Bug 517998 - xguest: firefox seams to need execmem
Summary: xguest: firefox seams to need execmem
Keywords:
Status: CLOSED DUPLICATE of bug 512845
Alias: None
Product: Fedora
Classification: Fedora
Component: xguest
Version: 11
Hardware: All
OS: Linux
low
medium
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-08-18 10:53 UTC by Christoph A.
Modified: 2009-08-18 13:39 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2009-08-18 13:39:07 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Christoph A. 2009-08-18 10:53:53 UTC
Description of problem:
Firefox crashes when logged in as xguest
Firefox tries to execute memory (execmem)

Version-Release number of selected component (if applicable):
rpm -qa xguest
xguest-1.0.7-5.fc11.noarch

rpm -qa selinux*
selinux-policy-3.6.12-72.fc11.noarch
selinux-policy-targeted-3.6.12-72.fc11.noarch

rpm -qa firefox*
firefox-3.5.2-2.fc11.i586

uname -r
2.6.29.6-217.2.8.fc11.i686.PAE

How reproducible:
always

Steps to Reproduce:
1.install xguest
2.login as xguest
3.try to start firefox 
  
Actual results:
firefox crashes at startup

Expected results:
firefox should not crash

Additional info:

AVC:
type=AVC msg=audit(1250580934.287:24730): avc: denied { execmem } for
pid=4845 comm="firefox" scontext=xguest_u:xguest_r:mozilla_t:s0
tcontext=xguest_u:xguest_r:mozilla_t:s0 tclass=process

getsebool -a|grep execmem
allow_execmem --> off

setting it to 1 resolves the problem, but this setting would allow execmem also for all other applications. If firefox really neads execmem this should be added to the policy.

ls /usr/lib/mozilla/plugins
librhythmbox-itms-detection-plugin.so  libtotem-cone-plugin.so
libtotem-gmp-plugin.so  libtotem-mully-plugin.so
libtotem-narrowspace-plugin.so


see also:
https://www.redhat.com/archives/fedora-selinux-list/2009-August/msg00139.html


thanks,
Christoph

Comment 2 Eric Paris 2009-08-18 13:39:07 UTC

*** This bug has been marked as a duplicate of bug 512845 ***


Note You need to log in before you can comment on or make changes to this bug.