Bug 749501
| Summary: | SELinux is preventing /opt/google/chrome/chrome from executing nacl_helper_bootstrap | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Antonio T. (sagitter) <anto.trande> | ||||||
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> | ||||||
| Severity: | low | Docs Contact: | |||||||
| Priority: | unspecified | ||||||||
| Version: | 6.1 | CC: | anto.trande, dspaldin, dwalsh, ksrot, mmalik | ||||||
| Target Milestone: | rc | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | All | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | selinux-policy-3.7.19-144.el6 | Doc Type: | Bug Fix | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2012-06-20 12:28:23 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
You will need to execute # chcon -t bin_t /opt/google/chrome/nacl_helper_bootstrap Hi Miroslav, is it a secure operation ? Hi Miroslav, is it a secure operation ? Yes, we are working with the chrome developers now to get a better SELinux policy wrapped around the chrome sandbox. Created attachment 530507 [details]
Selinux-alert-report-2
Thank you Daniel. Another Selinux alert after '# chcon -t bin_t /opt/google/chrome/nacl_helper_bootstrap' command. (See Selinux-alert-report-2 attachment) Yes we know about it, and are working on fixing the problems. This one will need o be dontaudit. There is some development and question about whether we can fix this in the kernel. mmap_zero is a dangerous access to allow. And the tool is just trying to figure out what the lowest value of memory it can allocate. Since RHEL 6.2 External Beta has begun, and this bug remains unresolved, it has been rejected as it is not proposed as exception or blocker. Red Hat invites you to ask your support representative to propose this request, if appropriate and relevant, in the next release of Red Hat Enterprise Linux. Thanks. The automated test produces following AVCs:
----
time->Wed Nov 9 02:10:39 2011
type=SYSCALL msg=audit(1320801039.655:444839): arch=c000003e syscall=59 success=no exit=-13 a0=7f68ed857928 a1=7f68ed86c7c0 a2=7fff36fe41c0 a3=7fff36fdfff0 items=0 ppid=1 pid=30506 auid=503 uid=503 gid=504 euid=503 suid=503 fsuid=503 egid=504 sgid=504 fsgid=504 tty=pts2 ses=60 comm="chrome" exe="/opt/google/chrome/chrome" subj=user_u:user_r:chrome_sandbox_t:s0 key=(null)
type=AVC msg=audit(1320801039.655:444839): avc: denied { execute } for pid=30506 comm="chrome" name="nacl_helper_bootstrap" dev=dm-0 ino=1966147 scontext=user_u:user_r:chrome_sandbox_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file
----
time->Wed Nov 9 02:10:39 2011
type=SYSCALL msg=audit(1320801039.722:444840): arch=c000003e syscall=42 success=no exit=-13 a0=3 a1=7fffd67d89e0 a2=14 a3=7fffd67d89e3 items=0 ppid=30514 pid=30515 auid=4294967295 uid=503 gid=504 euid=503 suid=503 fsuid=503 egid=504 sgid=504 fsgid=504 tty=(none) ses=4294967295 comm="ck-get-x11-serv" exe="/usr/libexec/ck-get-x11-server-pid" subj=unconfined_u:system_r:consolekit_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1320801039.722:444840): avc: denied { connectto } for pid=30515 comm="ck-get-x11-serv" path=002F746D702F2E5831312D756E69782F5831 scontext=unconfined_u:system_r:consolekit_t:s0-s0:c0.c1023 tcontext=user_u:user_r:user_t:s0 tclass=unix_stream_socket
----
time->Wed Nov 9 02:11:41 2011
type=SYSCALL msg=audit(1320801101.024:444885): arch=c000003e syscall=59 success=no exit=-13 a0=7f6c0e395928 a1=7f6c0e3aa7c0 a2=7fff90b06680 a3=7fff90b024b0 items=0 ppid=1 pid=31279 auid=503 uid=503 gid=504 euid=503 suid=503 fsuid=503 egid=504 sgid=504 fsgid=504 tty=pts2 ses=61 comm="chrome" exe="/opt/google/chrome/chrome" subj=staff_u:staff_r:chrome_sandbox_t:s0 key=(null)
type=AVC msg=audit(1320801101.024:444885): avc: denied { execute } for pid=31279 comm="chrome" name="nacl_helper_bootstrap" dev=dm-0 ino=1966147 scontext=staff_u:staff_r:chrome_sandbox_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file
----
time->Wed Nov 9 02:11:41 2011
type=SYSCALL msg=audit(1320801101.237:444886): arch=c000003e syscall=42 success=no exit=-13 a0=3 a1=7fff0c53a730 a2=14 a3=7fff0c53a733 items=0 ppid=31310 pid=31311 auid=4294967295 uid=503 gid=504 euid=503 suid=503 fsuid=503 egid=504 sgid=504 fsgid=504 tty=(none) ses=4294967295 comm="ck-get-x11-serv" exe="/usr/libexec/ck-get-x11-server-pid" subj=unconfined_u:system_r:consolekit_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1320801101.237:444886): avc: denied { connectto } for pid=31311 comm="ck-get-x11-serv" path=002F746D702F2E5831312D756E69782F5832 scontext=unconfined_u:system_r:consolekit_t:s0-s0:c0.c1023 tcontext=staff_u:staff_r:staff_t:s0 tclass=unix_stream_socket
----
time->Wed Nov 9 02:12:42 2011
type=SYSCALL msg=audit(1320801162.068:444930): arch=c000003e syscall=59 success=no exit=-13 a0=7ff887e2d928 a1=7ff887e42860 a2=7ffff60a98e0 a3=7ffff60a5710 items=0 ppid=1 pid=31974 auid=503 uid=503 gid=504 euid=503 suid=503 fsuid=503 egid=504 sgid=504 fsgid=504 tty=pts2 ses=62 comm="chrome" exe="/opt/google/chrome/chrome" subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0 key=(null)
type=AVC msg=audit(1320801162.068:444930): avc: denied { execute } for pid=31974 comm="chrome" name="nacl_helper_bootstrap" dev=dm-0 ino=1966147 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file
----
time->Wed Nov 9 02:13:43 2011
type=SYSCALL msg=audit(1320801223.073:444974): arch=c000003e syscall=59 success=no exit=-13 a0=7fd5742b8928 a1=7fd5742cd7c0 a2=7fff5dbc9ba0 a3=7fff5dbc59d0 items=0 ppid=1 pid=32679 auid=503 uid=503 gid=504 euid=503 suid=503 fsuid=503 egid=504 sgid=504 fsgid=504 tty=pts2 ses=63 comm="chrome" exe="/opt/google/chrome/chrome" subj=xguest_u:xguest_r:chrome_sandbox_t:s0 key=(null)
type=AVC msg=audit(1320801223.073:444974): avc: denied { execute } for pid=32679 comm="chrome" name="nacl_helper_bootstrap" dev=dm-0 ino=1966147 scontext=xguest_u:xguest_r:chrome_sandbox_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file
----
time->Wed Nov 9 02:13:43 2011
type=SYSCALL msg=audit(1320801223.303:444975): arch=c000003e syscall=42 success=no exit=-13 a0=3 a1=7fffed38e560 a2=14 a3=7fffed38e563 items=0 ppid=32710 pid=32711 auid=4294967295 uid=503 gid=504 euid=503 suid=503 fsuid=503 egid=504 sgid=504 fsgid=504 tty=(none) ses=4294967295 comm="ck-get-x11-serv" exe="/usr/libexec/ck-get-x11-server-pid" subj=unconfined_u:system_r:consolekit_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1320801223.303:444975): avc: denied { connectto } for pid=32711 comm="ck-get-x11-serv" path=002F746D702F2E5831312D756E69782F5832 scontext=unconfined_u:system_r:consolekit_t:s0-s0:c0.c1023 tcontext=xguest_u:xguest_r:xguest_t:s0 tclass=unix_stream_socket
----
Did you update to the 6.2 policy? I moved all chrome fixes to 6.3 Fixed in selinux-policy-3.7.19-136.el6 Miroslav you need to back port chrome.if Yes, I need. I am fixing it. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2012-0780.html |
Created attachment 530450 [details] Selinux Alert report Description of problem: SELinux is preventing /opt/google/chrome/chrome from executing nacl_helper_bootstrap Version-Release number of selected component (if applicable): selinux-policy-3.7.19-93.el6_1.7.noarch selinux-policy-targeted-3.7.19-93.el6_1.7.noarch How reproducible: Running Google-Chrome x86_64 release 15.0.874.106 Steps to Reproduce: 1. 2. 3. Actual results: Google-Chrome works Expected results: Additional info: