Bug 739618
| Summary: | Chrome/Chromium cannot start due to text relocations | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Jiri Koten <jkoten> | ||||
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | urgent | ||||||
| Version: | 6.1 | CC: | dominick.grift, dwalsh, ebenes, evan, julroy67, mgrepl, mmalik, omoris, psklenar, rhbugzilla | ||||
| Target Milestone: | rc | Keywords: | Regression, TestBlocker | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | selinux-policy-3.7.19-115.el6 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | 730449 | ||||||
| : | 741430 (view as bug list) | Environment: | |||||
| Last Closed: | 2011-12-06 10:19:09 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 730449 | ||||||
| Bug Blocks: | 741430 | ||||||
| Attachments: |
|
||||||
|
Description
Jiri Koten
2011-09-19 16:05:34 UTC
Created attachment 523863 [details]
AVC output
The same issue happens also in rhel6.
Need to back port fix from F16 for wacky Chrome Code. If allow_execmod boolean is off, then following AVC appears:
----
time->Tue Sep 20 14:12:03 2011
type=SYSCALL msg=audit(1316520723.723:127): arch=40000003 syscall=125 success=no exit=-13 a0=b45bb000 a1=31fd000 a2=5 a3=bff83490 items=0 ppid=4250 pid=5722 auid=503 uid=503 gid=505 euid=503 suid=503 fsuid=503 egid=505 sgid=505 fsgid=505 tty=pts0 ses=5 comm="chrome" exe="/opt/google/chrome/chrome" subj=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1316520723.723:127): avc: denied { execmod } for pid=5722 comm="chrome" path="/opt/google/chrome/chrome" dev=dm-0 ino=14873 scontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tcontext=system_u:object_r:execmem_exec_t:s0 tclass=file
----
If allow_execmod boolean is on, then following AVC appears:
----
time->Tue Sep 20 15:19:50 2011
type=SYSCALL msg=audit(1316524790.921:185): arch=40000003 syscall=125 success=no exit=-13 a0=b467d000 a1=31fd000 a2=5 a3=bf99c890 items=0 ppid=0 pid=6217 auid=503 uid=503 gid=505 euid=503 suid=503 fsuid=503 egid=505 sgid=505 fsgid=505 tty=pts0 ses=5 comm="chrome" exe="/opt/google/chrome/chrome" subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1316524790.921:185): avc: denied { execmod } for pid=6217 comm="chrome" path="/opt/google/chrome/chrome" dev=dm-0 ino=14873 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=system_u:object_r:execmem_exec_t:s0 tclass=file
----
Fixed in selinux-policy-3.7.19-112.el6 I have found a bug in the interface. Also fixed in Fedora We need to add
optional_policy(`
execmem_execmod($1_execmem_t)
')
to execmem_role_template() interface
Well, I think I got this. The problem is with policycoreutils and with
* Tue Sep 13 2011 Dan Walsh <dwalsh> 2.0.83-19.14 - restorecon should not alter MCS/MLS labels only types unless you specify -F Resolves: #736153
which causes after "touch /.autorelabel" /dev is not relabeled back to s0 how is defined in the policy.
/dev -d gen_context(system_u:object_r:device_t,s0)
The issue is with /usr/share/dracut/modules.d/99base/selinux-loadpolicy.sh
[ -e "$NEWROOT"/.autorelabel ] && ( echo 0 > "$NEWROOT"/selinux/enforce )
mount --bind /dev "$NEWROOT/dev"
chroot "$NEWROOT" /sbin/restorecon -R /dev
where we need to add -F flag.
hello, it looks like this bug change behavior of many tools as many of our test starts failing: see few example: $ service iptables save $ iptables: Saving firewall rules to /etc/sysconfig/iptables: [FAILED] with policycoreutils-2.0.83-19.13.el6.i686 it works well !!! $ rm -rf /etc/named.conf $ touch /etc/named.conf $ restorecon /etc/named.conf $ echo $? 1 $ ls -laZ /etc/named.conf -rw-r--r--. root root unconfined_u:object_r:named_conf_t:s0 /etc/named.conf # with policycoreutils-2.0.83-19.13.el6.i686 it works well !!! ... adding keyword Regression (In reply to comment #15) policycoreutils-2.0.83-19.15.el6.x86_64 was used ^ maybe it has something in common with bug 736153 but comment 736153#c10 says that its verified. So I am not sure which bug it is. this is a different issue which is fixed in * Fri Sep 23 2011 Dan Walsh <dwalsh> 2.0.83-19.16 - Restorecon should not be exiting with a 1 when it is successful in relabeling a file Resolves: #740699 Resolves: #739587 I am moving this bug back to MODIFIED. Miroslav I just added this to F16.
diff --git a/policy/modules/apps/execmem.if b/policy/modules/apps/execmem.if
index fc9014f..e23f640 100644
--- a/policy/modules/apps/execmem.if
+++ b/policy/modules/apps/execmem.if
@@ -66,9 +66,8 @@ template(`execmem_role_template',`
files_execmod_tmp($1_execmem_t)
- optional_policy(`
- execmem_execmod($1_execmem_t)
- ')
+ allow $3 execmem_exec_t:file execmod;
+ allow $1_execmem_t execmem_exec_t:file execmod;
# needed by plasma-desktop
optional_policy(`
Lets add it to RHEL6.
The problem is we don't have execmem role for xguest. We should add that also. Fixed in selinux-policy-3.7.19-115.el6 http://code.google.com/p/chromium/issues/detail?id=87704 noting that google chrome devs seem to be on track for removing the text relocations, set for milestone v16 of chrome Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2011-1511.html |