff401258c0 items=0 ppid=0 pid=7689 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="chrome" exe="/opt/google/chrome/chrome" subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  catchall,chrome,chrome_sandbox_t,usr_t,file,getattr
audit2allow suggests:

#============= chrome_sandbox_t ==============
allow chrome_sandbox_t usr_t:file getattr;