Bug 976487

+++ This bug was initially created as a clone of Bug #964417 +++

<<< SNIPPED ORIGINAL BUG COMMENTS >>>

Summary:

SELinux is preventing icedtea-web browser plugin from running any applet.  I believe a fix exists in dist-git for RAWHIDE and/or f19, but I find the issue also affecting f17.


How to reproduce:

Ensure that icedtea-web and firefox packages are installed.  (restart firefox after installing icedtea-web plugin if applicable).

$ yum install firefox icedtea-web

Ensure SELinux is in enforcing mode.

# setenforce 1

Go to any page with java applet.  Such as java test page:
http://www.java.com/en/download/testjava.jsp

Applet pane will remain as grey area, while SELinux AVC will turn up.


Notes:

The original bug seems to refer to two different issues:

1)
SELinux denials on the file ~/abc

This sounds like it is the applet being run trying to use file from home directory.  This isn't something that can be fixed in selinux-policy pakcage, as users may run arbitrary applets that may (if they are able to jump through the correct java security hoops) access arbitrary files in user's home directory; if the user needs a particular applet to access files in way not permitted by installed policy, they can add custom policy as suggested in original bug.

2)
SELinux denials on ~/.icedtea/cache/recently_used

This access is not from any particular applet, but from icedtea-web java browser plugin which is fedora package.  This is known predictable access, so the required policy should be included in selinux-policy.

I'm only reporting 2) here :)


Paste from SELinux details:

SELinux is preventing /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.25.x86_64/jre/bin/java from write access on the file /home/jon/.icedtea/cache/recently_used.
 
*****  Plugin catchall (100. confidence) suggests  ***************************
 
If you believe that java should be allowed write access on the recently_used file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep java /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
 
Additional Information:
Source Context                unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c
                              0.c1023
Target Context                unconfined_u:object_r:user_home_t:s0
Target Objects                /home/jon/.icedtea/cache/recently_used [ file ]
Source                        java
Source Path                   /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.25.x86_64/jr
                              e/bin/java
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           java-1.7.0-openjdk-1.7.0.25-2.3.10.3.fc17.x86_64
Target RPM Packages          
Policy RPM                    selinux-policy-3.10.0-169.fc17.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain 3.8.13-100.fc17.x86_64
                              #1 SMP Mon May 13 13:36:17 UTC 2013 x86_64 x86_64
Alert Count                   35
First Seen                    2013-06-19 15:35:23 EDT
Last Seen                     2013-06-19 15:35:24 EDT
Local ID                      cbc17533-d622-4975-afb7-8fddb6d3ea60
 
Raw Audit Messages
type=AVC msg=audit(1371670524.556:244): avc:  denied  { write } for  pid=10217 comm="java" name="recently_used" dev="dm-1" ino=266198 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file
 
 
type=SYSCALL msg=audit(1371670524.556:244): arch=x86_64 syscall=open success=no exit=EACCES a0=7f19443ee940 a1=241 a2=1b6 a3=6c746e656365722f items=0 ppid=10160 pid=10217 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=3 tty=(none) comm=java exe=/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.25.x86_64/jre/bin/java subj=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 key=(null)
 
Hash: java,mozilla_plugin_t,user_home_t,file,write
 
audit2allow
 
#============= mozilla_plugin_t ==============
allow mozilla_plugin_t user_home_t:file write;
 
audit2allow -R
 
#============= mozilla_plugin_t ==============
allow mozilla_plugin_t user_home_t:file write;


Thanks!