Bug 976487 - SELinux is preventing /usr/lib/jvm/java-1.7.0-openjdk-
SELinux is preventing /usr/lib/jvm/java-1.7.0-openjdk-
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
x86_64 Linux
unspecified Severity unspecified
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
: Reopened
Depends On: 964417
  Show dependency treegraph
Reported: 2013-06-20 12:19 EDT by Jon VanAlten
Modified: 2015-07-13 00:43 EDT (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 964417
Last Closed: 2013-07-04 05:06:42 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Jon VanAlten 2013-06-20 12:19:52 EDT
+++ This bug was initially created as a clone of Bug #964417 +++



SELinux is preventing icedtea-web browser plugin from running any applet.  I believe a fix exists in dist-git for RAWHIDE and/or f19, but I find the issue also affecting f17.

How to reproduce:

Ensure that icedtea-web and firefox packages are installed.  (restart firefox after installing icedtea-web plugin if applicable).

$ yum install firefox icedtea-web

Ensure SELinux is in enforcing mode.

# setenforce 1

Go to any page with java applet.  Such as java test page:

Applet pane will remain as grey area, while SELinux AVC will turn up.


The original bug seems to refer to two different issues:

SELinux denials on the file ~/abc

This sounds like it is the applet being run trying to use file from home directory.  This isn't something that can be fixed in selinux-policy pakcage, as users may run arbitrary applets that may (if they are able to jump through the correct java security hoops) access arbitrary files in user's home directory; if the user needs a particular applet to access files in way not permitted by installed policy, they can add custom policy as suggested in original bug.

SELinux denials on ~/.icedtea/cache/recently_used

This access is not from any particular applet, but from icedtea-web java browser plugin which is fedora package.  This is known predictable access, so the required policy should be included in selinux-policy.

I'm only reporting 2) here :)

Paste from SELinux details:

SELinux is preventing /usr/lib/jvm/java-1.7.0-openjdk- from write access on the file /home/jon/.icedtea/cache/recently_used.
*****  Plugin catchall (100. confidence) suggests  ***************************
If you believe that java should be allowed write access on the recently_used file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
allow this access for now by executing:
# grep java /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Additional Information:
Source Context                unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c
Target Context                unconfined_u:object_r:user_home_t:s0
Target Objects                /home/jon/.icedtea/cache/recently_used [ file ]
Source                        java
Source Path                   /usr/lib/jvm/java-1.7.0-openjdk-
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           java-1.7.0-openjdk-
Target RPM Packages          
Policy RPM                    selinux-policy-3.10.0-169.fc17.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain 3.8.13-100.fc17.x86_64
                              #1 SMP Mon May 13 13:36:17 UTC 2013 x86_64 x86_64
Alert Count                   35
First Seen                    2013-06-19 15:35:23 EDT
Last Seen                     2013-06-19 15:35:24 EDT
Local ID                      cbc17533-d622-4975-afb7-8fddb6d3ea60
Raw Audit Messages
type=AVC msg=audit(1371670524.556:244): avc:  denied  { write } for  pid=10217 comm="java" name="recently_used" dev="dm-1" ino=266198 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file
type=SYSCALL msg=audit(1371670524.556:244): arch=x86_64 syscall=open success=no exit=EACCES a0=7f19443ee940 a1=241 a2=1b6 a3=6c746e656365722f items=0 ppid=10160 pid=10217 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=3 tty=(none) comm=java exe=/usr/lib/jvm/java-1.7.0-openjdk- subj=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 key=(null)
Hash: java,mozilla_plugin_t,user_home_t,file,write
#============= mozilla_plugin_t ==============
allow mozilla_plugin_t user_home_t:file write;
audit2allow -R
#============= mozilla_plugin_t ==============
allow mozilla_plugin_t user_home_t:file write;

Comment 1 Fedora End Of Life 2013-07-03 20:58:24 EDT
This message is a reminder that Fedora 17 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 17. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '17'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 17's end of life.

Bug Reporter:  Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 17 is end of life. If you 
would still like  to see this bug fixed and are able to reproduce it 
against a later version  of Fedora, you are encouraged  change the 
'version' to a later Fedora version prior to Fedora 17's end of life.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Note You need to log in before you can comment on or make changes to this bug.