Bug 864581

Created attachment 624188 [details]
File: type

Created attachment 624189 [details]
File: hashmarkername

You did not include any AVC messages.

I am not sure about what you mean by AVC message because I am not very familiar with the bug report system. I am getting frequent selinux warnings/errors when I use firefox, or konqueror with KHTML enabled; related to nsplugin I believe. I don't get them with webkit. If it is the details in the Review and Submit Bug Report dialog, I pasted it below. Otherwise, I will need directions from you.



SELinux is preventing /usr/lib64/nspluginwrapper/plugin-config from 'write' accesses on the file /tmp/ffi5kD15v (deleted).

*****  Plugin leaks (86.2 confidence) suggests  ******************************

If you want to ignore plugin-config trying to write access the ffi5kD15v (deleted) file, because you believe it should not need this access.
Then you should report this as a bug.  
You can generate a local policy module to dontaudit this access.
Do
# grep /usr/lib64/nspluginwrapper/plugin-config /var/log/audit/audit.log | audit2allow -D -M mypol
# semodule -i mypol.pp

*****  Plugin catchall (14.7 confidence) suggests  ***************************

If you believe that plugin-config should be allowed write access on the ffi5kD15v (deleted) file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep plugin-config /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:mozilla_plugin_config_t:
                              s0-s0:c0.c1023
Target Context                unconfined_u:object_r:user_tmp_t:s0
Target Objects                /tmp/ffi5kD15v (deleted) [ file ]
Source                        plugin-config
Source Path                   /usr/lib64/nspluginwrapper/plugin-config
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           nspluginwrapper-1.4.4-11.fc17.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.10.0-149.fc17.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.5.5-2.fc17.x86_64 #1 SMP Wed Oct
                              3 13:20:37 UTC 2012 x86_64 x86_64
Alert Count                   1
First Seen                    2012-10-09 12:59:33 EDT
Last Seen                     2012-10-09 12:59:33 EDT
Local ID                      8d7f5b15-e20b-4306-865a-23c7ba84f987

Raw Audit Messages
type=AVC msg=audit(1349801973.323:72): avc:  denied  { write } for  pid=2438 comm="plugin-config" path=2F746D702F666669356B44313576202864656C6574656429 dev="dm-1" ino=4689 scontext=unconfined_u:unconfined_r:mozilla_plugin_config_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file


type=AVC msg=audit(1349801973.323:72): avc:  denied  { write } for  pid=2438 comm="plugin-config" path="/home/ss/.sage/gp-expect.log" dev="dm-2" ino=6685386 scontext=unconfined_u:unconfined_r:mozilla_plugin_config_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file


type=SYSCALL msg=audit(1349801973.323:72): arch=x86_64 syscall=execve success=yes exit=0 a0=de1680 a1=dde380 a2=de0cd0 a3=18 items=0 ppid=2436 pid=2438 auid=1000 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm=plugin-config exe=/usr/lib64/nspluginwrapper/plugin-config subj=unconfined_u:unconfined_r:mozilla_plugin_config_t:s0-s0:c0.c1023 key=(null)

Hash: plugin-config,mozilla_plugin_config_t,user_tmp_t,file,write

audit2allow

#============= mozilla_plugin_config_t ==============
allow mozilla_plugin_config_t user_home_t:file write;
allow mozilla_plugin_config_t user_tmp_t:file write;

audit2allow -R

#============= mozilla_plugin_config_t ==============
allow mozilla_plugin_config_t user_home_t:file write;
allow mozilla_plugin_config_t user_tmp_t:file write;

Just added dontaudits for this in F18.

selinux-policy-3.10.0-156.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-156.fc17

Package selinux-policy-3.10.0-156.fc17:
* should fix your issue,
* was pushed to the Fedora 17 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-156.fc17'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-16347/selinux-policy-3.10.0-156.fc17
then log in and leave karma (feedback).

I started firefox in fedora 17 kde spin and this error / warning showed up

Package: (null)
OS Release: Fedora release 17 (Beefy Miracle)

selinux-policy-3.10.0-156.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.