Bug 604512

Summary:

SELinux is preventing gtk-gnash (nsplugin_t) "read" tmpfs_t.

/tmp is tmpfs

Detailed Description:

SELinux denied access requested by gtk-gnash. It is not expected that this
access is required by gtk-gnash and this access may signal an intrusion attempt.
It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                unconfined_u:unconfined_r:nsplugin_t:s0
Target Context                unconfined_u:object_r:tmpfs_t:s0
Target Objects                pulse-shm-2538062869 [ file ]
Source                        gtk-gnash
Source Path                   /usr/bin/gtk-gnash
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           gnash-0.8.5-3.fc11
Target RPM Packages           
Policy RPM                    selinux-policy-3.6.12-3.fc11
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     (removed)
Platform                      Linux (removed) 2.6.29.1-68.fc11.x86_64 #1
                              SMP Sat Apr 11 02:20:46 EDT 2009 x86_64 x86_64
Alert Count                   2
First Seen                    Wed 15 Apr 2009 23:34:48 EST
Last Seen                     Wed 15 Apr 2009 23:34:48 EST
Local ID                      3738898f-9aa4-4b8c-8560-6a14807e4a19
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1239802488.382:161): avc:  denied  { read } for  pid=10797 comm="gtk-gnash" name="pulse-shm-2538062869" dev=tmpfs ino=666039 scontext=unconfined_u:unconfined_r:nsplugin_t:s0 tcontext=unconfined_u:object_r:tmpfs_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1239802488.382:161): arch=c000003e syscall=2 success=no exit=1041301464 a0=7fff986f75f0 a1=a0000 a2=0 a3=0 items=0 ppid=4128 pid=10797 auid=283929 uid=283929 gid=2033849 euid=283929 suid=283929 fsuid=283929 egid=2033849 sgid=2033849 fsgid=2033849 tty=(none) ses=2 comm="gtk-gnash" exe="/usr/bin/gtk-gnash" subj=unconfined_u:unconfined_r:nsplugin_t:s0 key=(null)



Hash String generated from  catchall,gtk-gnash,nsplugin_t,tmpfs_t,file,read
audit2allow suggests:

#============= nsplugin_t ==============
allow nsplugin_t tmpfs_t:file read;