Bug 975745 - SELinux is preventing /usr/lib64/firefox/firefox from 'name_connect' accesses on the tcp_socket .
SELinux is preventing /usr/lib64/firefox/firefox from 'name_connect' accesses...
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: setroubleshoot-plugins (Show other bugs)
19
x86_64 Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Daniel Walsh
Fedora Extras Quality Assurance
abrt_hash:728bc4bc5e11f815a69b7438d1c...
: Reopened
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-06-19 05:13 EDT by Artur Szymczak
Modified: 2013-07-11 23:15 EDT (History)
4 users (show)

See Also:
Fixed In Version: setroubleshoot-plugins-3.0.54-1.fc19
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-07-11 23:15:46 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Artur Szymczak 2013-06-19 05:13:31 EDT
Description of problem:
Same as in bug: 975743
SELinux is preventing /usr/lib64/firefox/firefox from 'name_connect' accesses on the tcp_socket .

*****  Plugin catchall_boolean (89.3 confidence) suggests  *******************

If aby allow system to run with NIS
Then you must tell SELinux about this by enabling the 'nis_enabled' boolean.
Na stronie podręcznika "None" znajduje się więcej informacji.
Do
setsebool -P nis_enabled 1

*****  Plugin catchall (11.6 confidence) suggests  ***************************

If aby firefox powinno mieć domyślnie name_connect dostęp do  tcp_socket.
Then proszę to zgłosić jako błąd.
Można utworzyć lokalny moduł polityki, aby umożliwić ten dostęp.
Do
można tymczasowo zezwolić na ten dostęp wykonując polecenia:
# grep 536F636B657420546872656164 /var/log/audit/audit.log | audit2allow -M mojapolityka
# semodule -i mojapolityka.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:sandbox_x_client_t:s0:c4
                              34,c772
Target Context                system_u:object_r:http_port_t:s0
Target Objects                 [ tcp_socket ]
Source                        536F636B657420546872656164
Source Path                   /usr/lib64/firefox/firefox
Port                          443
Host                          (removed)
Source RPM Packages           firefox-21.0-3.fc19.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-52.fc19.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.9.6-301.fc19.x86_64 #1 SMP Mon
                              Jun 17 14:26:26 UTC 2013 x86_64 x86_64
Alert Count                   7
First Seen                    2013-06-19 13:07:38 CEST
Last Seen                     2013-06-19 13:07:40 CEST
Local ID                      a1eb9927-0aaf-46ef-afc9-7d011f32f6bb

Raw Audit Messages
type=AVC msg=audit(1371640060.464:550): avc:  denied  { name_connect } for  pid=2443 comm=536F636B657420546872656164 dest=443 scontext=unconfined_u:unconfined_r:sandbox_x_client_t:s0:c434,c772 tcontext=system_u:object_r:http_port_t:s0 tclass=tcp_socket


type=SYSCALL msg=audit(1371640060.464:550): arch=x86_64 syscall=connect success=no exit=EACCES a0=2f a1=7f91688fe9d0 a2=1c a3=7f91688fea90 items=0 ppid=2408 pid=2443 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=1 tty=(none) comm=536F636B657420546872656164 exe=/usr/lib64/firefox/firefox subj=unconfined_u:unconfined_r:sandbox_x_client_t:s0:c434,c772 key=(null)

Hash: 536F636B657420546872656164,sandbox_x_client_t,http_port_t,tcp_socket,name_connect

Additional info:
reporter:       libreport-2.1.5
hashmarkername: setroubleshoot
kernel:         3.9.6-301.fc19.x86_64
type:           libreport
Comment 1 Daniel Walsh 2013-06-19 16:23:26 EDT
Try 

sandbox -X -t sandbox_web_t firefox
Comment 2 Artur Szymczak 2013-06-20 02:43:06 EDT
Yes, it is ok to block network connecting in this sandbox, but shouldn't it be dontaudited?
Comment 3 Daniel Walsh 2013-06-20 14:40:47 EDT
Well then how would you know why firefox is not working?

I should add an setroubleshoot that says to try sandbox_web_t or sandbox_net_t.
Comment 4 Artur Szymczak 2013-06-23 05:30:39 EDT
I think it is a good idea.
Comment 5 Daniel Walsh 2013-06-27 17:37:26 EDT
Fixed in setroubleshoot-plugins-3.0.54-1.fc19
Comment 6 Fedora Update System 2013-06-27 17:46:20 EDT
setroubleshoot-plugins-3.0.54-1.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/setroubleshoot-plugins-3.0.54-1.fc19
Comment 7 Fedora Update System 2013-06-29 11:26:25 EDT
Package setroubleshoot-plugins-3.0.54-1.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing setroubleshoot-plugins-3.0.54-1.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-11913/setroubleshoot-plugins-3.0.54-1.fc19
then log in and leave karma (feedback).
Comment 8 Fedora Update System 2013-07-11 23:15:46 EDT
setroubleshoot-plugins-3.0.54-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.