The problem here is that firefox is not transitioning when you run it.

Does it work if you turn on the 


browser_confine_xguest boolean.

setsebool -P browser_confine_xguest 1

It was turned on.

I've tried to uninstall nspluginwrapper which I didn't use in F8 and F9. 
I assume this avoids the setuid call and complications of context transition.

But then I get the following AVC error:

node=macfed type=AVC msg=audit(1226351324.331:42): avc: denied { execstack } for pid=3237 comm="firefox" scontext=xguest_u:xguest_r:xguest_mozilla_t:s0 tcontext=xguest_u:xguest_r:xguest_mozilla_t:s0 tclass=process 
node=macfed type=SYSCALL msg=audit(1226351324.331:42): arch=40000003 syscall=125 success=no exit=-13 a0=bfc1d000 a1=1000 a2=1000007 a3=fffff000 items=0 ppid=3223 pid=3237 auid=501 uid=501 gid=501 euid=501 suid=501 fsuid=501 egid=501 sgid=501 fsgid=501 tty=(none) ses=1 comm="firefox" exe="/usr/lib/firefox-3.0.2/firefox" subj=xguest_u:xguest_r:xguest_mozilla_t:s0 key=(null) 

I didn't change SELinux boolean values after F10 installation. These are the current relevant settings:

$ getsebool -a | egrep '(xguest|exec|browser)'
allow_execheap --> off
allow_execmem --> off
allow_execmod --> off
allow_execstack --> on
allow_guest_exec_content --> off
allow_mplayer_execstack --> off
allow_nsplugin_execmem --> on
allow_staff_exec_content --> on
allow_sysadm_exec_content --> on
allow_unconfined_exec_content --> on
allow_user_exec_content --> on
allow_xguest_exec_content --> off
allow_xserver_execmem --> on
browser_confine_xguest --> on
browser_write_xguest_data --> on
httpd_execmem --> off
httpd_ssi_exec --> off
xguest_connect_network --> on
xguest_mount_media --> on
xguest_use_bluetooth --> on

Well the first avc shows npviewer running as xguest_t, now you show firefox running as xguest_mozilla_t.

# audit2allow -w -i /tmp/t
node=macfed type=AVC msg=audit(1226351324.331:42): avc: denied { execstack } for pid=3237 comm="firefox" scontext=xguest_u:xguest_r:xguest_mozilla_t:s0 tcontext=xguest_u:xguest_r:xguest_mozilla_t:s0 tclass=process node=macfed 

	Was caused by:
	The boolean allow_execmem was set incorrectly. 
	Description:
	Allow unconfined executables to map a memory region as both executable and writable, this is dangerous and the executable should be reported in bugzilla")

	Allow access by executing:
	# setsebool -P allow_execmem 1

Which was default in Fedora 9.

The interesting thing here is that I would have thought xguest_t->firefox->xguest_mozilla_t->nsplugin->nsplugin_t
But you showed xguest_t->nsplugin->xguest_t

I though nsplugin was started by firefox?

(In reply to comment #3)
> now you show firefox
> running as xguest_mozilla_t.
> 
> # audit2allow -w -i /tmp/t
> node=macfed type=AVC msg=audit(1226351324.331:42): avc: denied { execstack }
> for pid=3237 comm="firefox" scontext=xguest_u:xguest_r:xguest_mozilla_t:s0
> tcontext=xguest_u:xguest_r:xguest_mozilla_t:s0 tclass=process node=macfed 
> 
>  Was caused by:
>  The boolean allow_execmem was set incorrectly. 
> 
>  Allow access by executing:
>  # setsebool -P allow_execmem 1
> 
> Which was default in Fedora 9.

This was the AVC after uninstalling nspluginwrapper. After turning on allow_execmem, Flash player is starting but still not working properly: no sound and video stopps playing. It doesn't make  much difference whether libflashsupport is installed or not. (Only difference is CPU load of Firefox). Pulseaudio seems to be the cause of the problems.

I have tried to extend the xguest SELinux rules with the audit2allow tool but apparently this would end up in a completely unconfined xguest.
I have given up when audit2allow has generated the following rules:


#============= xdm_t ==============
allow xdm_t lib_t:file execmod;

#============= xguest_mozilla_t ==============
allow xguest_mozilla_t user_tmpfs_t:file unlink;

#============= xguest_t ==============
allow xguest_t fusefs_t:filesystem { mount unmount };
allow xguest_t lib_t:file execmod;
allow xguest_t pulseaudio_port_t:tcp_socket name_connect;
allow xguest_t self:capability { setuid dac_read_search sys_admin dac_override };
allow xguest_t tmpfs_t:file read;


During an xguest session lots of pulseaudio errors are logged to /var/log/messages. I've also tried to add xguest to group pulse-rt w/o success:

Nov 11 22:05:20 localhost pulseaudio[11056]: main.c: Called SUID root and real-time/high-priority scheduling was requested in the configuration. However, we lack the necessary privileges:
Nov 11 22:05:20 localhost pulseaudio[11056]: main.c: We are not in group 'pulse-rt' and PolicyKit refuse to grant us privileges. Dropping SUID again.
Nov 11 22:05:20 localhost pulseaudio[11056]: main.c: For enabling real-time scheduling please acquire the appropriate PolicyKit privileges, or become a member of 'pulse-rt', or increase the RLIMIT_NICE/RLIMIT_RTPRIO resource limits for this user.
Nov 11 22:05:20 localhost pulseaudio[11056]: main.c: High-priority scheduling enabled in configuration but not allowed by policy.
Nov 11 22:05:20 localhost pulseaudio[11056]: core-util.c: setpriority(): Keine Berechtigung
Nov 11 22:05:30 localhost gnome-session[10779]: WARNING: Application 'libcanberra-login-sound.desktop' failed to register before timeout
Nov 11 22:05:30 localhost pulseaudio[11132]: pid.c: Daemon already running.
Nov 11 22:05:31 localhost setroubleshoot: SELinux hindert gpk-update-icon (xguest_t) "read" am Zugriff auf ./extra-data.db (var_lib_t). For complete SELinux messages. run sealert -l f319f0c6-a985-4508-9f16-ed1186756a4c
Nov 11 22:05:31 localhost setroubleshoot: [rpc.ERROR] attempt to open server connection failed: Keine Berechtigung
Nov 11 22:05:31 localhost setroubleshoot: SELinux hindert gpk-update-icon (xguest_t) "read" am Zugriff auf ./firmware-BhAckAcu (udev_var_run_t). For complete SELinux messages. run sealert -l cfcbae4c-e421-4abd-bc7f-0c601f8b97a9
Nov 11 22:05:31 localhost setroubleshoot: SELinux hindert gpk-update-icon (xguest_t) "read" am Zugriff auf ./firmware-7Y96inV1 (udev_var_run_t). For complete SELinux messages. run sealert -l f795d59a-b8bc-4574-b927-d21ccb3d06d3
Nov 11 22:06:23 localhost pulseaudio[11061]: shm.c: fstat() failed: Keine Berechtigung
Nov 11 22:06:23 localhost pulseaudio[11061]: pstream.c: Failed to import memory block.

On a normal user account, Flash player and pulseaudio are working fine.

(In reply to comment #3)

> The interesting thing here is that I would have thought
> xguest_t->firefox->xguest_mozilla_t->nsplugin->nsplugin_t
> But you showed xguest_t->nsplugin->xguest_t
> 
> I though nsplugin was started by firefox?
I've also tried out the YouTube plugin of Totem (unsuccessfully as to be expected). Probably this AVC was caused by totem.

Now it seems I've found the solution to the problem:

Obviously the desktop config files installed with the old /etc/desktop-profiles/xguest.zip are no more compatible with the latest GNOME version.
I've simply created a new sabayon profile and replaced the original xguest.zip.

After that there was only one AVC error left to fix:

node=macfed type=AVC msg=audit(1226446315.248:114): avc: denied { sendto } for pid=5729 comm="firefox" scontext=xguest_u:xguest_r:xguest_mozilla_t:s0 tcontext=xguest_u:xguest_r:xguest_mozilla_t:s0 tclass=unix_dgram_socket 
node=macfed type=SYSCALL msg=audit(1226446315.248:114): arch=40000003 syscall=102 success=no exit=-13 a0=9 a1=bf927a00 a2=106f234 a3=0 items=0 ppid=5715 pid=5729 auid=501 uid=501 gid=501 euid=501 suid=501 fsuid=501 egid=501 sgid=501 fsgid=501 tty=(none) ses=2 comm="firefox" exe="/usr/lib/firefox-3.0.2/firefox" subj=xguest_u:xguest_r:xguest_mozilla_t:s0 key=(null) 

From this I've created a xguestlocal.te policy module with audit2allow -M:

module xguestlocal 1.0;

require {
	type xguest_mozilla_t;
	class unix_dgram_socket sendto;
}

#============= xguest_mozilla_t ==============
allow xguest_mozilla_t self:unix_dgram_socket sendto;


Note for reproducing: 
I've uninstalled nspluginwrapper and called
setsebool -P allow_execmem 1 
as adviced.

This bug appears to have been reported against 'rawhide' during the Fedora 10 development cycle.
Changing version to '10'.

More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

This message is a reminder that Fedora 10 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 10.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '10'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 10's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 10 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Fedora 10 changed to end-of-life (EOL) status on 2009-12-17. Fedora 10 is 
no longer maintained, which means that it will not receive any further 
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of 
Fedora please feel free to reopen this bug against that version.

Thank you for reporting this bug and we are sorry it could not be fixed.