Description of problem: SELinux is preventing /usr/lib64/xulrunner/plugin-container from 'rename' accesses on the file /home/blitzter/.macromedia/Flash_Player/macromedia.com/support/flashplayer/sys/settings.sxx. ***** Plugin restorecon (57.3 confidence) suggests ************************* If you want to fix the label. /home/blitzter/.macromedia/Flash_Player/macromedia.com/support/flashplayer/sys/settings.sxx default label should be mozilla_home_t. Then you can run restorecon. Do # /sbin/restorecon -v /home/blitzter/.macromedia/Flash_Player/macromedia.com/support/flashplayer/sys/settings.sxx ***** Plugin mozplugger (43.1 confidence) suggests ************************* If you want to use the plugin package Then you must turn off SELinux controls on the Firefox plugins. Do # setsebool unconfined_mozilla_plugin_transition 0 ***** Plugin catchall (1.06 confidence) suggests *************************** If you believe that plugin-container should be allowed rename access on the settings.sxx file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep plugin-containe /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c 0.c1023 Target Context unconfined_u:object_r:user_home_dir_t:s0 Target Objects /home/blitzter/.macromedia/Flash_Player/macromedia .com/support/flashplayer/sys/settings.sxx [ file ] Source plugin-containe Source Path /usr/lib64/xulrunner/plugin-container Port <Unknown> Host (removed) Source RPM Packages xulrunner-23.0-2.fc19.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-69.fc19.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.10.5-201.fc19.x86_64 #1 SMP Wed Aug 7 16:25:24 UTC 2013 x86_64 x86_64 Alert Count 65 First Seen 2013-08-10 17:33:54 IST Last Seen 2013-08-10 18:10:01 IST Local ID 91be2918-6726-47b6-96cb-6e8c29a4fd42 Raw Audit Messages type=AVC msg=audit(1376138401.593:646): avc: denied { rename } for pid=4806 comm="plugin-containe" name="settings.sxx" dev="sdb8" ino=2097374 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=file type=SYSCALL msg=audit(1376138401.593:646): arch=x86_64 syscall=rename success=no exit=EACCES a0=7f80e6738940 a1=7f80e67389a0 a2=7fff8f8399a0 a3=16e6565726373 items=0 ppid=4504 pid=4806 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=5 tty=(none) comm=plugin-containe exe=/usr/lib64/xulrunner/plugin-container subj=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 key=(null) Hash: plugin-containe,mozilla_plugin_t,user_home_dir_t,file,rename Additional info: reporter: libreport-2.1.6 hashmarkername: setroubleshoot kernel: 3.10.5-201.fc19.x86_64 type: libreport
Please read what setroubleshoot is telling you before submitting bug reports. ***** Plugin restorecon (57.3 confidence) suggests ************************* If you want to fix the label. /home/blitzter/.macromedia/Flash_Player/macromedia.com/support/flashplayer/sys/settings.sxx default label should be mozilla_home_t. Then you can run restorecon. Do # /sbin/restorecon -v /home/blitzter/.macromedia/Flash_Player/macromedia.com/support/flashplayer/sys/settings.sxx I would just run restorecon -R -v /home/blitzter
(In reply to Daniel Walsh from comment #1) > Please read what setroubleshoot is telling you before submitting bug reports. > > ***** Plugin restorecon (57.3 confidence) suggests > ************************* > > If you want to fix the label. > /home/blitzter/.macromedia/Flash_Player/macromedia.com/support/flashplayer/ > sys/settings.sxx default label should be mozilla_home_t. > Then you can run restorecon. > Do > # /sbin/restorecon -v > /home/blitzter/.macromedia/Flash_Player/macromedia.com/support/flashplayer/ > sys/settings.sxx > > I would just run restorecon -R -v /home/blitzter I had run the command suggested in the troubleshoot before I created the bug. In fact I tried both the troubleshooting steps. I still get the message every time I run firefox and access a page with flash.(usually videos) Also I get one message when I close the tab. I will run "restorecon -R -v /home/blitzter" and see if that fixes it. As a user I still would want to understand more like... Why do I need to run this? What caused this issue? Why are these security permissions not granted by default to the plugin that created the .macromedia folder in the first place. Thanks
setsebool unconfined_mozilla_plugin_transition 0 Should have stated setsebool -P unconfined_mozilla_plugin_transition 0 which would make it permanent, survive a reboot. I have fixed this in the upstream package. Not sure how your homedir got mislabeled. And you are correct it should work out of the box.
(In reply to Daniel Walsh from comment #3) > setsebool unconfined_mozilla_plugin_transition 0 > > Should have stated > > setsebool -P unconfined_mozilla_plugin_transition 0 > > which would make it permanent, survive a reboot. I have fixed this in the > upstream package. > > Not sure how your homedir got mislabeled. And you are correct it should > work out of the box. I ran "restorecon -R -v /home/blitzter/.macromedia" and it seems to have fixed it. I'll try to read more into Selinux just to be sure what exactly is going on in there. Thanks
Checkout danwalsh.livejournal.com. :^)