Bug 960798
| Summary: | SELinux is preventing /opt/google/chrome/chrome from 'write' accesses on the directory libreport-2013-05-08-08:18:10.133804-4241. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Mikhail <mikhail.v.gavrilov> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 19 | CC: | abrt-devel-list, dominick.grift, dvlasenk, dwalsh, iprikryl, jfilak, jmoskovc, mgrepl, mmilata, mtoman, redhat, rocketraman |
| Target Milestone: | --- | Keywords: | Reopened |
| Target Release: | --- | ||
| Hardware: | i686 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:6218ead962e3320f428daeff4ecd1adeef8f60a8cd85599655de9d66072f6901 | ||
| Fixed In Version: | selinux-policy-3.12.1-48.fc19 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-06-08 03:32:55 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Thank you for the report, but /opt/google/chrome/chrome is definitely not supported by Fedora, so you'll have to create your own selinux policy to allow the requested action. Well since we ship the policy we have to support the policy. 6fcda96bbeef99f9cdc9bdd57c2445dd6cc586a1 fixes this in git. *** Bug 961857 has been marked as a duplicate of this bug. *** #============= chrome_sandbox_t ============== #!!!! This avc is allowed in the current policy allow chrome_sandbox_t user_tmp_t:dir write; *** Bug 969211 has been marked as a duplicate of this bug. *** selinux-policy-3.12.1-48.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-48.fc19 Package selinux-policy-3.12.1-48.fc19: * should fix your issue, * was pushed to the Fedora 19 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-48.fc19' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-10204/selinux-policy-3.12.1-48.fc19 then log in and leave karma (feedback). selinux-policy-3.12.1-48.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: SELinux is preventing /opt/google/chrome/chrome from 'write' accesses on the directory libreport-2013-05-08-08:18:10.133804-4241. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that chrome should be allowed write access on the libreport-2013-05-08-08:18:10.133804-4241 directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep chrome /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c 0.c1023 Target Context unconfined_u:object_r:user_tmp_t:s0 Target Objects libreport-2013-05-08-08:18:10.133804-4241 [ dir ] Source chrome Source Path /opt/google/chrome/chrome Port <Unknown> Host (removed) Source RPM Packages google-chrome-unstable-28.0.1500.3-198635.i386 Target RPM Packages Policy RPM selinux-policy-3.12.1-42.fc19.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.9.0-301.fc19.i686.PAE #1 SMP Mon Apr 29 13:55:54 UTC 2013 i686 i686 Alert Count 1 First Seen 2013-05-08 08:21:11 YEKT Last Seen 2013-05-08 08:21:11 YEKT Local ID 48a6b5d8-6098-4561-8385-f9a87a43ea43 Raw Audit Messages type=AVC msg=audit(1367979671.897:497): avc: denied { write } for pid=4415 comm="chrome" name="libreport-2013-05-08-08:18:10.133804-4241" dev="tmpfs" ino=139918 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=dir type=SYSCALL msg=audit(1367979671.897:497): arch=i386 syscall=open success=no exit=EACCES a0=b7afc1bc a1=8441 a2=1b6 a3=b7b21b00 items=0 ppid=0 pid=4415 auid=1000 uid=1000 gid=0 euid=1000 suid=1000 fsuid=1000 egid=0 sgid=0 fsgid=0 ses=1 tty=(none) comm=chrome exe=/opt/google/chrome/chrome subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 key=(null) Hash: chrome,chrome_sandbox_t,user_tmp_t,dir,write audit2allow #============= chrome_sandbox_t ============== allow chrome_sandbox_t user_tmp_t:dir write; audit2allow -R require { type chrome_sandbox_t; } #============= chrome_sandbox_t ============== userdom_manage_user_tmp_sockets(chrome_sandbox_t) Additional info: reporter: libreport-2.1.4 hashmarkername: setroubleshoot kernel: 3.9.0-301.fc19.i686.PAE type: libreport