Bug 833550 - SELinux is preventing /usr/bin/rekonq from 'mmap_zero' accesses on the memprotect .
SELinux is preventing /usr/bin/rekonq from 'mmap_zero' accesses on the mempro...
Status: CLOSED DUPLICATE of bug 746171
Product: Fedora
Classification: Fedora
Component: rekonq (Show other bugs)
i686 Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Rex Dieter
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2012-06-19 14:31 EDT by Brallan Jesús Aguilar Rivera
Modified: 2012-06-20 09:05 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-06-20 09:05:44 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Brallan Jesús Aguilar Rivera 2012-06-19 14:31:25 EDT
libreport version: 2.0.10
executable:     /usr/bin/python2.7
hashmarkername: setroubleshoot
kernel:         3.4.2-4.fc17.i686
time:           Tue 19 Jun 2012 12:30:45 PM CST

:SELinux is preventing /usr/bin/rekonq from 'mmap_zero' accesses on the memprotect .
:*****  Plugin mmap_zero (53.1 confidence) suggests  **************************
:If you do not think /usr/bin/rekonq should need to mmap low memory in the kernel.
:Then you may be under attack by a hacker, this is a very dangerous access.
:contact your security administrator and report this issue.
:*****  Plugin catchall_boolean (42.6 confidence) suggests  *******************
:If you want to mmap_low_allowed
:Then you must tell SELinux about this by enabling the 'mmap_low_allowed' boolean.You can read 'unconfined_selinux' man page for more details.
:setsebool -P mmap_low_allowed 1
:*****  Plugin catchall (5.76 confidence) suggests  ***************************
:If you believe that rekonq should be allowed mmap_zero access on the  memprotect by default.
:Then you should report this as a bug.
:You can generate a local policy module to allow this access.
:allow this access for now by executing:
:# grep rekonq /var/log/audit/audit.log | audit2allow -M mypol
:# semodule -i mypol.pp
:Additional Information:
:Source Context                unconfined_u:unconfined_r:unconfined_t:s0
:Target Context                unconfined_u:unconfined_r:unconfined_t:s0
:Target Objects                 [ memprotect ]
:Source                        rekonq
:Source Path                   /usr/bin/rekonq
:Port                          <Unknown>
:Host                          (removed)
:Source RPM Packages           rekonq-0.9.2-1.fc17.i686
:Target RPM Packages           
:Policy RPM                    selinux-policy-3.10.0-130.fc17.noarch
:Selinux Enabled               True
:Policy Type                   targeted
:Enforcing Mode                Enforcing
:Host Name                     (removed)
:Platform                      Linux (removed) 3.4.2-4.fc17.i686 #1 SMP
:                              Thu Jun 14 22:19:00 UTC 2012 i686 i686
:Alert Count                   1
:First Seen                    Tue 19 Jun 2012 12:27:21 PM CST
:Last Seen                     Tue 19 Jun 2012 12:27:21 PM CST
:Local ID                      054de449-3ecc-4622-9fca-18a6a2bd31b9
:Raw Audit Messages
:type=AVC msg=audit(1340130441.49:52): avc:  denied  { mmap_zero } for  pid=1385 comm="rekonq" scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=memprotect
:type=SYSCALL msg=audit(1340130441.49:52): arch=i386 syscall=mmap2 success=no exit=EACCES a0=0 a1=db000 a2=3 a3=22 items=0 ppid=1384 pid=1385 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm=rekonq exe=/usr/bin/rekonq subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null)
:Hash: rekonq,unconfined_t,unconfined_t,memprotect,mmap_zero
:audit2allowunable to open /sys/fs/selinux/policy:  Permission denied
:audit2allow -Runable to open /sys/fs/selinux/policy:  Permission denied
Comment 1 Daniel Walsh 2012-06-19 14:47:09 EDT
This is a dangerous access and not something we will allow on the system.  rekonq should be fixed to not need this access.
Comment 2 Rex Dieter 2012-06-19 15:10:36 EDT
I don't think rekonq (or qtwebkit by extention) does require this by default, but I don't have any i686 box to test.

Reporter, any hints on how to reproduce this?  Just run rekonq or go to any particular websites?

While we're at it, mind posting output of:

ldd -r /usr/bin/reqkonq

(I further wonder if it's any embedded media, gst plugin, or browser plugin at play here)
Comment 3 Brallan Jesús Aguilar Rivera 2012-06-19 16:02:43 EDT
When I type ldd -r /usr/bin/reqkonq:

        linux-gate.so.1 =>  (0xb7776000)
        libkdeinit4_rekonq.so => /lib/libkdeinit4_rekonq.so (0x42d27000)
        libQtScript.so.4 => /lib/libQtScript.so.4 (0x43fd3000)
        libkdewebkit.so.5 => /lib/libkdewebkit.so.5 (0x41786000)
        libQtWebKit.so.4 => /lib/libQtWebKit.so.4 (0x47453000)
        libkutils.so.4 => /lib/libkutils.so.4 (0x410e1000)
        libkemoticons.so.4 => /lib/libkemoticons.so.4 (0x4106a000)
        libkidletime.so.4 => /lib/libkidletime.so.4 (0x41084000)
        libkcmutils.so.4 => /lib/libkcmutils.so.4 (0x415de000)
        libkprintutils.so.4 => /lib/libkprintutils.so.4 (0x410d8000)
        libkparts.so.4 => /lib/libkparts.so.4 (0x419d0000)
        libkio.so.5 => /lib/libkio.so.5 (0x42a72000)
        libQtNetwork.so.4 => /lib/libQtNetwork.so.4 (0x41a4f000)
        libQtXml.so.4 => /lib/libQtXml.so.4 (0x410ec000)
        libnepomukutils.so.4 => /lib/libnepomukutils.so.4 (0x416dd000)
        libnepomuk.so.4 => /lib/libnepomuk.so.4 (0x427eb000)
        libkdeui.so.5 => /lib/libkdeui.so.5 (0x4538a000)
        libQtGui.so.4 => /lib/libQtGui.so.4 (0x44896000)
        libQtSvg.so.4 => /lib/libQtSvg.so.4 (0x41013000)
        libkdecore.so.5 => /lib/libkdecore.so.5 (0x41e58000)
        libQtDBus.so.4 => /lib/libQtDBus.so.4 (0x4136e000)
        libsoprano.so.4 => /lib/libsoprano.so.4 (0x42213000)
        libthreadweaver.so.4 => /lib/libthreadweaver.so.4 (0x41531000)
        libQtCore.so.4 => /lib/libQtCore.so.4 (0x4243c000)
        libpthread.so.0 => /lib/libpthread.so.0 (0x4f96f000)
        libstdc++.so.6 => /lib/libstdc++.so.6 (0x4fb88000)
        libm.so.6 => /lib/libm.so.6 (0x4f99d000)
        libgcc_s.so.1 => /lib/libgcc_s.so.1 (0x4fa1f000)
        libc.so.6 => /lib/libc.so.6 (0x4f7bf000)
        libsqlite3.so.0 => /lib/libsqlite3.so.0 (0x4437d000)
        libXrender.so.1 => /lib/libXrender.so.1 (0x41324000)
        libgio-2.0.so.0 => /lib/libgio-2.0.so.0 (0x4344b000)
        libgstapp-0.10.so.0 => /lib/libgstapp-0.10.so.0 (0x417a9000)
        libgstinterfaces-0.10.so.0 => /lib/libgstinterfaces-0.10.so.0 (0x43428000)
        libgstpbutils-0.10.so.0 => /lib/libgstpbutils-0.10.so.0 (0x43607000)
        libgstvideo-0.10.so.0 => /lib/libgstvideo-0.10.so.0 (0x43408000)
        libgstbase-0.10.so.0 => /lib/libgstbase-0.10.so.0 (0x435a4000)
        libgstreamer-0.10.so.0 => /lib/libgstreamer-0.10.so.0 (0x4331e000)
        libgobject-2.0.so.0 => /lib/libgobject-2.0.so.0 (0x41735000)
        libgmodule-2.0.so.0 => /lib/libgmodule-2.0.so.0 (0x413f3000)
        libgthread-2.0.so.0 => /lib/libgthread-2.0.so.0 (0x41553000)
        librt.so.1 => /lib/librt.so.1 (0x4f992000)
        libxml2.so.2 => /lib/libxml2.so.2 (0x41ba4000)
        libglib-2.0.so.0 => /lib/libglib-2.0.so.0 (0x41d2e000)
        libQtLocation.so.1 => /lib/libQtLocation.so.1 (0x4318b000)
        libQtSensors.so.1 => /lib/libQtSensors.so.1 (0x42416000)
        libXext.so.6 => /lib/libXext.so.6 (0x411dd000)
        libX11.so.6 => /lib/libX11.so.6 (0x4fd23000)
        libXss.so.1 => /lib/libXss.so.1 (0x445b1000)
        libSM.so.6 => /lib/libSM.so.6 (0x41b99000)
        libICE.so.6 => /lib/libICE.so.6 (0x41663000)
        libXft.so.2 => /lib/libXft.so.2 (0x4112f000)
        libXau.so.6 => /lib/libXau.so.6 (0x4fd1d000)
        libXpm.so.4 => /lib/libXpm.so.4 (0x41d1a000)
        libnepomukquery.so.4 => /lib/libnepomukquery.so.4 (0x41691000)
        libz.so.1 => /lib/libz.so.1 (0x4f9ca000)
        libstreamanalyzer.so.0 => /lib/libstreamanalyzer.so.0 (0x418e7000)
        libstreams.so.0 => /lib/libstreams.so.0 (0x417c5000)
        libsolid.so.4 => /lib/libsolid.so.4 (0x42724000)
        libacl.so.1 => /lib/libacl.so.1 (0x42f07000)
        libattr.so.1 => /lib/libattr.so.1 (0x4292e000)
        libssl.so.10 => /lib/libssl.so.10 (0x43833000)
        libcrypto.so.10 => /lib/libcrypto.so.10 (0x4fff8000)
        libsopranoclient.so.1 => /lib/libsopranoclient.so.1 (0x4158d000)
        libqca.so.2 => /lib/libqca.so.2 (0x41425000)
        libattica.so.0.3 => /lib/libattica.so.0.3 (0x42137000)
        libdbusmenu-qt.so.2 => /lib/libdbusmenu-qt.so.2 (0x41558000)
        libXtst.so.6 => /lib/libXtst.so.6 (0x42a69000)
        libXcursor.so.1 => /lib/libXcursor.so.1 (0x41cf5000)
        libXfixes.so.3 => /lib/libXfixes.so.3 (0x41655000)
        libpng15.so.15 => /lib/libpng15.so.15 (0x4121c000)
        libfreetype.so.6 => /lib/libfreetype.so.6 (0x41282000)
        libXi.so.6 => /lib/libXi.so.6 (0x4167f000)
        libXrandr.so.2 => /lib/libXrandr.so.2 (0x419b3000)
        libXinerama.so.1 => /lib/libXinerama.so.1 (0x4165d000)
        libfontconfig.so.1 => /lib/libfontconfig.so.1 (0x4124b000)
        libbz2.so.1 => /lib/libbz2.so.1 (0x41000000)
        liblzma.so.5 => /lib/liblzma.so.5 (0x41343000)
        libresolv.so.2 => /lib/libresolv.so.2 (0x4fb68000)
        libfam.so.0 => /lib/libfam.so.0 (0x41a3e000)
        libdbus-1.so.3 => /lib/libdbus-1.so.3 (0x4fc76000)
        libdl.so.2 => /lib/libdl.so.2 (0x4f98b000)
        /lib/ld-linux.so.2 (0x4f798000)
        libffi.so.5 => /lib/libffi.so.5 (0x4fcc2000)
        libselinux.so.1 => /lib/libselinux.so.1 (0x4f9e2000)
        liborc-0.4.so.0 => /lib/liborc-0.4.so.0 (0x44714000)
        libQtSql.so.4 => /lib/libQtSql.so.4 (0x41097000)
        libxcb.so.1 => /lib/libxcb.so.1 (0x4fe5d000)
        libuuid.so.1 => /lib/libuuid.so.1 (0x4fe81000)
        libHUpnp.so.1 => /lib/libHUpnp.so.1 (0x422fd000)
        libudev.so.0 => /lib/libudev.so.0 (0x419be000)
        libgssapi_krb5.so.2 => /lib/libgssapi_krb5.so.2 (0x43147000)
        libkrb5.so.3 => /lib/libkrb5.so.3 (0x43037000)
        libcom_err.so.2 => /lib/libcom_err.so.2 (0x4fe89000)
        libk5crypto.so.3 => /lib/libk5crypto.so.3 (0x43119000)
        libexpat.so.1 => /lib/libexpat.so.1 (0x411f1000)
        libqtsoap.so.2 => /lib/libqtsoap.so.2 (0x4117f000)
        libkrb5support.so.0 => /lib/libkrb5support.so.0 (0x411b5000)
        libkeyutils.so.1 => /lib/libkeyutils.so.1 (0x4ff80000)
Comment 4 Brallan Jesús Aguilar Rivera 2012-06-19 16:06:45 EDT
I get this error frequently. For example, some times when I log in, specially after suspend my session.
Comment 5 Eric Paris 2012-06-20 09:05:44 EDT
kernel bug.  sorry to distract you.

*** This bug has been marked as a duplicate of bug 746171 ***

Note You need to log in before you can comment on or make changes to this bug.