Hide Forgot
Adobe started supporting 64bit flash couple of days (weeks) ago. Which means nspluginwrapper is not required for flash anymore anywhere. And given that since somewhere in 3.6.* line, firefox now supports out of the process plugins, it should be possible to confine flash process as such. However, when I run it (in RHEL 6.2 true) I get in pstree -Z this ├─firefox(`unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023') │ ├─plugin-containe(`unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023') │ │ ├─{plugin-contain}(`unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023') │ │ ├─{plugin-contain}(`unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023') │ │ ├─{plugin-contain}(`unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023') │ │ └─{plugin-contain}(`unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023') │ ├─{firefox}(`unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023') │ └─{firefox}(`unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023') i.e., flash plugin (process plugin-container) runs unconfined again. According to the discussion on IRC, there is apparently some support for this in Fedora. Could we backport this to RHEL 6 eventually?
This needs to wait for 6.3
Fixed in selinux-policy-3.7.19-136.el6
Since FailedQA, should this be a 6.3 blocker?
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2012-0780.html