Created attachment 523863 [details]
AVC output

The same issue happens also in rhel6.

Need to back port fix from F16 for wacky Chrome Code.

If allow_execmod boolean is off, then following AVC appears:
----
time->Tue Sep 20 14:12:03 2011
type=SYSCALL msg=audit(1316520723.723:127): arch=40000003 syscall=125 success=no exit=-13 a0=b45bb000 a1=31fd000 a2=5 a3=bff83490 items=0 ppid=4250 pid=5722 auid=503 uid=503 gid=505 euid=503 suid=503 fsuid=503 egid=505 sgid=505 fsgid=505 tty=pts0 ses=5 comm="chrome" exe="/opt/google/chrome/chrome" subj=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1316520723.723:127): avc:  denied  { execmod } for  pid=5722 comm="chrome" path="/opt/google/chrome/chrome" dev=dm-0 ino=14873 scontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tcontext=system_u:object_r:execmem_exec_t:s0 tclass=file
----

If allow_execmod boolean is on, then following AVC appears:
----
time->Tue Sep 20 15:19:50 2011
type=SYSCALL msg=audit(1316524790.921:185): arch=40000003 syscall=125 success=no exit=-13 a0=b467d000 a1=31fd000 a2=5 a3=bf99c890 items=0 ppid=0 pid=6217 auid=503 uid=503 gid=505 euid=503 suid=503 fsuid=503 egid=505 sgid=505 fsgid=505 tty=pts0 ses=5 comm="chrome" exe="/opt/google/chrome/chrome" subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1316524790.921:185): avc:  denied  { execmod } for  pid=6217 comm="chrome" path="/opt/google/chrome/chrome" dev=dm-0 ino=14873 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=system_u:object_r:execmem_exec_t:s0 tclass=file
----

Fixed in selinux-policy-3.7.19-112.el6

I have found a bug in the interface. Also fixed in Fedora

We need to add

    optional_policy(`
        execmem_execmod($1_execmem_t)
    ')

to execmem_role_template() interface

Well, I think I got this. The problem is with policycoreutils and with 

* Tue Sep 13 2011 Dan Walsh <dwalsh> 2.0.83-19.14 - restorecon should not alter MCS/MLS labels only types unless you specify -F Resolves: #736153


which causes after "touch /.autorelabel" /dev is not relabeled back to s0 how is defined in the policy.

/dev            -d  gen_context(system_u:object_r:device_t,s0)


The issue is with /usr/share/dracut/modules.d/99base/selinux-loadpolicy.sh


[ -e "$NEWROOT"/.autorelabel ] && ( echo 0 > "$NEWROOT"/selinux/enforce )
            mount --bind /dev "$NEWROOT/dev"
            chroot "$NEWROOT" /sbin/restorecon -R /dev


where we need to add -F flag.

hello,
it looks like this bug change behavior of many tools as many of our test starts failing:
see few example:

$ service iptables save
$ iptables: Saving firewall rules to /etc/sysconfig/iptables: [FAILED]
with policycoreutils-2.0.83-19.13.el6.i686 it works well !!!

$ rm -rf /etc/named.conf
$ touch /etc/named.conf
$ restorecon /etc/named.conf
$ echo $?
1
$ ls -laZ /etc/named.conf
-rw-r--r--. root root unconfined_u:object_r:named_conf_t:s0 /etc/named.conf
# with policycoreutils-2.0.83-19.13.el6.i686 it works well !!!

... adding keyword Regression

(In reply to comment #15)
policycoreutils-2.0.83-19.15.el6.x86_64 was used ^

maybe it has something in common with bug 736153 but comment 736153#c10 says that its verified. So I am not sure which bug it is.

this is a different issue which is fixed in 

* Fri Sep 23 2011 Dan Walsh <dwalsh> 2.0.83-19.16
- Restorecon should not be exiting with a 1 when it is successful in relabeling a file
Resolves: #740699
Resolves: #739587

I am moving this bug back to MODIFIED.

Miroslav I just added this to F16.

diff --git a/policy/modules/apps/execmem.if b/policy/modules/apps/execmem.if
index fc9014f..e23f640 100644
--- a/policy/modules/apps/execmem.if
+++ b/policy/modules/apps/execmem.if
@@ -66,9 +66,8 @@ template(`execmem_role_template',`
 
        files_execmod_tmp($1_execmem_t)
 
-       optional_policy(`
-               execmem_execmod($1_execmem_t)
-       ')
+       allow $3 execmem_exec_t:file execmod;
+       allow $1_execmem_t execmem_exec_t:file execmod;
 
        # needed by plasma-desktop
        optional_policy(`

Lets add it to RHEL6.

The problem is we don't have execmem role for xguest.

We should add that also.

Fixed in selinux-policy-3.7.19-115.el6

http://code.google.com/p/chromium/issues/detail?id=87704  noting that google chrome devs seem to be on track for removing the text relocations, set for milestone v16 of chrome

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1511.html