Created attachment 325476 [details] Copy of the selinux alert Description of problem: I have Fedora 10 with all on-line updates applied. I installed RealPlayer 11 and now, everytime I started firefox, I got a message from selinux, preventing npviewer.bin (nsplugin_t) from executing /opt/real/RealPlayer/mozilla/nphelix.so. As suggested in the message, I executed chcon -t bin_t '/opt/real/RealPlayer/mozilla/nphelix.so' and that fixed the problem. Then I executed semanage fcontext -a -t bin_t '/opt/real/RealPlayer/mozilla/nphelix.so', as also suggested by the message. Version-Release number of selected component (if applicable): selinux-policy-3.5.13-18.fc10 firefox-3.0.4-1.fc10 RealPlayer 11.0.1.1056 (GOLD) How reproducible: With the given versions installed, just start firefox, and a message will appear in the problem navigator informing of the problem. Steps to Reproduce: 1. Install the versions given 2. Start Firefox Actual results: Message from selinux preventing the execution of the plugin Expected results: The plugin is loaded without any problem and no message from selinux appears Additional info:
Created attachment 325613 [details] SELinux alert file for one of Adobe Reader files
The same happens about Adobe Reader plugin. I get the same error for all /opt/Adobe/Reader8/Reader/intellinux/sidecars/*.ESP files. The version of the Reader is: AdobeReader_esp-8.1.3-1 (i486) The new (updated today) version of selinux-policy is: selinux-policy-3.5.13-26.fc10 Firefox version is the same. The solution for the problem has been the same as in the case of Real Player, but applied to every of the .ESP files in that directory. I attach one of the selinux alert file, for one of the ESP files.
/opt/real/RealPlayer/mozilla/nphelix.so should be labeled lib_t, if you run restorecon on it, it will get relabeled. I will fix the labeling on adobe. Also you can turn off the confinement of nsplugin, if it is causing you problems. # setsebool -P allow_unconfined_nsplugin_transition 0 Then restart firefox, it should work then. I am changing the default since this is happening to too many people. Fixed in selinux-policy-3.5.13-31.fc10
This message is a reminder that Fedora 10 is nearing its end of life. Approximately 30 (thirty) days from now Fedora will stop maintaining and issuing updates for Fedora 10. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as WONTFIX if it remains open with a Fedora 'version' of '10'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version prior to Fedora 10's end of life. Bug Reporter: Thank you for reporting this issue and we are sorry that we may not be able to fix it before Fedora 10 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora please change the 'version' of this bug to the applicable version. If you are unable to change the version, please add a comment here and someone will do it for you. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. The process we are following is described here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping