Hide Forgot
SELinux is preventing /usr/lib/nspluginwrapper/npviewer.bin from read, write access on the unix_stream_socket unix_stream_socket. ***** Plugin leaks (50.5 confidence) suggests ****************************** If you want to ignore npviewer.bin trying to read write access the unix_stream_socket unix_stream_socket, because you believe it should not need this access. Then you should report this as a bug. You can generate a local policy module to dontaudit this access. Do # grep /usr/lib/nspluginwrapper/npviewer.bin /var/log/audit/audit.log | audit2allow -D -M mypol # semodule -i mypol.pp ***** Plugin catchall (50.5 confidence) suggests *************************** If you believe that npviewer.bin should be allowed read write access on the unix_stream_socket unix_stream_socket by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep npviewer.bin /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c102 3 Target Context unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c 0.c1023 Target Objects unix_stream_socket [ unix_stream_socket ] Source npviewer.bin Source Path /usr/lib/nspluginwrapper/npviewer.bin Port <Unknown> Host (removed) Source RPM Packages nspluginwrapper-1.3.0-17.fc15 Target RPM Packages Policy RPM selinux-policy-3.9.14-2.fc15 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 2.6.38-rc5+ #1 SMP Thu Feb 17 17:15:53 EST 2011 x86_64 x86_64 Alert Count 8 First Seen Wed 16 Feb 2011 02:16:13 PM EST Last Seen Fri 18 Feb 2011 06:41:32 AM EST Local ID b815090d-fe25-4b70-a1ed-b5e65a77300b Raw Audit Messages type=AVC msg=audit(1298029292.606:64): avc: denied { read write } for pid=1843 comm="npviewer.bin" path="socket:[26728]" dev=sockfs ino=26728 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket type=AVC msg=audit(1298029292.606:64): avc: denied { read write } for pid=1843 comm="npviewer.bin" path="socket:[26073]" dev=sockfs ino=26073 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket type=AVC msg=audit(1298029292.606:64): avc: denied { read write } for pid=1843 comm="npviewer.bin" path="socket:[25441]" dev=sockfs ino=25441 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket type=AVC msg=audit(1298029292.606:64): avc: denied { read write } for pid=1843 comm="npviewer.bin" path="socket:[26064]" dev=sockfs ino=26064 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket type=AVC msg=audit(1298029292.606:64): avc: denied { read write } for pid=1843 comm="npviewer.bin" path="socket:[26069]" dev=sockfs ino=26069 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket type=AVC msg=audit(1298029292.606:64): avc: denied { read write } for pid=1843 comm="npviewer.bin" path="socket:[25449]" dev=sockfs ino=25449 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket type=AVC msg=audit(1298029292.606:64): avc: denied { read write } for pid=1843 comm="npviewer.bin" path="socket:[24413]" dev=sockfs ino=24413 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket type=AVC msg=audit(1298029292.606:64): avc: denied { read write } for pid=1843 comm="npviewer.bin" path="socket:[24428]" dev=sockfs ino=24428 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket type=AVC msg=audit(1298029292.606:64): avc: denied { read write } for pid=1843 comm="npviewer.bin" path="socket:[24430]" dev=sockfs ino=24430 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket type=AVC msg=audit(1298029292.606:64): avc: denied { read write } for pid=1843 comm="npviewer.bin" path="socket:[25439]" dev=sockfs ino=25439 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket type=AVC msg=audit(1298029292.606:64): avc: denied { read write } for pid=1843 comm="npviewer.bin" path="socket:[24421]" dev=sockfs ino=24421 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket type=AVC msg=audit(1298029292.606:64): avc: denied { read write } for pid=1843 comm="npviewer.bin" path="socket:[26720]" dev=sockfs ino=26720 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket type=AVC msg=audit(1298029292.606:64): avc: denied { read write } for pid=1843 comm="npviewer.bin" path="socket:[26071]" dev=sockfs ino=26071 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket type=AVC msg=audit(1298029292.606:64): avc: denied { read write } for pid=1843 comm="npviewer.bin" path="socket:[24426]" dev=sockfs ino=24426 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket type=AVC msg=audit(1298029292.606:64): avc: denied { read write } for pid=1843 comm="npviewer.bin" path="socket:[26715]" dev=sockfs ino=26715 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tclass=unix_stream_socket type=SYSCALL msg=audit(1298029292.606:64): arch=x86_64 syscall=execve per=8 success=yes exit=0 a0=7ffff0b18879 a1=7ffff0b18440 a2=7ffff0b18468 a3=0 items=0 ppid=1675 pid=1843 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm=npviewer.bin exe=/usr/lib/nspluginwrapper/npviewer.bin subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null) Hash: npviewer.bin,nsplugin_t,chrome_sandbox_t,unix_stream_socket,read,write audit2allow #============= nsplugin_t ============== allow nsplugin_t chrome_sandbox_t:unix_stream_socket { read write }; audit2allow -R #============= nsplugin_t ============== allow nsplugin_t chrome_sandbox_t:unix_stream_socket { read write };
This is a leak from chrome_sandbox to nsplugin. Will be dontaudited in the next F15 release.
selinux-policy-3.9.15-2.fc15 has been submitted as an update for Fedora 15. https://admin.fedoraproject.org/updates/selinux-policy-3.9.15-2.fc15
selinux-policy-3.9.15-2.fc15 has been pushed to the Fedora 15 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: https://admin.fedoraproject.org/updates/selinux-policy-3.9.15-2.fc15
selinux-policy-3.9.15-2.fc15 has been pushed to the Fedora 15 stable repository. If problems still persist, please make note of it in this bug report.