Description of problem: Load Java Applet from https://www.mojebanka.cz/InternetBanking/?L=CS with Firefox 21. SELinux is preventing /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.19.x86_64/jre/bin/java from 'create' accesses on the directory 10. ***** Plugin mozplugger (99.1 confidence) suggests ************************* If you want to use the plugin package Then you must turn off SELinux controls on the Firefox plugins. Do # setsebool unconfined_mozilla_plugin_transition 0 ***** Plugin catchall (1.81 confidence) suggests *************************** If you believe that java should be allowed create access on the 10 directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep java /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c 0.c1023 Target Context unconfined_u:object_r:user_home_t:s0 Target Objects 10 [ dir ] Source java Source Path /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.19.x86_64/jr e/bin/java Port <Unknown> Host (removed) Source RPM Packages java-1.7.0-openjdk-1.7.0.19-2.3.9.3.fc18.x86_64 Target RPM Packages Policy RPM selinux-policy-3.11.1-92.fc18.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.8.11-200.fc18.x86_64 #1 SMP Wed May 1 19:44:27 UTC 2013 x86_64 x86_64 Alert Count 9 First Seen 2013-05-15 10:52:27 CEST Last Seen 2013-05-15 10:52:30 CEST Local ID 88fc60c5-c906-411a-810d-f0a3e8da372d Raw Audit Messages type=AVC msg=audit(1368607950.749:453): avc: denied { create } for pid=17098 comm="java" name="10" scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=SYSCALL msg=audit(1368607950.749:453): arch=x86_64 syscall=mkdir success=no exit=EACCES a0=7fe5940068a0 a1=1ff a2=7fe668488e20 a3=1f items=0 ppid=16787 pid=17098 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=2 tty=(none) comm=java exe=/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.19.x86_64/jre/bin/java subj=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 key=(null) Hash: java,mozilla_plugin_t,user_home_t,dir,create audit2allow #============= mozilla_plugin_t ============== allow mozilla_plugin_t user_home_t:dir create; audit2allow -R require { type mozilla_plugin_t; } #============= mozilla_plugin_t ============== userdom_manage_user_home_content_dirs(mozilla_plugin_t) Additional info: hashmarkername: setroubleshoot kernel: 3.8.11-200.fc18.x86_64 type: libreport
Is it trying to create 10 in your homedir?
Hmm, I don't know -- is there a way to test it? Anyway, it created following: /home/newman/kbpki/ /home/newman/kbpki/nativLib /home/newman/kbpki/nativLib/libCIMNativeLib.so /home/newman/kbpki/MojeBanka /home/newman/kbpki/MojeBanka/temp /home/newman/kbpki/MojeBanka/PKIApplet.properties
Disregard #2. Yes it does create '10' in /home/newman/.icedtea/cache/: /home/newman/.icedtea/cache/10 /home/newman/.icedtea/cache/10/https /home/newman/.icedtea/cache/10/https/www.mojebanka.cz /home/newman/.icedtea/cache/10/https/www.mojebanka.cz/jars /home/newman/.icedtea/cache/10/https/www.mojebanka.cz/jars/detectVM.jar.gz /home/newman/.icedtea/cache/10/https/www.mojebanka.cz/jars/detectVM.jar.gz.info
Try to execute # chcon -R -t mozilla_home_t /home/newman/.icedtea should fix it.
selinux-policy-3.11.1-95.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-95.fc18
Package selinux-policy-3.11.1-95.fc18: * should fix your issue, * was pushed to the Fedora 18 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.11.1-95.fc18' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-8591/selinux-policy-3.11.1-95.fc18 then log in and leave karma (feedback).
selinux-policy-3.11.1-95.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.
This error seemed to still occured when I used Monzilla to browse to and logged into logmein.com
# chcon -R -t mozilla_home_t /home/newman/.icedtea should fix it for now.
Thanks very much! Work great! Devon
I see this is closed but I am seeing a similar problem with webex on Fedora 17. webex is trying to write to ~/.webex directory tree. Will this fix correct this problem also? WIll is be backported to Fedora 17?
Forgot to say the chcon command Miroslav Grepl posted fixes this webex problem for me.
No, this bug was about .icedtea. Michael, could you open a new one for ~/.webex