FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Redhat > Fedora User

 
 
LinkBack Thread Tools
 
Old 10-11-2011, 09:04 PM
"Christoph A."
 
Default flash-plugin not working within SELinux sandbox (f14)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi,
since a recent flash-plugin it is no longer working within a sandbox.


rpm -qa flash-plugin
flash-plugin-11.0.1.152-release.i386

rpm -qa *selinux*
selinux-policy-targeted-3.9.7-44.fc14.noarch
libselinux-utils-2.0.96-6.fc14.1.x86_64
libselinux-2.0.96-6.fc14.1.i686
selinux-policy-3.9.7-44.fc14.noarch
libselinux-python-2.0.96-6.fc14.1.x86_64
libselinux-2.0.96-6.fc14.1.x86_64

I tried restorecon but it didn't fix the problem.

I turned off the dontaudit rules as described by Dan Walsh at a previous
similar thread:
https://lists.fedoraproject.org/pipermail/users/2010-August/380366.html

I see the following AVCs:

type=AVC msg=audit(1318366350.121:782): avc: denied { execmod } for
pid=11212 comm="npviewer.bin"
path="/usr/lib/flash-plugin/libflashplayer.so" dev=dm-1 ino=4980766
scontext=unconfined_u:unconfined_r:sandbox_web_cli ent_t:s0:c140,c1007
tcontext=system_ubject_r:lib_t:s0 tclass=file

type=AVC msg=audit(1318366350.122:783): avc: denied { read } for
pid=11120 comm="firefox" name="nswrapper_64_64.libflashplayer.so"
dev=dm-1 ino=4720059
scontext=unconfined_u:unconfined_r:sandbox_web_cli ent_t:s0:c140,c1007
tcontext=unconfined_ubject_r:nsplugin_rw_t:s0:c1 85,c254 tclass=file

type=AVC msg=audit(1318366350.122:784): avc: denied { read } for
pid=11120 comm="firefox" name="nswrapper_64_64.libflashplayer.so"
dev=dm-1 ino=4720059
scontext=unconfined_u:unconfined_r:sandbox_web_cli ent_t:s0:c140,c1007
tcontext=unconfined_ubject_r:nsplugin_rw_t:s0:c1 85,c254 tclass=file



-----BEGIN PGP SIGNATURE-----

iEYEAREKAAYFAk6Ur0MACgkQrq+riTAIEg29rQCgn4JsW9ddTr/yFN2ROGnaLWyM
8rQAoIpeuntpo2RjesoN8Omnw1rxGTbx
=IWsP
-----END PGP SIGNATURE-----
--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
 
Old 10-11-2011, 09:11 PM
Daniel J Walsh
 
Default flash-plugin not working within SELinux sandbox (f14)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/11/2011 05:04 PM, Christoph A. wrote:
> Hi, since a recent flash-plugin it is no longer working within a
> sandbox.
>
>
> rpm -qa flash-plugin flash-plugin-11.0.1.152-release.i386
>
> rpm -qa *selinux* selinux-policy-targeted-3.9.7-44.fc14.noarch
> libselinux-utils-2.0.96-6.fc14.1.x86_64
> libselinux-2.0.96-6.fc14.1.i686
> selinux-policy-3.9.7-44.fc14.noarch
> libselinux-python-2.0.96-6.fc14.1.x86_64
> libselinux-2.0.96-6.fc14.1.x86_64
>
> I tried restorecon but it didn't fix the problem.
>
> I turned off the dontaudit rules as described by Dan Walsh at a
> previous similar thread:
> https://lists.fedoraproject.org/pipermail/users/2010-August/380366.html
>
> I see the following AVCs:
>
> type=AVC msg=audit(1318366350.121:782): avc: denied { execmod }
> for pid=11212 comm="npviewer.bin"
> path="/usr/lib/flash-plugin/libflashplayer.so" dev=dm-1
> ino=4980766
> scontext=unconfined_u:unconfined_r:sandbox_web_cli ent_t:s0:c140,c1007
>
>
tcontext=system_ubject_r:lib_t:s0 tclass=file
>
> type=AVC msg=audit(1318366350.122:783): avc: denied { read } for
> pid=11120 comm="firefox" name="nswrapper_64_64.libflashplayer.so"
> dev=dm-1 ino=4720059
> scontext=unconfined_u:unconfined_r:sandbox_web_cli ent_t:s0:c140,c1007
>
>
tcontext=unconfined_ubject_r:nsplugin_rw_t:s0:c1 85,c254 tclass=file
>
> type=AVC msg=audit(1318366350.122:784): avc: denied { read } for
> pid=11120 comm="firefox" name="nswrapper_64_64.libflashplayer.so"
> dev=dm-1 ino=4720059
> scontext=unconfined_u:unconfined_r:sandbox_web_cli ent_t:s0:c140,c1007
>
>
tcontext=unconfined_ubject_r:nsplugin_rw_t:s0:c1 85,c254 tclass=file
>
>
>


chcon -t textrel_shlib_t /usr/lib/flash-plugin/libflashplayer.so
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk6UsOwACgkQrlYvE4MpobPlFACdGT6yf7FOgK dbOOZF7uGzksTj
Gw0AoLyoisPYhVqZLH5kzFcnUzTGPTKF
=QcC5
-----END PGP SIGNATURE-----
--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
 
Old 10-11-2011, 09:16 PM
Joe Zeff
 
Default flash-plugin not working within SELinux sandbox (f14)

On 10/11/2011 02:04 PM, Christoph A. wrote:
> I tried restorecon but it didn't fix the problem.

Did the troubleshooter suggest that, or did you try it on your own? In
the latter case, try running sealert from a terminal to bring up the
troubleshooter and try what it suggests.
--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
 
Old 10-12-2011, 04:20 PM
"Christoph A."
 
Default flash-plugin not working within SELinux sandbox (f14)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 10/11/2011 11:11 PM, Daniel J Walsh wrote:
> chcon -t textrel_shlib_t /usr/lib/flash-plugin/libflashplayer.so

thank you,
that fixed it!
-----BEGIN PGP SIGNATURE-----

iEYEAREKAAYFAk6VvjQACgkQrq+riTAIEg2ERQCfRBY9Q4DM2B auE2M/37pxXRwW
c4YAn3XfL4IEKtPDh8WvmU3ILQsRVA+D
=MmQK
-----END PGP SIGNATURE-----
--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
 

Thread Tools




All times are GMT. The time now is 01:29 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org