Bug 517435 - BBC iPlayer is denied updating by selinux
Summary: BBC iPlayer is denied updating by selinux
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted
Version: 11
Hardware: All
OS: Linux
low
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Ben Levenson
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-08-13 22:07 UTC by Jonathan Pritchard
Modified: 2010-04-28 15:49 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2010-04-28 15:49:06 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Jonathan Pritchard 2009-08-13 22:07:20 UTC
Description of problem:
The BBC iPlayer Desktop Application for Linux can auto-update itself, however it is prevented from doing so by selinux, and generates an avc message.

It does however ask for the root password before doing so and should be seen as reasonably secure.

You can find iPlayer on the BBC website http://bbc.co.uk/iplayer


Version-Release number of selected component (if applicable):
Running Fedora 11 updated as of 13/08/09.


How reproducible:
Every time.

Additional info: AVC message from setroubleshoot (great program by the way) below -

Summary:

SELinux is preventing rpm (unconfined_execmem_t) "transition" rpm_script_t.

Detailed Description:

SELinux denied access requested by rpm. It is not expected that this access is
required by rpm and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                unconfined_u:system_r:unconfined_execmem_t:s0-s0:c
                              0.c1023
Target Context                unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023
Target Objects                /bin/bash [ process ]
Source                        rpm
Source Path                   /bin/rpm
Port                          <Unknown>
Host                          Jon-Laptop
Source RPM Packages           rpm-4.7.1-1.fc11
Target RPM Packages           bash-4.0-7.fc11
Policy RPM                    selinux-policy-3.6.12-72.fc11
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     Jon-Laptop
Platform                      Linux Jon-Laptop 2.6.29.6-217.2.3.fc11.i686.PAE #1
                              SMP Wed Jul 29 16:05:22 EDT 2009 i686 i686
Alert Count                   2
First Seen                    Thu 13 Aug 2009 22:54:07 BST
Last Seen                     Thu 13 Aug 2009 23:00:04 BST
Local ID                      aad05ea9-ed28-437b-b317-787932ebd837
Line Numbers                  

Raw Audit Messages            

node=Jon-Laptop type=AVC msg=audit(1250200804.253:89): avc:  denied  { transition } for  pid=9407 comm="rpm" path="/bin/bash" dev=sda8 ino=25031 scontext=unconfined_u:system_r:unconfined_execmem_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 tclass=process

node=Jon-Laptop type=SYSCALL msg=audit(1250200804.253:89): arch=40000003 syscall=11 success=no exit=-13 a0=8796540 a1=87967f0 a2=87176a8 a3=0 items=0 ppid=9406 pid=9407 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="rpm" exe="/bin/rpm" subj=unconfined_u:system_r:unconfined_execmem_t:s0-s0:c0.c1023 key=(null)

Comment 1 Daniel Walsh 2009-08-13 22:27:51 UTC
Why is rpm running as unconfined_execmem_t?

Comment 2 Jonathan Pritchard 2009-08-13 23:53:40 UTC
I'm afraid I can't answer your question, I am clueless when it comes to selinux. I have never altered what mode selinux is in (haven't found it really necessary this release).

I have found a workaround to this by downloading the update itself (.air) and executing that in my home folder.

Thanks.

Comment 3 Daniel Walsh 2009-08-21 22:29:30 UTC
I think what is happening is you have firefox running as unconfined_execmem_t and when it tried to execute rpm to install a package, it  failed. Were you running as root?

Comment 4 Jonathan Pritchard 2009-08-24 18:30:59 UTC
I wasn't running my session as root, however the update process pops up an Adobe Air window that asks for the root password to continue the upgrade of iPlayer, this is perhaps the equivalent.

If there's any other questions or logs you need, don't hesitate to ask.

Thanks.

Comment 5 Daniel Walsh 2009-08-25 13:38:53 UTC
Jonathan the BBC will not let me run this from the states.

I just wish I new what app is running this for you.

Miroslav, add

unconfined_execmem_trpm_transition_script(unconfined_execmem_t)

to unconfineduser.te

Comment 6 Jonathan Pritchard 2009-08-25 16:29:08 UTC
Sorry I don't understand your last part of Comment #5, are those instructions for me to run?

If there's anything you want me to do, to help you troubleshoot this, just send me the instructions through the bug report and I'll run them and give you the results - it's in everyone's interest.

Thanks for responding so quickly all the time, I've come across a number of other problems with selinux that I'd rather report as bugs to hopefully be fixed, in the hope of a smoother future. I'll report those separately obviously.

Comment 7 Miroslav Grepl 2009-09-02 14:05:05 UTC
Fixed in selinux-policy-3.6.12-82.fc11

Comment 8 Bug Zapper 2010-04-28 09:45:21 UTC
This message is a reminder that Fedora 11 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 11.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '11'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 11's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 11 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping


Note You need to log in before you can comment on or make changes to this bug.