Bug 747993 - Re-confining of Firefox plugins
Summary: Re-confining of Firefox plugins
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.2
Hardware: All
OS: Linux
high
unspecified
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks: 750385 784309 826592 832998
TreeView+ depends on / blocked
 
Reported: 2011-10-21 16:18 UTC by Matěj Cepl
Modified: 2012-10-15 14:56 UTC (History)
4 users (show)

Fixed In Version: selinux-policy-3.7.19-154.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 784309 (view as bug list)
Environment:
Last Closed: 2012-06-20 12:28:05 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2012:0780 0 normal SHIPPED_LIVE selinux-policy bug fix and enhancement update 2012-06-19 20:34:59 UTC

Description Matěj Cepl 2011-10-21 16:18:29 UTC
Adobe started supporting 64bit flash couple of days (weeks) ago. Which means nspluginwrapper is not required for flash anymore anywhere. And given that since somewhere in 3.6.* line, firefox now supports out of the process plugins, it should be possible to confine flash process as such.

However, when I run it (in RHEL 6.2 true) I get in pstree -Z this

├─firefox(`unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023')
 │ ├─plugin-containe(`unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023')
 │  │ ├─{plugin-contain}(`unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023')
 │  │ ├─{plugin-contain}(`unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023')
 │  │ ├─{plugin-contain}(`unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023')
 │  │ └─{plugin-contain}(`unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023')
 │  ├─{firefox}(`unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023')
 │  └─{firefox}(`unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023')


i.e., flash plugin (process plugin-container) runs unconfined again.

According to the discussion on IRC, there is apparently some support for this in Fedora. Could we backport this to RHEL 6 eventually?

Comment 2 Daniel Walsh 2011-10-21 17:27:06 UTC
This needs to wait for 6.3

Comment 6 Miroslav Grepl 2012-01-26 07:53:03 UTC
Fixed in selinux-policy-3.7.19-136.el6

Comment 9 Suzanne Logcher 2012-05-17 17:56:18 UTC
Since FailedQA, should this be a 6.3 blocker?

Comment 15 errata-xmlrpc 2012-06-20 12:28:05 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0780.html


Note You need to log in before you can comment on or make changes to this bug.