Bug 733824

Summary: SELinux Policy prevents use of Kindle Web App in Chromium
Product: [Fedora] Fedora Reporter: Muel Kiel <muel>
Component: 0xFFFFAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED NOTABUG QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 15CC: dominick.grift, dwalsh, dwmw2, mcepl, mcepl, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-08-29 08:30:58 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Attachments:
Description Flags
Details from SELinux Troubleshooter none

Description Muel Kiel 2011-08-27 07:10:52 UTC
Created attachment 520163 [details]
Details from SELinux Troubleshooter

Description of problem:
Can't use the Kindle Web app in chromium because SELinux policy prevents the HTML5 offline storage (I think that's what Kindle web app is trying to use) from being accessed by chromium.

Version-Release number of selected component (if applicable):
3.9.16

How reproducible:
Everytime

Steps to Reproduce:
1. Install Chromium from the repos.fedorapeople.org repo
2. Install Kindle Web App in Chromium
3. Try to access Kindle web app
  
Actual results:
The tab gets the crashed symbol and SELinux troubleshooter pops up with a new warning

Expected results:
The amazon kindle web app loads in chromium


Additional info:

The information I got from SELinux Troubleshooter is added as an attachment. After it didn't work the first time I tried restorecon then as per the suggestion of the trouble shooter modified the policy to change the context of the file it was trying to access. Neither of these things worked. Also I replaced my username with <username> and my hostname with <hostname>

Comment 1 Matěj Cepl 2011-08-28 21:16:50 UTC
I don't think this is a local database access to chromium which makes a problems here. Testing both http://www.html5rocks.com/en/tutorials/webdatabase/todo/ and http://www.html5rocks.com/en/tutorials/indexeddb/todo/ with chromium-13.0.782.112-1.fc16.x86_64 from spot's repository and I have no AVC denials in ausearch results.

On the other hand

unconfined_u:object_r:file_t:s0

is almost certainly wrong label. See https://fedoraproject.org/wiki/SELinux/Troubleshooting/AVCDecisions#file_t

Comment 2 Miroslav Grepl 2011-08-29 08:30:58 UTC
You need to fix labels on your homedir

# restorecon -R -v /home

Also you can look at

http://danwalsh.livejournal.com/42768.html

for some details.