Bug 995717 - SELinux is preventing /usr/lib64/xulrunner/plugin-container from 'rename' accesses on the file /home/blitzter/.macromedia/Flash_Player/macromedia.com/support/flashplayer/sys/settings.sxx.
SELinux is preventing /usr/lib64/xulrunner/plugin-container from 'rename' acc...
Status: CLOSED NOTABUG
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
19
x86_64 Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
abrt_hash:816543f347700ed339276a5b7d0...
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-08-10 08:41 EDT by blitzter
Modified: 2013-08-14 12:39 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-08-13 18:36:31 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description blitzter 2013-08-10 08:41:45 EDT
Description of problem:
SELinux is preventing /usr/lib64/xulrunner/plugin-container from 'rename' accesses on the file /home/blitzter/.macromedia/Flash_Player/macromedia.com/support/flashplayer/sys/settings.sxx.

*****  Plugin restorecon (57.3 confidence) suggests  *************************

If you want to fix the label. 
/home/blitzter/.macromedia/Flash_Player/macromedia.com/support/flashplayer/sys/settings.sxx default label should be mozilla_home_t.
Then you can run restorecon.
Do
# /sbin/restorecon -v /home/blitzter/.macromedia/Flash_Player/macromedia.com/support/flashplayer/sys/settings.sxx

*****  Plugin mozplugger (43.1 confidence) suggests  *************************

If you want to use the plugin package
Then you must turn off SELinux controls on the Firefox plugins.
Do
# setsebool unconfined_mozilla_plugin_transition 0

*****  Plugin catchall (1.06 confidence) suggests  ***************************

If you believe that plugin-container should be allowed rename access on the settings.sxx file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep plugin-containe /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c
                              0.c1023
Target Context                unconfined_u:object_r:user_home_dir_t:s0
Target Objects                /home/blitzter/.macromedia/Flash_Player/macromedia
                              .com/support/flashplayer/sys/settings.sxx [ file ]
Source                        plugin-containe
Source Path                   /usr/lib64/xulrunner/plugin-container
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           xulrunner-23.0-2.fc19.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-69.fc19.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.10.5-201.fc19.x86_64 #1 SMP Wed
                              Aug 7 16:25:24 UTC 2013 x86_64 x86_64
Alert Count                   65
First Seen                    2013-08-10 17:33:54 IST
Last Seen                     2013-08-10 18:10:01 IST
Local ID                      91be2918-6726-47b6-96cb-6e8c29a4fd42

Raw Audit Messages
type=AVC msg=audit(1376138401.593:646): avc:  denied  { rename } for  pid=4806 comm="plugin-containe" name="settings.sxx" dev="sdb8" ino=2097374 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=file


type=SYSCALL msg=audit(1376138401.593:646): arch=x86_64 syscall=rename success=no exit=EACCES a0=7f80e6738940 a1=7f80e67389a0 a2=7fff8f8399a0 a3=16e6565726373 items=0 ppid=4504 pid=4806 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=5 tty=(none) comm=plugin-containe exe=/usr/lib64/xulrunner/plugin-container subj=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 key=(null)

Hash: plugin-containe,mozilla_plugin_t,user_home_dir_t,file,rename

Additional info:
reporter:       libreport-2.1.6
hashmarkername: setroubleshoot
kernel:         3.10.5-201.fc19.x86_64
type:           libreport
Comment 1 Daniel Walsh 2013-08-13 18:36:31 EDT
Please read what setroubleshoot is telling you before submitting bug reports.

*****  Plugin restorecon (57.3 confidence) suggests  *************************

If you want to fix the label. 
/home/blitzter/.macromedia/Flash_Player/macromedia.com/support/flashplayer/sys/settings.sxx default label should be mozilla_home_t.
Then you can run restorecon.
Do
# /sbin/restorecon -v /home/blitzter/.macromedia/Flash_Player/macromedia.com/support/flashplayer/sys/settings.sxx

I would just run  restorecon -R -v /home/blitzter
Comment 2 blitzter 2013-08-14 05:29:49 EDT
(In reply to Daniel Walsh from comment #1)
> Please read what setroubleshoot is telling you before submitting bug reports.
> 
> *****  Plugin restorecon (57.3 confidence) suggests 
> *************************
> 
> If you want to fix the label. 
> /home/blitzter/.macromedia/Flash_Player/macromedia.com/support/flashplayer/
> sys/settings.sxx default label should be mozilla_home_t.
> Then you can run restorecon.
> Do
> # /sbin/restorecon -v
> /home/blitzter/.macromedia/Flash_Player/macromedia.com/support/flashplayer/
> sys/settings.sxx
> 
> I would just run  restorecon -R -v /home/blitzter

I had run the command suggested in the troubleshoot before I created the bug. In fact I tried both the troubleshooting steps.
I still get the message every time I run firefox and access a page with flash.(usually videos) Also I get one message when I close the tab. 

I will run "restorecon -R -v /home/blitzter" and see if that fixes it.
As a user I still would want to understand more like...
Why do I need to run this?
What caused this issue?
Why are these security permissions not granted by default to the plugin that created the .macromedia folder in the first place.

Thanks
Comment 3 Daniel Walsh 2013-08-14 10:21:15 EDT
setsebool unconfined_mozilla_plugin_transition 0

Should have stated

setsebool -P unconfined_mozilla_plugin_transition 0

which would make it permanent, survive a reboot.  I have fixed this in the upstream package.

Not sure how your homedir got mislabeled.  And you are correct it should work out of the box.
Comment 4 blitzter 2013-08-14 10:52:38 EDT
(In reply to Daniel Walsh from comment #3)
> setsebool unconfined_mozilla_plugin_transition 0
> 
> Should have stated
> 
> setsebool -P unconfined_mozilla_plugin_transition 0
> 
> which would make it permanent, survive a reboot.  I have fixed this in the
> upstream package.
> 
> Not sure how your homedir got mislabeled.  And you are correct it should
> work out of the box.

I ran "restorecon -R -v /home/blitzter/.macromedia" and it seems to have fixed it.
I'll try to read more into Selinux just to be sure what exactly is going on in there.

Thanks
Comment 5 Daniel Walsh 2013-08-14 12:39:17 EDT
Checkout danwalsh.livejournal.com.  :^)

Note You need to log in before you can comment on or make changes to this bug.