Bug 438384 - tmpwatch cannot access alloc when running compiz-fusion with firefox
tmpwatch cannot access alloc when running compiz-fusion with firefox
Product: Fedora
Classification: Fedora
Component: firefox (Show other bugs)
All Linux
low Severity low
: ---
: ---
Assigned To: Gecko Maintainer
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2008-03-20 13:58 EDT by Taylor Boatright
Modified: 2008-05-30 21:46 EDT (History)
2 users (show)

See Also:
Fixed In Version: Fedora 9
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2008-05-30 21:46:21 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
SElinux alert for this problem. (2.69 KB, text/plain)
2008-03-20 13:58 EDT, Taylor Boatright
no flags Details

  None (edit)
Description Taylor Boatright 2008-03-20 13:58:02 EDT
Description of problem: SElinux is preventing tmpwatch (tmpreaper_t) "setattr"
to ./alloc (usr_t)

Version-Release number of selected component (if applicable):

How reproducible: Run compiz-fusion icon with FireFox running with multiple tabs
 or windows.

Steps to Reproduce:
1. Launch Compiz-fusion
2. Launch FireFox
3. Browse to sites with multimedia and/or have multiple windows/tabs open.
Actual results:  FireFox freezes and requires a force quit, SElinux opens giving
the warning.

Expected results:

Additional info:  When SElinux opens it says to allow access to invoke the
command "restorecon -v './alloc'; however, when I do this,
Comment 1 Taylor Boatright 2008-03-20 13:58:02 EDT
Created attachment 298723 [details]
SElinux alert for this problem.
Comment 2 Miloslav Trmač 2008-03-21 10:00:54 EDT
Is the Firefox behavior reproducible?

As far as I know, firefox doesn't start tmpwatch nor does it depend on tmpwatch
- so either something is mislabeled (and run as tmpreaper_t when it shouldn't),
or the tmpwatch report is unrelated to firefox hanging.

As for the AVC itself, tmpwatch will touch anything in /tmp - so either it
should be allowed to change the inode times, or dontaudited (perhaps deny - with
dontaudit - even stat()ing the file).
Comment 3 Taylor Boatright 2008-03-21 11:58:41 EDT
I believe the FireFox issue is with compiz-fusion and having FireFox open in
more than one workspace.  As for the tmpwatch, I believe it may actually have to
do with Force Quitting but I am still unsure, I will post more information when
it happens again.
Comment 4 Daniel Walsh 2008-03-21 19:14:54 EDT
Yes this has nothing to do with SELinux.  You or some app has mv'd a file
"alloc" to /tmp from /usr which ended up with the wrong context.  Either delete
the file/direcory or

chcon -Rt tmp_t /tmp/alloc

This AVC happening at the same time is a coincidence.

The other problem is a firefox issue, reassigning.
Comment 5 Taylor Boatright 2008-03-22 12:20:41 EDT
I actually believe the FireFox issue comes from having two FireFox windows open
in two different workspaces.  Thank you for the help with the tmp issue though.

Note You need to log in before you can comment on or make changes to this bug.