Bug 859189 - SELinux is preventing plugin-containe from 'read' accesses on the file libflashplayer.so.
Summary: SELinux is preventing plugin-containe from 'read' accesses on the file libfla...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 17
Hardware: i686
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:a1b301600dc92137a0aea12aeea...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-09-20 18:43 UTC by crawford
Modified: 2012-09-21 08:50 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-09-21 08:50:52 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
File: type (9 bytes, text/plain)
2012-09-20 18:43 UTC, crawford
no flags Details
File: hashmarkername (14 bytes, text/plain)
2012-09-20 18:43 UTC, crawford
no flags Details

Description crawford 2012-09-20 18:43:36 UTC
Additional info:
libreport version: 2.0.13
kernel:         3.5.3-1.fc17.i686

description:
:SELinux is preventing plugin-containe from 'read' accesses on the file libflashplayer.so.
:
:*****  Plugin catchall_labels (83.8 confidence) suggests  ********************
:
:If you want to allow plugin-containe to have read access on the libflashplayer.so file
:Then you need to change the label on libflashplayer.so
:Do
:# semanage fcontext -a -t FILE_TYPE 'libflashplayer.so'
:where FILE_TYPE is one of the following: mozilla_exec_t, mozilla_home_t, gstreamer_home_t, alsa_home_t, lpr_exec_t, system_dbusd_var_lib_t, sysctl_crypto_t, application_exec_type, passwd_file_t, mozilla_plugin_exec_t, krb5_conf_t, mplayer_exec_t, mplayer_home_t, mozilla_plugin_tmp_t, sysctl_type, locale_t, dosfs_t, fonts_t, bin_t, cert_t, ld_so_t, proc_t, lib_t, sysfs_t, usr_t, user_fonts_cache_t, samba_var_t, abrt_t, user_tmp_t, samba_etc_t, ld_so_t, lib_t, iceauth_home_t, xauth_home_t, user_fonts_t, user_tmpfs_t, net_conf_t, audio_home_t, cpu_online_t, afs_cache_t, abrt_helper_exec_t, fonts_cache_t, shell_exec_t, mozilla_plugin_rw_t, user_fonts_config_t, mozilla_plugin_t, alsa_etc_rw_t, mozilla_plugin_tmpfs_t, dbusd_etc_t, textrel_shlib_t, pulseaudio_exec_t, pulseaudio_home_t, rpm_script_tmp_t, proc_net_t, ld_so_cache_t, gnome_home_type, user_home_type, configfile, etc_t, cert_t, config_usr_t, udev_var_run_t, xdm_var_run_t, machineid_t, net_conf_t, user_cron_spool_t, sssd_public_t, abrt_var_run_t, home_cert_t. 
:Then execute: 
:restorecon -v 'libflashplayer.so'
:
:
:*****  Plugin catchall (17.1 confidence) suggests  ***************************
:
:If you believe that plugin-containe should be allowed read access on the libflashplayer.so file by default.
:Then you should report this as a bug.
:You can generate a local policy module to allow this access.
:Do
:allow this access for now by executing:
:# grep plugin-containe /var/log/audit/audit.log | audit2allow -M mypol
:# semodule -i mypol.pp
:
:Additional Information:
:Source Context                unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c
:                              0.c1023
:Target Context                unconfined_u:object_r:default_t:s0
:Target Objects                libflashplayer.so [ file ]
:Source                        plugin-containe
:Source Path                   plugin-containe
:Port                          <Unknown>
:Host                          (removed)
:Source RPM Packages           
:Target RPM Packages           
:Policy RPM                    selinux-policy-3.10.0-146.fc17.noarch
:Selinux Enabled               True
:Policy Type                   targeted
:Enforcing Mode                Enforcing
:Host Name                     (removed)
:Platform                      Linux (removed) 3.5.3-1.fc17.i686 #1 SMP Wed Aug
:                              29 19:25:38 UTC 2012 i686 i686
:Alert Count                   17
:First Seen                    2012-09-20 14:16:28 EDT
:Last Seen                     2012-09-20 14:42:17 EDT
:Local ID                      7a1bc8ef-01d0-4280-804b-29b73f8558c2
:
:Raw Audit Messages
:type=AVC msg=audit(1348166537.203:313): avc:  denied  { read } for  pid=6054 comm="plugin-containe" name="libflashplayer.so" dev="dm-1" ino=3015502 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:default_t:s0 tclass=file
:
:
:Hash: plugin-containe,mozilla_plugin_t,default_t,file,read
:
:audit2allow
:
:#============= mozilla_plugin_t ==============
:allow mozilla_plugin_t default_t:file read;
:
:audit2allow -R
:
:#============= mozilla_plugin_t ==============
:allow mozilla_plugin_t default_t:file read;
:

Comment 1 crawford 2012-09-20 18:43:39 UTC
Created attachment 615045 [details]
File: type

Comment 2 crawford 2012-09-20 18:43:41 UTC
Created attachment 615046 [details]
File: hashmarkername

Comment 3 Miroslav Grepl 2012-09-21 08:50:52 UTC
It looks like you moved libflashplayer.so from / to /usr/lib/mozilla. You need to fix labeling now

# restorecon -R -v PATHO/libflashplayer.so


Note You need to log in before you can comment on or make changes to this bug.