Bug 1371742 - SELinux is preventing Chrome_ChildThr from read, write access on the file /home/ted/.mozilla/firefox/3q2u98v0.default/storage/temporary/https+++www.facebook.com/asmjs/module15.
Summary: SELinux is preventing Chrome_ChildThr from read, write access on the file /ho...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 23
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:91c9d8a0582341f6eef2f3fd825...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-08-31 01:55 UTC by Ted
Modified: 2016-08-31 10:52 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-08-31 10:52:55 UTC
Type: ---


Attachments (Terms of Use)

Description Ted 2016-08-31 01:55:10 UTC
Description of problem:
SELinux is preventing Chrome_ChildThr from read, write access on the file /home/ted/.mozilla/firefox/3q2u98v0.default/storage/temporary/https+++www.facebook.com/asmjs/module15.

*****  Plugin restorecon (57.3 confidence) suggests   ************************

If you want to fix the label. 
/home/ted/.mozilla/firefox/3q2u98v0.default/storage/temporary/https+++www.facebook.com/asmjs/module15 default label should be mozilla_home_t.
Then you can run restorecon.
Do
# /sbin/restorecon -v /home/ted/.mozilla/firefox/3q2u98v0.default/storage/temporary/https+++www.facebook.com/asmjs/module15

*****  Plugin mozplugger (43.1 confidence) suggests   ************************

If you want to use the plugin package
Then you must turn off SELinux controls on the Firefox plugins.
Do
# setsebool -P unconfined_mozilla_plugin_transition 0

*****  Plugin catchall (1.06 confidence) suggests   **************************

If you believe that Chrome_ChildThr should be allowed read write access on the module15 file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'Chrome_ChildThr' --raw | audit2allow -M my-ChromeChildThr
# semodule -X 300 -i my-ChromeChildThr.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c
                              0.c1023
Target Context                system_u:object_r:user_home_dir_t:s0
Target Objects                /home/ted/.mozilla/firefox/3q2u98v0.default/storag
                              e/temporary/https+++www.facebook.com/asmjs/module1
                              5 [ file ]
Source                        Chrome_ChildThr
Source Path                   Chrome_ChildThr
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    <Unknown>
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.6.7-200.fc23.x86_64 #1 SMP Wed
                              Aug 17 14:24:53 UTC 2016 x86_64 x86_64
Alert Count                   1
First Seen                    2016-08-30 21:52:00 EDT
Last Seen                     2016-08-30 21:52:00 EDT
Local ID                      7b9f3d10-4b57-4ba4-b035-92e0a3e1262a

Raw Audit Messages
type=AVC msg=audit(1472608320.125:278): avc:  denied  { read write } for  pid=4416 comm="Chrome_ChildThr" path="/home/ted/.mozilla/firefox/3q2u98v0.default/storage/temporary/https+++www.facebook.com/asmjs/module15" dev="sda8" ino=6439827 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:user_home_dir_t:s0 tclass=file permissive=0


Hash: Chrome_ChildThr,mozilla_plugin_t,user_home_dir_t,file,read,write


Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.6.7-200.fc23.x86_64
type:           libreport

Comment 1 Daniel Walsh 2016-08-31 10:52:55 UTC
The alert told you what to do.


*****  Plugin restorecon (57.3 confidence) suggests   ************************

If you want to fix the label. 
/home/ted/.mozilla/firefox/3q2u98v0.default/storage/temporary/https+++www.facebook.com/asmjs/module15 default label should be mozilla_home_t.
Then you can run restorecon.
Do
# /sbin/restorecon -v /home/ted/.mozilla/firefox/3q2u98v0.default/storage/temporary/https+++www.facebook.com/asmjs/module15

I would just do a 

restorecon -R -v ~


Note You need to log in before you can comment on or make changes to this bug.