Bug 743606

Summary: SELinux policy preventing nspluginwrapper from wrapping Flash 11.0.1.152
Product: [Fedora] Fedora Reporter: Michel Alexandre Salim <michel>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 16CC: dominick.grift, dwalsh, mgrepl, redhat-bugs, robatino, tiffany.antopolski, twaugh
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: selinux-policy-3.10.0-40.fc16 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-10-19 04:30:39 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Michel Alexandre Salim 2011-10-05 14:01:13 UTC 
Description of problem:
After Adobe Flash is updated to the specified version, Flash-based websites stopped working. When re-running mozilla-plugin-config by hand, it revealed the following error:

$ sudo mozilla-plugin-config -i
*** NSPlugin Viewer  *** ERROR: /usr/lib/mozilla/plugins/libflashplayer.so: cannot restore segment prot after reloc: Permission denied
*** NSPlugin Viewer  *** ERROR: /usr/lib/mozilla/plugins/libflashplayer.so: cannot restore segment prot after reloc: Permission denied

With setenforce 0, mozilla-plugin-config succeeds in rewrapping the new Flash plugin.

Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.10.0-36.fc16.noarch
nspluginwrapper-1.4.4-1.fc16.x86_64
nspluginwrapper-1.4.4-1.fc16.i686
flash-plugin-11.0.1.152-release.i386


How reproducible:
Always

Steps to Reproduce:
1. Follow the instructions from http://fedoraproject.org/wiki/Flash#32_bit_wrapped_version
2. sudo mozilla-plugin-config -i
  
Actual results:
Error restoring segment protection after relocation, as above

Expected results:
Should work without error as with previous Flash versions

Additional info:
Comment 1 Andre Robatino 2011-10-05 14:12:08 UTC 
Although this bug should be dealt with, Adobe now has full 64-bit support (both a 64-bit plugin and a corresponding repo). Just go to http://get.adobe.com/flashplayer/ , select "YUM for Linux (YUM)", download and install adobe-release-x86_64-1.0-1.noarch.rpm, and install flash-plugin from the repo. The instructions on the Flash wiki need to be updated.
Comment 2 Michel Alexandre Salim 2011-10-05 14:59:49 UTC 
Aha, thanks! I'll switch one of my computer to the 64-bit plugin, and keep one with the 32-bit to check if the bug is fixed
Comment 3 Daniel Walsh 2011-10-05 15:26:45 UTC 
 /usr/lib/mozilla/plugins/libflashplayer.so Looks like an old flash player, we have not needed this to be labeled textrel_shlib_t in quite a while
Comment 4 Jeremy Nickurak 2011-10-09 19:23:51 UTC 
Note that nsplugginwrapper is also required in order to run flash (which uses gtk2) under epiphany 3.x (which uses gtk3), so "use 64 bit flash" isn't a total workaround.
Comment 5 Miroslav Grepl 2011-10-10 13:50:24 UTC 
Fixed in -39.fc16 release.
Comment 6 Fedora Update System 2011-10-14 16:17:30 UTC 
selinux-policy-3.10.0-40.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-40.fc16
Comment 7 Fedora Update System 2011-10-15 14:31:11 UTC 
Package selinux-policy-3.10.0-40.fc16:
* should fix your issue,
* was pushed to the Fedora 16 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-40.fc16'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2011-14363
then log in and leave karma (feedback).
Comment 8 Fedora Update System 2011-10-19 04:30:39 UTC 
selinux-policy-3.10.0-40.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.