Description of problem: Google Talk Plugin allow name_connect get access to tcp_socket Additional info: libreport version: 2.0.16 kernel: 3.6.3-1.fc17.x86_64
Created attachment 639401 [details] File: type
Created attachment 639402 [details] File: hashmarkername
*** Bug 873720 has been marked as a duplicate of this bug. ***
Could you attach the AVC information.
Hello, thank you for dealing with this ticket. Is this the information you need? I got it from the SELinux window: Additional Information: Source Context unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c 0.c1023 Target Context system_u:object_r:openvpn_port_t:s0 Target Objects [ tcp_socket ] Source GoogleTalkPlugi Source Path /opt/google/talkplugin/GoogleTalkPlugin Port 1194 Host localhost.localdomain Source RPM Packages google-talkplugin-3.9.1.0-1.x86_64 Target RPM Packages Policy RPM selinux-policy-3.10.0-156.fc17.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name localhost.localdomain Platform Linux localhost.localdomain 3.6.3-1.fc17.x86_64 #1 SMP Mon Oct 22 15:32:35 UTC 2012 x86_64 x86_64 Alert Count 1 First Seen 2012-11-05 20:01:37 CET Last Seen 2012-11-05 20:01:37 CET Local ID bc1df1d0-4a24-42e3-af7b-b570cf165929 Raw Audit Messages type=AVC msg=audit(1352142097.729:395): avc: denied { name_connect } for pid=31242 comm="GoogleTalkPlugi" dest=1194 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:openvpn_port_t:s0 tclass=tcp_socket type=SYSCALL msg=audit(1352142097.729:395): arch=x86_64 syscall=connect success=no exit=EACCES a0=3a a1=7f880bffcfb0 a2=10 a3=f0 items=0 ppid=1 pid=31242 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm=GoogleTalkPlugi exe=/opt/google/talkplugin/GoogleTalkPlugin subj=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 key=(null) Hash: GoogleTalkPlugi,mozilla_plugin_t,openvpn_port_t,tcp_socket,name_connect audit2allow #============= mozilla_plugin_t ============== allow mozilla_plugin_t openvpn_port_t:tcp_socket name_connect; audit2allow -R #============= mozilla_plugin_t ============== allow mozilla_plugin_t openvpn_port_t:tcp_socket name_connect;
(In reply to comment #4) > Could you attach the AVC information. I hit "Reply" so that you could see that I posted a comment.
Did GoolgeTalk work properly? IE Other then this AVC showing up, did you notice anyproblems?
(In reply to comment #7) > Did GoolgeTalk work properly? IE Other then this AVC showing up, did you > notice anyproblems? Google Talk works properly, although sometimes there is no sound. In this case I go to chat settings and change sound settings from analog speakers to standard and back to analog speakers. and then it works. but it occurs only from time to time. and it doesn't work properly with empathy, only on the website.
Are you able to re-create this AVC?
(In reply to comment #9) > Are you able to re-create this AVC? Sorry I don't know how to do this.
Can you get the error to happen again?
No, I tried videochat in GMail, Google+ and Empathy, but it didn't happen. Although the quality of video and sound in Empathy was worse and video went on and off. But I couldn't make the bug happen again. Can it be because the kernel was updated?
No most likely you went to a web site that triggered a connection to tcp port 1194. I am going to close this and see if it happens again, to another user. This port is usually used for vpns. So I am not anxious to open it up.