Description of problem: Icedtea plugin failed to load formula1.com Live Timing Java applet. SELinux is preventing /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.19/jre/bin/java from 'create' accesses on the directory .icedtea. ***** Plugin mozplugger (99.1 confidence) suggests ************************* If you want to use the plugin package Then you must turn off SELinux controls on the Firefox plugins. Do # setsebool unconfined_mozilla_plugin_transition 0 ***** Plugin catchall (1.81 confidence) suggests *************************** If si crede che java dovrebbe avere possibilità di accesso create sui .icedtea directory in modo predefinito. Then si dovrebbe riportare il problema come bug. E' possibile generare un modulo di politica locale per consentire questo accesso. Do consentire questo accesso per il momento eseguendo: # grep java /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c 0.c1023 Target Context unconfined_u:object_r:user_home_dir_t:s0 Target Objects .icedtea [ dir ] Source java Source Path /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.19/jre/bin/j ava Port <Unknown> Host (removed) Source RPM Packages java-1.7.0-openjdk-1.7.0.19-2.3.9.5.fc18.i686 Target RPM Packages Policy RPM selinux-policy-3.11.1-96.fc18.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.9.4-200.fc18.i686 #1 SMP Fri May 24 20:35:02 UTC 2013 i686 i686 Alert Count 16 First Seen 2013-05-26 14:07:48 CEST Last Seen 2013-05-26 14:07:52 CEST Local ID a9abaffe-f530-4151-b7a9-4067c8f5d097 Raw Audit Messages type=AVC msg=audit(1369570072.959:353): avc: denied { create } for pid=1698 comm="java" name=".icedtea" scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=dir type=SYSCALL msg=audit(1369570072.959:353): arch=i386 syscall=mkdir success=no exit=EACCES a0=b4518958 a1=1ff a2=b6cbf000 a3=807fd28 items=0 ppid=1648 pid=1698 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=2 tty=(none) comm=java exe=/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.19/jre/bin/java subj=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 key=(null) Hash: java,mozilla_plugin_t,user_home_dir_t,dir,create audit2allow #============= mozilla_plugin_t ============== allow mozilla_plugin_t user_home_dir_t:dir create; audit2allow -R require { type mozilla_plugin_t; } #============= mozilla_plugin_t ============== userdom_create_user_home_dirs(mozilla_plugin_t) Additional info: hashmarkername: setroubleshoot kernel: 3.9.4-200.fc18.i686 type: libreport
Description of problem: Trying to run games on pogo.com, a java-based web-site. Additional info: hashmarkername: setroubleshoot kernel: 3.9.4-200.fc18.x86_64 type: libreport
The fix has been added. You can execute # chcon -t mozilla_home_t /home/<USER>/.icedtea to make this working for now.
selinux-policy-3.11.1-97.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-97.fc18
I am not really sure if this is the problem I am experiencing, but my java has been giving me troubles since a recent openjdk update. Currently running 1.7.0.19, which should be the latest version. For some reason the SELinux Troubleshoot GUI that usually notifies me of denials does not warn me of any errors. audit2allow -b doesn't give any errors, and sudo audit2allow /var/log/audit/audit.log doesn't finish, it just sits there. Examples of applets not working: The Noregian BankID applets. test link: https://www.bankid.no/Hjelp-og-nyttige-verktoy/Nyttige-verktoy/Test-din-BankID/ Oracles Java Test plugin: http://www.java.com/en/download/installed.jsp?detect=jre In both cases I'm asked to run the plugin, chooses to run it, and all I get is the grey box where the java plugin should load. Example of applet that works: http://www.java.com/en/download/testjava.jsp I have tried to run chcon -t mozilla_home_t /home/<myusername>/.icedtea as both root and normal user to no avail. Also tried clearing the cache in the ~/.icedtea folder. A "couple" of lines from the /var/log/audit/audit.log-file while having these problems: http://pastebin.com/SgbFtdnu I hope some of those are saying you something. Sorry if I should rather have made a new bugreport, but seeing as there is at least three of them opened at the same time, and this semmes SELinux related too, I guessed I'm having a variant of the same problem.
Package selinux-policy-3.11.1-97.fc18: * should fix your issue, * was pushed to the Fedora 18 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.11.1-97.fc18' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-9612/selinux-policy-3.11.1-97.fc18 then log in and leave karma (feedback).
Could you please test it with # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.11.1-97.fc18
Nope, still no go. It manages to download files into the .icedtea/cache folder, but it did that before too. Seems it stalls after that. However, audit2allow reports something now: $ sudo audit2allow -b #============= setroubleshootd_t ============== allow setroubleshootd_t var_run_t:sock_file unlink; Doesn't seem related to me, but I don't know. Output of $ sudo grep denied /var/log/audit/audit.log is: type=AVC msg=audit(1369411786.136:820): avc: denied { name_connect } for pid=17673 comm="plugin-containe" dest=6969 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tor_port_t:s0 tclass=tcp_socket type=AVC msg=audit(1369436238.564:327): avc: denied { name_connect } for pid=3760 comm="plugin-containe" dest=6969 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tor_port_t:s0 tclass=tcp_socket type=AVC msg=audit(1369436250.525:328): avc: denied { name_connect } for pid=3799 comm="plugin-containe" dest=6969 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tor_port_t:s0 tclass=tcp_socket type=AVC msg=audit(1369522842.533:562): avc: denied { name_connect } for pid=4573 comm="plugin-containe" dest=6969 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tor_port_t:s0 tclass=tcp_socket type=AVC msg=audit(1369522845.182:563): avc: denied { name_connect } for pid=4597 comm="plugin-containe" dest=6969 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tor_port_t:s0 tclass=tcp_socket type=AVC msg=audit(1369567465.665:307): avc: denied { name_connect } for pid=2096 comm="plugin-containe" dest=6969 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tor_port_t:s0 tclass=tcp_socket type=AVC msg=audit(1369577322.864:472): avc: denied { create } for pid=4440 comm="java" name=".appletTrustSettings" scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577333.413:473): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577333.466:474): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577333.523:475): avc: denied { write } for pid=4483 comm="java" name="bankid-launcher.jar.info" dev="dm-2" ino=15990804 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577333.524:476): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577333.525:477): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577333.972:478): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577333.973:479): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577333.976:480): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577333.977:481): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577333.983:482): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577333.985:483): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577333.985:484): avc: denied { write } for pid=4483 comm="java" name="bankid-launcher.jar.info" dev="dm-2" ino=15990804 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577333.986:485): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577334.030:486): avc: denied { create } for pid=4483 comm="java" name="11" scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=AVC msg=audit(1369577334.030:487): avc: denied { create } for pid=4483 comm="java" name="11" scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=AVC msg=audit(1369577334.030:488): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577334.031:489): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577334.032:490): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577334.032:491): avc: denied { write } for pid=4483 comm="java" name="bankid-launcher.jar.info" dev="dm-2" ino=15990804 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577334.033:492): avc: denied { write } for pid=4483 comm="java" name="bankid-launcher.jar.info" dev="dm-2" ino=15990804 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577334.034:493): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577334.035:494): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577334.035:495): avc: denied { write } for pid=4483 comm="java" name="bankid-launcher.jar.info" dev="dm-2" ino=15990804 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577334.103:496): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577334.104:497): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577334.105:498): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577334.106:499): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577334.106:500): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577334.107:501): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577334.107:502): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577334.108:503): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577334.109:504): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577334.110:505): avc: denied { write } for pid=4483 comm="java" name="recently_used" dev="dm-2" ino=3151544 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369577334.110:506): avc: denied { write } for pid=4483 comm="java" name="bankid-launcher.jar" dev="dm-2" ino=15990805 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369581665.426:539): avc: denied { setattr } for pid=23311 comm="java" name="bankid-launcher.jar.info.temp" dev="dm-2" ino=19660932 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369581706.253:548): avc: denied { unlink } for pid=23364 comm="java" name="bankid-launcher.jar" dev="dm-2" ino=15990805 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1369662371.525:331): avc: denied { name_connect } for pid=4815 comm="plugin-containe" dest=6969 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tor_port_t:s0 tclass=tcp_socket type=AVC msg=audit(1369736581.741:488): avc: denied { name_connect } for pid=13992 comm="plugin-containe" dest=6969 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tor_port_t:s0 tclass=tcp_socket type=AVC msg=audit(1369742747.433:503): avc: denied { name_connect } for pid=15132 comm="plugin-containe" dest=6969 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tor_port_t:s0 tclass=tcp_socket type=AVC msg=audit(1369833155.454:729): avc: denied { name_connect } for pid=1635 comm="plugin-containe" dest=6969 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tor_port_t:s0 tclass=tcp_socket type=AVC msg=audit(1369842478.810:744): avc: denied { name_connect } for pid=3717 comm="plugin-containe" dest=6969 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tor_port_t:s0 tclass=tcp_socket type=AVC msg=audit(1369848791.495:775): avc: denied { execheap } for pid=5152 comm="steam" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process type=AVC msg=audit(1369877571.232:450): avc: denied { unlink } for pid=6376 comm="setroubleshootd" name="setroubleshoot_server" dev="tmpfs" ino=30657 scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=sock_file Could I have messed up SELinux configs somehow? It seems strange this happened at the same time as SELinux Troubleshooter stopped working - it has always warned me of denials before.
selinux-policy-3.11.1-97.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.
Did you upgrade to the latest selinux-policy?
Yes, I'm still having problems on two different machines. On one the one where SELinux troubleshooter IS working, I don't get any denial warnings either. On the follwing two pages, I only get a grey background field where the applet is supposed to run, after I have pressed "run" in the java security warning window. https://www.bankid.no/Hjelp-og-nyttige-verktoy/Nyttige-verktoy/Test-din-BankID/ and http://www.java.com/en/download/installed.jsp?detect=jre This is with selinux-policy Version : 3.11.1 Release : 97.fc18 I made an IcedTea debug log and put here, in case that helps: http://pastebin.com/28LQ7r5k Aoart from java.io.FileNotFoundException: /home/gert/.icedtea/deployment.properties I don't se anthing that seems odd, but hopefully you will see something. Are the two URLs working for you? Seems strange I should get problems on two different machines.
*** Bug 970251 has been marked as a duplicate of this bug. ***
Naguz can you run restorecon -R -v ~/ And see if you get relabeling
I got "restorecon reset" on a lot of cache files. But still no go with the java test applet. Is there a way to temprarily disable SELinux to verify it is SELinux causing this issue?
(In reply to naguz from comment #13) > I got "restorecon reset" on a lot of cache files. But still no go with the > java test applet. Is there a way to temprarily disable SELinux to verify it > is SELinux causing this issue? http://www.cyberciti.biz/tips/enable-permissive-mode-for-selinux-troubleshooting-purpose.html
setsebool -P unconfined_mozilla_plugin_transition 0 Will disable the check.
*** Bug 994733 has been marked as a duplicate of this bug. ***
*** Bug 998572 has been marked as a duplicate of this bug. ***