| Summary: | SELinux is preventing /usr/lib64/xulrunner-2/plugin-container from execute access on the arquivo /usr/lib64/mozilla/plugins/libflashplayer.so. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Rafael Santos <rafael> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED NOTABUG | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | low | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 16 | CC: | dominick.grift, dwalsh, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-10-03 08:21:38 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Rafael Santos
2011-10-02 16:36:02 UTC
The issue is that you have moved the lib from your home directory to the mozilla plugin directory. If you would have copied the file instead of move it this issue would not have happened. But i agree. Users that stick to the default SElinux user mapping in a default installation are usually not familiar with SELinux and probably think this is some kind of bug. Therefore we should not run anything confined for these users, as that will confront them with issues like the issue you report above. Fedora should set "unconfined_mozilla_plugin_transition" to off by default, and maybe she will by the time Fedora 16 goes stable. Currently it is beta. The matter is pretty complicated. Fedora has a "unconfined" SELinux environment and it is currently the default SELinux environment for users. This environment was as far as i know designed so that (specified) users could be exempted from SELinux restriction/protection. This unconfined SELinux environment was designed i think in Fedora 3, because when SELinux was introduced in Fedora 2 (i believe), there were only protected/restricted SELinux environments. Users were not happy by these restrictions. (i guess also because then it had rought edges) The problem in my view is that the unconfined SELinux environment that was designed was implemented as a permanent solution to the problem described above, rather that a temporary solution, until the protected SELinux environments were better polished. This caused problems later, as the man focus was on the unconfined SELinux environment, and by the time the restricted SELinux user environments were merged (back) in (In fedora 8) Almost no one bothered to use it, and Fedora did not force/stimulate it because they left the unconfined SELinux user environment to be the default. And in the mean time the model was broken in the sense that Fedora started using SELinux to protect the unprotected (or confine the unconfined) by using SELinux to implement memory protection by default and other protection, And so over time the unconfined domain became more confined and the very issues that caused Fedora to design the unconfined domain in the first place, resurfaced or were reintroduced. Nowadays, it seems that Fedora is haunted by these earlier decisions. when policy for protecting the user space is introduced, Fedora sometimes enables it for the default unconfined users during the beta and alpha stage to expose it to a greater audience for optimal testing. And so we encounter reports like yours, which make great sense to me. In the meantime the confined/restricted SELinux user environments are placed in second place and have lower priority. So, its all a bit messed up in my view. The above might not make sense to you, and others might not agree on my take on history about this matter but this is how i experience it. tl;dr Thanks for the report but this is not a bug. You have a good point but Fedora 16 is in beta stage (it is not ready for general consumption yet). By the time Fedora 16 is final this should no longer happen. If it does, then please re-open this report. |