Bug 678552

Summary: SELinux is preventing /usr/lib/nspluginwrapper/npviewer.bin from read, write access on the unix_stream_socket unix_stream_socket.
Product: [Fedora] Fedora Reporter: Michel Alexandre Salim <michel>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: dwalsh, mgrepl
Target Milestone: ---Keywords: Reopened
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard: setroubleshoot_trace_hash:9851adfa45c01fb2f307305262127d781dacb103d77fc4a5aff0e94f5be7c5d6
Fixed In Version: selinux-policy-3.9.15-2.fc15 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-03-08 02:20:37 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Michel Alexandre Salim 2011-02-18 11:52:08 UTC
SELinux is preventing /usr/lib/nspluginwrapper/npviewer.bin from read, write access on the unix_stream_socket unix_stream_socket.

*****  Plugin leaks (50.5 confidence) suggests  ******************************

If you want to ignore npviewer.bin trying to read write access the unix_stream_socket unix_stream_socket, because you believe it should not need this access.
Then you should report this as a bug.  
You can generate a local policy module to dontaudit this access.
Do
# grep /usr/lib/nspluginwrapper/npviewer.bin /var/log/audit/audit.log | audit2allow -D -M mypol
# semodule -i mypol.pp

*****  Plugin catchall (50.5 confidence) suggests  ***************************

If you believe that npviewer.bin should be allowed read write access on the unix_stream_socket unix_stream_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep npviewer.bin /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c102
                              3
Target Context                unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c
                              0.c1023
Target Objects                unix_stream_socket [ unix_stream_socket ]
Source                        npviewer.bin
Source Path                   /usr/lib/nspluginwrapper/npviewer.bin
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           nspluginwrapper-1.3.0-17.fc15
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.14-2.fc15
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 2.6.38-rc5+ #1 SMP Thu
                              Feb 17 17:15:53 EST 2011 x86_64 x86_64
Alert Count                   8
First Seen                    Wed 16 Feb 2011 02:16:13 PM EST
Last Seen                     Fri 18 Feb 2011 06:41:32 AM EST
Local ID                      b815090d-fe25-4b70-a1ed-b5e65a77300b

Raw Audit Messages
type=AVC msg=audit(1298029292.606:64): avc:  denied  { read write } for  pid=1843 comm="npviewer.bin" path="socket:[26728]" dev=sockfs ino=26728 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket


type=AVC msg=audit(1298029292.606:64): avc:  denied  { read write } for  pid=1843 comm="npviewer.bin" path="socket:[26073]" dev=sockfs ino=26073 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket


type=AVC msg=audit(1298029292.606:64): avc:  denied  { read write } for  pid=1843 comm="npviewer.bin" path="socket:[25441]" dev=sockfs ino=25441 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket


type=AVC msg=audit(1298029292.606:64): avc:  denied  { read write } for  pid=1843 comm="npviewer.bin" path="socket:[26064]" dev=sockfs ino=26064 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket


type=AVC msg=audit(1298029292.606:64): avc:  denied  { read write } for  pid=1843 comm="npviewer.bin" path="socket:[26069]" dev=sockfs ino=26069 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket


type=AVC msg=audit(1298029292.606:64): avc:  denied  { read write } for  pid=1843 comm="npviewer.bin" path="socket:[25449]" dev=sockfs ino=25449 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket


type=AVC msg=audit(1298029292.606:64): avc:  denied  { read write } for  pid=1843 comm="npviewer.bin" path="socket:[24413]" dev=sockfs ino=24413 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket


type=AVC msg=audit(1298029292.606:64): avc:  denied  { read write } for  pid=1843 comm="npviewer.bin" path="socket:[24428]" dev=sockfs ino=24428 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket


type=AVC msg=audit(1298029292.606:64): avc:  denied  { read write } for  pid=1843 comm="npviewer.bin" path="socket:[24430]" dev=sockfs ino=24430 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket


type=AVC msg=audit(1298029292.606:64): avc:  denied  { read write } for  pid=1843 comm="npviewer.bin" path="socket:[25439]" dev=sockfs ino=25439 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket


type=AVC msg=audit(1298029292.606:64): avc:  denied  { read write } for  pid=1843 comm="npviewer.bin" path="socket:[24421]" dev=sockfs ino=24421 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket


type=AVC msg=audit(1298029292.606:64): avc:  denied  { read write } for  pid=1843 comm="npviewer.bin" path="socket:[26720]" dev=sockfs ino=26720 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket


type=AVC msg=audit(1298029292.606:64): avc:  denied  { read write } for  pid=1843 comm="npviewer.bin" path="socket:[26071]" dev=sockfs ino=26071 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket


type=AVC msg=audit(1298029292.606:64): avc:  denied  { read write } for  pid=1843 comm="npviewer.bin" path="socket:[24426]" dev=sockfs ino=24426 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket


type=AVC msg=audit(1298029292.606:64): avc:  denied  { read write } for  pid=1843 comm="npviewer.bin" path="socket:[26715]" dev=sockfs ino=26715 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket


type=SYSCALL msg=audit(1298029292.606:64): arch=x86_64 syscall=execve per=8 success=yes exit=0 a0=7ffff0b18879 a1=7ffff0b18440 a2=7ffff0b18468 a3=0 items=0 ppid=1675 pid=1843 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm=npviewer.bin exe=/usr/lib/nspluginwrapper/npviewer.bin subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)

Hash: npviewer.bin,nsplugin_t,chrome_sandbox_t,unix_stream_socket,read,write

audit2allow

#============= nsplugin_t ==============
allow nsplugin_t chrome_sandbox_t:unix_stream_socket { read write };

audit2allow -R

#============= nsplugin_t ==============
allow nsplugin_t chrome_sandbox_t:unix_stream_socket { read write };

Comment 1 Daniel Walsh 2011-02-18 14:41:28 UTC
This is a leak from chrome_sandbox to nsplugin.  Will be dontaudited in the next F15 release.

Comment 2 Fedora Update System 2011-02-21 20:44:51 UTC
selinux-policy-3.9.15-2.fc15 has been submitted as an update for Fedora 15.
https://admin.fedoraproject.org/updates/selinux-policy-3.9.15-2.fc15

Comment 3 Fedora Update System 2011-02-22 21:49:13 UTC
selinux-policy-3.9.15-2.fc15 has been pushed to the Fedora 15 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update selinux-policy'.  You can provide feedback for this update here: https://admin.fedoraproject.org/updates/selinux-policy-3.9.15-2.fc15

Comment 4 Fedora Update System 2011-03-08 02:20:13 UTC
selinux-policy-3.9.15-2.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.