libreport version: 2.0.6
executable:     /usr/bin/python
hashmarkername: setroubleshoot
kernel:         3.1.0-0.rc8.git0.1.fc16.x86_64
reason:         SELinux is preventing nacl_helper_boo from 'mmap_zero' accesses on the memprotect Unknown.
time:           Sat Oct  8 13:50:12 2011

description:
:(note, first launch of Google Chrome Dev build)
:
:SELinux is preventing nacl_helper_boo from 'mmap_zero' accesses on the memprotect Unknown.
:
:*****  Plugin mmap_zero (50.5 confidence) suggests  **************************
:
:If you do not think nacl_helper_boo should need to mmap low memory in the kernel.
:Then you may be under attack by a hacker, this is a very dangerous access.
:Do
:contact your security administrator and report this issue.
:
:*****  Plugin catchall_boolean (40.5 confidence) suggests  *******************
:
:If you want to control the ability to mmap a low area of the address space, as configured by /proc/sys/kernel/mmap_min_addr.
:Then you must tell SELinux about this by enabling the 'mmap_low_allowed' boolean.
:Do
:setsebool -P mmap_low_allowed 1
:
:*****  Plugin catchall (5.5 confidence) suggests  ****************************
:
:If you believe that nacl_helper_boo should be allowed mmap_zero access on the Unknown memprotect by default.
:Then you should report this as a bug.
:You can generate a local policy module to allow this access.
:Do
:allow this access for now by executing:
:# grep nacl_helper_boo /var/log/audit/audit.log | audit2allow -M mypol
:# semodule -i mypol.pp
:
:*****  Plugin leaks (5.5 confidence) suggests  *******************************
:
:If you want to ignore nacl_helper_boo trying to mmap_zero access the Unknown memprotect, because you believe it should not need this access.
:Then you should report this as a bug.  
:You can generate a local policy module to dontaudit this access.
:Do
:# grep nacl_helper_boo /var/log/audit/audit.log | audit2allow -D -M mypol
:# semodule -i mypol.pp
:
:Additional Information:
:Source Context                unconfined_u:unconfined_r:unconfined_execmem_t:s0-
:                              s0:c0.c1023
:Target Context                unconfined_u:unconfined_r:unconfined_execmem_t:s0-
:                              s0:c0.c1023
:Target Objects                Unknown [ memprotect ]
:Source                        nacl_helper_boo
:Source Path                   nacl_helper_boo
:Port                          <Unknown>
:Host                          (removed)
:Source RPM Packages           
:Target RPM Packages           
:Policy RPM                    selinux-policy-3.10.0-32.fc16
:Selinux Enabled               True
:Policy Type                   targeted
:Enforcing Mode                Enforcing
:Host Name                     (removed)
:Platform                      Linux (removed) 3.1.0-0.rc8.git0.1.fc16.x86_64 #1
:                              SMP Tue Oct 4 03:16:40 UTC 2011 x86_64 x86_64
:Alert Count                   1
:First Seen                    Sat 08 Oct 2011 01:48:29 PM PDT
:Last Seen                     Sat 08 Oct 2011 01:48:29 PM PDT
:Local ID                      3f3001a7-61a4-4fc2-bf51-b2369345fded
:
:Raw Audit Messages
:type=AVC msg=audit(1318106909.547:89): avc:  denied  { mmap_zero } for  pid=13429 comm="nacl_helper_boo" scontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=memprotect
:
:
:type=SYSCALL msg=audit(1318106909.547:89): arch=x86_64 syscall=execve success=no exit=EACCES a0=7f3ef2b746f8 a1=7f3ef2baafe0 a2=7fff3629fec0 a3=7fff3629bd00 items=0 ppid=1 pid=13429 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=2 comm=nacl_helper_boo subj=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 key=(null)
:
:Hash: nacl_helper_boo,unconfined_execmem_t,unconfined_execmem_t,memprotect,mmap_zero
:
:audit2allow
:
:#============= unconfined_execmem_t ==============
:#!!!! This avc can be allowed using the boolean 'mmap_low_allowed'
:
:allow unconfined_execmem_t self:memprotect mmap_zero;
:
:audit2allow -R
:
:#============= unconfined_execmem_t ==============
:#!!!! This avc can be allowed using the boolean 'mmap_low_allowed'
:
:allow unconfined_execmem_t self:memprotect mmap_zero;
: