Bug 964377
| Summary: | SELinux is preventing chrome from 'mmap_zero' accesses on the memprotect . | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Mikhail <mikhail.v.gavrilov> |
| Component: | kernel | Assignee: | Kernel Maintainer List <kernel-maint> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 19 | CC: | dominick.grift, dwalsh, eparis, gansalmon, itamar, jonathan, kernel-maint, madhu.chinakonda, mgrepl |
| Target Milestone: | --- | Keywords: | Reopened |
| Target Release: | --- | ||
| Hardware: | i686 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:9d11b4feaeeaa097cff6de7de113a15a39c34ffa7240a490e4035bb3658428f4 | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-06-07 15:08:17 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
*** This bug has been marked as a duplicate of bug 870670 *** Why you think that this is bug of Google Chrome??? I see this alert only when open very much tabs ~100!!! Seems PAE kernel have problem when application try allocate very many memory. Kernel begins allocate low address and it is trigger this alert. Can you check this??? Well then it would be a kernel bug. application is the wine-preloader *** This bug has been marked as a duplicate of bug 882623 *** |
Description of problem: SELinux is preventing chrome from 'mmap_zero' accesses on the memprotect . ***** Plugin mmap_zero (53.1 confidence) suggests ************************** If you do not think chrome should need to mmap low memory in the kernel. Then you may be under attack by a hacker, this is a very dangerous access. Do contact your security administrator and report this issue. ***** Plugin catchall_boolean (42.6 confidence) suggests ******************* If you want to control the ability to mmap a low area of the address space, as configured by /proc/sys/kernel/mmap_min_addr. Then you must tell SELinux about this by enabling the 'mmap_low_allowed' boolean. You can read 'unconfined_selinux' man page for more details. Do setsebool -P mmap_low_allowed 1 ***** Plugin catchall (5.76 confidence) suggests *************************** If you believe that chrome should be allowed mmap_zero access on the memprotect by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep chrome /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Objects [ memprotect ] Source chrome Source Path chrome Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.12.1-44.fc19.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.9.2-301.fc19.i686.PAE #1 SMP Mon May 13 12:47:57 UTC 2013 i686 i686 Alert Count 670 First Seen 2013-05-08 09:05:21 YEKT Last Seen 2013-05-18 00:18:27 YEKT Local ID 6025d625-9545-4077-bdfc-507c9a8b51bc Raw Audit Messages type=AVC msg=audit(1368814707.93:491): avc: denied { mmap_zero } for pid=5822 comm="wine-preloader" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect Hash: chrome,unconfined_t,unconfined_t,memprotect,mmap_zero audit2allow #============= unconfined_t ============== #!!!! This avc can be allowed using the boolean 'mmap_low_allowed' allow unconfined_t self:memprotect mmap_zero; audit2allow -RYou must regenerate interface info by running /usr/bin/sepolgen-ifgen Additional info: reporter: libreport-2.1.4 hashmarkername: setroubleshoot kernel: 3.9.2-301.fc19.i686.PAE type: libreport Potential duplicate: bug 870670