Bug 1126864 - SElinux prevents creation of .cache/icedtea-web
Summary: SElinux prevents creation of .cache/icedtea-web
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 21
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-08-05 13:32 UTC by birger
Modified: 2014-09-04 13:34 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-09-04 13:34:07 UTC

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description birger 2014-08-05 13:32:50 UTC 
Description of problem:
icedtea run in firefox doesn't start. i get lots of errors about not finding directories in ~/.cache. If I set selinux in permissive mode java applets work.

Version-Release number of selected component (if applicable):
icedtea-web-1.5-4.fc21.x86_64

How reproducible:
Before enabling permissive mode: 100% failure. Applet does not start. Lots of error messages.
With permissive mode: Works as expected
SElinux in Enforcing mode *after* running successfully in permissive mode once: Errors about .cache/icedtea-web/* not being accessible. Applet starts

Steps to Reproduce:
1. navigate to https://www.java.com/en/download/installed.jsp
2.
3.

Actual results:
icedtea logo with error message

Expected results:
verification success

Additional info:
Comment 1 Miroslav Grepl 2014-08-05 15:35:41 UTC 
What AVC are you getting?
Comment 2 birger 2014-08-06 10:34:10 UTC 
see bug 1127162

The whole home directory gets mislabeled for corporate users. More stuff ought to break. I assume this isn't a icedtea-web error at all.
Comment 3 Daniel Walsh 2014-08-06 14:42:02 UTC 
I answered that bug,

semanage fcontext -a -e /home /home/DOMAIN

Should fix your problem here also
Note You need to log in before you can comment on or make changes to this bug.