Bug 597827
| Summary: | SELinux is preventing /usr/lib/firefox-3.6/firefox from loading /home/john/.mozilla/firefox/mhr3ns3d.default/extensions/{340c2bbc-ce74-4362-90b5-7c26312808ef}/platform/Linux_x86-gcc3/components/WeaveCrypto.so which requires text relocation. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | John Duchek <johnduchek> |
| Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED NOTABUG | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 13 | CC: | dwalsh, jpazdziora, luca.botti, mgrepl, viabsb |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | i386 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:849a76b57535d05b4af0a6df6377b4d3e801ed388e8e515e71ca5f421dbed700 | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2010-05-31 09:51:05 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Alert tells you what you can do.
chcon -t textrel_shlib_t
'/home/john/.mozilla/firefox/mhr3ns3d.default/extensions/{340c2bbc-ce74-4362-90b5-7c26312808ef}/platform/Linux_x86-gcc3/components/WeaveCrypto.so'
Or you can turn off the protection by executing
setsebool -P allow_execmod 1
When trying the above command, on a 32 bit Fedora 13 with latest patches (as of 5th jul 2010) I receive an error regarding invalid content of \{\}.
Please attach the exec error message. (In reply to comment #3) > Please attach the exec error message. It's something like # semanage fcontext -a -t textrel_shlib_t '/home/user/.mozilla/firefox/12345.default/extensions/{340c2bbc-ce74-4362-90b5-7c26312808ef}/platform/Linux_x86-gcc3/components/WeaveCrypto.so' /etc/selinux/targeted/contexts/files/file_contexts.local: line 4 has invalid regex /home/user/.mozilla/firefox/12345.default/extensions/{340c2bbc-ce74-4362-90b5-7c26312808ef}/platform/Linux_x86-gcc3/components/WeaveCrypto.so: Invalid content of \{\} Presumably, setroubleshoot (or whoever it is which is generating the hint command) should escape with backslash any special characters in the filename, like curly brackets, or dots. Except I really do not want to allow this type of path to get into the system since it is likely to cause bugs. (As it has in the past.) Understood. |
Summary: SELinux is preventing /usr/lib/firefox-3.6/firefox from loading /home/john/.mozilla/firefox/mhr3ns3d.default/extensions/{340c2bbc-ce74-4362-90b5-7c26312808ef}/platform/Linux_x86-gcc3/components/WeaveCrypto.so which requires text relocation. Detailed Description: The firefox application attempted to load /home/john/.mozilla/firefox/mhr3ns3d.default/extensions/{340c2bbc-ce74-4362-90b5-7c26312808ef}/platform/Linux_x86-gcc3/components/WeaveCrypto.so which requires text relocation. This is a potential security problem. Most libraries do not need this permission. Libraries are sometimes coded incorrectly and request this permission. The SELinux Memory Protection Tests (http://people.redhat.com/drepper/selinux-mem.html) web page explains how to remove this requirement. You can configure SELinux temporarily to allow /home/john/.mozilla/firefox/mhr3ns3d.default/extensions/{340c2bbc-ce74-4362-90b5-7c26312808ef}/platform/Linux_x86-gcc3/components/WeaveCrypto.so to use relocation as a workaround, until the library is fixed. Please file a bug report. Allowing Access: If you trust /home/john/.mozilla/firefox/mhr3ns3d.default/extensions/{340c2bbc-ce74-4362-90b5-7c26312808ef}/platform/Linux_x86-gcc3/components/WeaveCrypto.so to run correctly, you can change the file context to textrel_shlib_t. "chcon -t textrel_shlib_t '/home/john/.mozilla/firefox/mhr3ns3d.default/extensions/{340c2bbc-ce74-4362-90b5-7c26312808ef}/platform/Linux_x86-gcc3/components/WeaveCrypto.so'" You must also change the default file context files on the system in order to preserve them even on a full relabel. "semanage fcontext -a -t textrel_shlib_t '/home/john/.mozilla/firefox/mhr3ns3d.default/extensions/{340c2bbc-ce74-4362-90b5-7c26312808ef}/platform/Linux_x86-gcc3/components/WeaveCrypto.so'" Fix Command: chcon -t textrel_shlib_t '/home/john/.mozilla/firefox/mhr3ns3d.default/extensions/{340c2bbc-ce74-4362-90b5-7c26312808ef}/platform/Linux_x86-gcc3/components/WeaveCrypto.so' Additional Information: Source Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Context unconfined_u:object_r:mozilla_home_t:s0 Target Objects /home/john/.mozilla/firefox/mhr3ns3d.default/exten sions/{340c2bbc-ce74-4362-90b5-7c26312808ef}/platf orm/Linux_x86-gcc3/components/WeaveCrypto.so [ file ] Source seamonkey-bin Source Path /usr/lib/seamonkey-2.0.4/seamonkey-bin Port <Unknown> Host (removed) Source RPM Packages firefox-3.6.3-4.fc13 Target RPM Packages Policy RPM selinux-policy-3.7.19-10.fc13 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name allow_execmod Host Name (removed) Platform Linux Dell-D610 2.6.33.3-85.fc13.i686.PAE #1 SMP Thu May 6 18:27:11 UTC 2010 i686 i686 Alert Count 5 First Seen Sun 30 May 2010 11:41:06 AM CDT Last Seen Sun 30 May 2010 11:50:33 AM CDT Local ID a6dd7f36-1d2c-4e92-a914-73e14ba650ca Line Numbers Raw Audit Messages node=Dell-D610 type=AVC msg=audit(1275238233.881:28018): avc: denied { execmod } for pid=2607 comm="firefox" path="/home/john/.mozilla/firefox/mhr3ns3d.default/extensions/{340c2bbc-ce74-4362-90b5-7c26312808ef}/platform/Linux_x86-gcc3/components/WeaveCrypto.so" dev=dm-0 ino=1456165 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:mozilla_home_t:s0 tclass=file node=Dell-D610 type=SYSCALL msg=audit(1275238233.881:28018): arch=40000003 syscall=125 success=no exit=-13 a0=8569000 a1=8000 a2=5 a3=bfe40670 items=0 ppid=2590 pid=2607 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="firefox" exe="/usr/lib/firefox-3.6/firefox" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) Hash String generated from allow_execmod,seamonkey-bin,unconfined_t,mozilla_home_t,file,execmod audit2allow suggests: #============= unconfined_t ============== #!!!! This avc can be allowed using the boolean 'allow_execmod' allow unconfined_t mozilla_home_t:file execmod;