Bug 641522
| Summary: | nspluginwrapper cannot look at textrel_shlib_t libraries | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Ulrich Drepper <drepper> |
| Component: | selinux-policy-targeted | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED ERRATA | QA Contact: | Ben Levenson <benl> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 14 | Keywords: | Reopened |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.9.7-4.fc14 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2010-10-28 05:52:19 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
restorecon /opt/google/talkplugin/lib Should fix the label. (In reply to comment #1) > restorecon /opt/google/talkplugin/lib > > Should fix the label. No, Dan, that's the point. Look at the labels I use. Unfortunately Google once again failed to build the binary correctly and has text relocations. Therefore I have to use textrel_shlib_t. But the policy currently doesn't allow this. You will have to relax the policy... Fixed in selinux-policy-3.9.7-4.fc14 selinux-policy-3.9.7-4.fc14 has been submitted as an update for Fedora 14. https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-4.fc14 selinux-policy-3.9.7-4.fc14 has been pushed to the Fedora 14 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-4.fc14 selinux-policy-3.9.7-4.fc14 has been pushed to the Fedora 14 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: Unfortunately Google browser plugins still have text relocations and therefore require textrel_shlib_t type. The policy seems to not allow "search" and "getattr". Summary: SELinux is preventing /usr/lib64/nspluginwrapper/plugin-config "search" access to /opt/google/talkplugin/lib. Detailed Description: SELinux denied access requested by plugin-config. /opt/google/talkplugin/lib may be a mislabeled. /opt/google/talkplugin/lib default SELinux type is lib_t, but its current type is textrel_shlib_t. Changing this file back to the default type, may fix your problem. File contexts can be assigned to a file in the following ways. * Files created in a directory receive the file context of the parent directory by default. * The SELinux policy might override the default label inherited from the parent directory by specifying a process running in context A which creates a file in a directory labeled B will instead create the file with label C. An example of this would be the dhcp client running with the dhclient_t type and creating a file in the directory /etc. This file would normally receive the etc_t type due to parental inheritance but instead the file is labeled with the net_conf_t type because the SELinux policy specifies this. * Users can change the file context on a file using tools such as chcon, or restorecon. This file could have been mislabeled either by user error, or if an normally confined application was run under the wrong domain. However, this might also indicate a bug in SELinux because the file should not have been labeled with this type. If you believe this is a bug, please file a bug report against this package. Allowing Access: You can restore the default system context to this file by executing the restorecon command. restorecon '/opt/google/talkplugin/lib', if this file is a directory, you can recursively restore using restorecon -R '/opt/google/talkplugin/lib'. Fix Command: /sbin/restorecon '/opt/google/talkplugin/lib' Additional Information: Source Context unconfined_u:unconfined_r:nsplugin_config_t:s0-s0: c0.c1023 Target Context system_u:object_r:textrel_shlib_t:s0 Target Objects /opt/google/talkplugin/lib [ dir ] Source plugin-config Source Path /usr/lib64/nspluginwrapper/plugin-config Port <Unknown> Host x201.akkadia.org Source RPM Packages nspluginwrapper-1.3.0-14.fc14 Target RPM Packages google-talkplugin-1.5.1.0-1 Policy RPM selinux-policy-3.9.5-7.fc14 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name restorecon Host Name x201.akkadia.org Platform Linux x201.akkadia.org 2.6.35.4-28.fc14.x86_64 #1 SMP Wed Sep 15 01:56:54 UTC 2010 x86_64 x86_64 Alert Count 7 First Seen Fri 08 Oct 2010 09:16:19 PM EDT Last Seen Fri 08 Oct 2010 09:16:19 PM EDT Local ID 7f4d2d66-d2ec-4fba-9cc5-141b6fd99660 Line Numbers Raw Audit Messages node=x201.akkadia.org type=AVC msg=audit(1286586979.523:32789): avc: denied { search } for pid=2602 comm="plugin-config" name="lib" dev=sda5 ino=6261 scontext=unconfined_u:unconfined_r:nsplugin_config_t:s0-s0:c0.c1023 tcontext=system_u:object_r:textrel_shlib_t:s0 tclass=dir node=x201.akkadia.org type=SYSCALL msg=audit(1286586979.523:32789): arch=c000003e syscall=2 success=no exit=-13 a0=7fffb56925e0 a1=0 a2=0 a3=ffffffff items=0 ppid=2600 pid=2602 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="plugin-config" exe="/usr/lib64/nspluginwrapper/plugin-config" subj=unconfined_u:unconfined_r:nsplugin_config_t:s0-s0:c0.c1023 key=(null) and Summary: SELinux is preventing /usr/lib64/nspluginwrapper/plugin-config "getattr" access to /opt/google/talkplugin/lib. Detailed Description: SELinux denied access requested by plugin-config. /opt/google/talkplugin/lib may be a mislabeled. /opt/google/talkplugin/lib default SELinux type is lib_t, but its current type is textrel_shlib_t. Changing this file back to the default type, may fix your problem. File contexts can be assigned to a file in the following ways. * Files created in a directory receive the file context of the parent directory by default. * The SELinux policy might override the default label inherited from the parent directory by specifying a process running in context A which creates a file in a directory labeled B will instead create the file with label C. An example of this would be the dhcp client running with the dhclient_t type and creating a file in the directory /etc. This file would normally receive the etc_t type due to parental inheritance but instead the file is labeled with the net_conf_t type because the SELinux policy specifies this. * Users can change the file context on a file using tools such as chcon, or restorecon. This file could have been mislabeled either by user error, or if an normally confined application was run under the wrong domain. However, this might also indicate a bug in SELinux because the file should not have been labeled with this type. If you believe this is a bug, please file a bug report against this package. Allowing Access: You can restore the default system context to this file by executing the restorecon command. restorecon '/opt/google/talkplugin/lib', if this file is a directory, you can recursively restore using restorecon -R '/opt/google/talkplugin/lib'. Fix Command: /sbin/restorecon '/opt/google/talkplugin/lib' Additional Information: Source Context unconfined_u:unconfined_r:nsplugin_config_t:s0-s0: c0.c1023 Target Context system_u:object_r:textrel_shlib_t:s0 Target Objects /opt/google/talkplugin/lib [ dir ] Source plugin-config Source Path /usr/lib64/nspluginwrapper/plugin-config Port <Unknown> Host x201.akkadia.org Source RPM Packages nspluginwrapper-1.3.0-14.fc14 Target RPM Packages google-talkplugin-1.5.1.0-1 Policy RPM selinux-policy-3.9.5-7.fc14 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name restorecon Host Name x201.akkadia.org Platform Linux x201.akkadia.org 2.6.35.4-28.fc14.x86_64 #1 SMP Wed Sep 15 01:56:54 UTC 2010 x86_64 x86_64 Alert Count 1 First Seen Fri 08 Oct 2010 09:16:19 PM EDT Last Seen Fri 08 Oct 2010 09:16:19 PM EDT Local ID 8a0a5e7e-5e04-4b3b-a691-db6ee0367ae5 Line Numbers Raw Audit Messages node=x201.akkadia.org type=AVC msg=audit(1286586979.523:32790): avc: denied { getattr } for pid=2602 comm="plugin-config" path="/opt/google/talkplugin/lib" dev=sda5 ino=6261 scontext=unconfined_u:unconfined_r:nsplugin_config_t:s0-s0:c0.c1023 tcontext=system_u:object_r:textrel_shlib_t:s0 tclass=dir node=x201.akkadia.org type=SYSCALL msg=audit(1286586979.523:32790): arch=c000003e syscall=4 success=no exit=-13 a0=7fffb56925e0 a1=7fffb5692690 a2=7fffb5692690 a3=ffffffff items=0 ppid=2600 pid=2602 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="plugin-config" exe="/usr/lib64/nspluginwrapper/plugin-config" subj=unconfined_u:unconfined_r:nsplugin_config_t:s0-s0:c0.c1023 key=(null) Version-Release number of selected component (if applicable): selinux-policy-targeted-3.9.5-7.fc14.noarch How reproducible: always Steps to Reproduce: 1.install google talk plugin 2.start nspluginwrapper 3. Actual results: messages above Expected results: no messages Additional info: