Bug 818163

Summary:	SElinux is preventing /usr/libexec/totem-plugin-viewer from 'create' accesses on the directory .pki from firefox
Product:	[Fedora] Fedora	Reporter:	Filip Skola <fskola>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	17	CC:	amarecek, dominick.grift, dwalsh, mgrepl
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	selinux-policy-3.10.0-121.fc17	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-05-08 04:22:49 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Filip Skola 2012-05-02 11:07:33 UTC

Version-Release number of selected component (if applicable):
selinux-policy-3.10.0-118.fc17.noarch

How reproducible: the first time I tried to open the page on a installed system, but always on fresh install

Steps to Reproduce:
1. run firefox
2. open a webpage that needs a plugin to display correctly (http://blog.mozilla.org worked for me)
  
Actual results: avc denial
Expected results: no avc denial

Comment 1 Daniel Walsh 2012-05-02 13:39:34 UTC

This would require us to allow mozilla_plugin_t to create home_cert_t. Is there value in blocking plugins from writing to cert content?

Comment 2 Daniel Walsh 2012-05-02 13:46:01 UTC

Miroslav can you try this in permissive mode to see what mozilla_plugin_t writes to the ~/.pki directory.

Comment 3 Miroslav Grepl 2012-05-03 08:21:06 UTC

Ok, I see

# ls -lZ /home/mgrepl/.pki/nssdb
#

and the following AVC

avc: denined { create } for pid=1737 comm="totem-plugin-vi" name=".pki" scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=dir

Comment 4 Daniel Walsh 2012-05-03 14:04:20 UTC

Ok I am going to allow it.

Fixed in selinux-policy-3.10.0-121.fc17

Although I am not thrilled with the idea.

Comment 5 Miroslav Grepl 2012-05-04 15:35:14 UTC

Ok. 

Filip,
good catch.

Comment 6 Fedora Update System 2012-05-04 19:53:13 UTC

selinux-policy-3.10.0-121.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-121.fc17

Comment 7 Fedora Update System 2012-05-04 22:17:00 UTC

Package selinux-policy-3.10.0-121.fc17:
* should fix your issue,
* was pushed to the Fedora 17 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-121.fc17'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-7313/selinux-policy-3.10.0-121.fc17
then log in and leave karma (feedback).

Comment 8 Fedora Update System 2012-05-08 04:22:49 UTC

selinux-policy-3.10.0-121.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.