Plugins for Firefox and others common programs disallowed access

[John Griffiths <fedora@xxxxxxxxxxx>]

Was poking around in the selinux FAQs fro FC 5 and found:

Q:

I have a process running as unconfined_t, and SELinux is still preventing my application from running.

A:

We have begun to confine the unconfined_t domain somewhat. SELinux restricts certain memory protection operation. Following is a list of those denials, as well as possible reasons and solutions for those denials. For more information on these restrictions, see http://people.redhat.com/drepper/selinux-mem.html.

execmod

This is usually based on a library label. You can change the context on the library with the chcon -t testrel_shlib_t LIBRARY. Now your application can run. Please report this as a bugzilla.

So I tried that with the library that was getting this avc:

Apr  1 16:35:26 gei kernel: audit(1143927326.008:7224): avc:  denied  { execmod } for  pid=12193 comm="acroread" name="libJP2K.so" dev=dm-0 ino=682112 scontext=user_u:system_r:unconfined_t:s0-s0:c0.c255 tcontext=system_u:object_r:lib_t:s0 tclass=file

I did this:

chcon -t testrel_shlib_t /usr/local/Adobe/Acrobat7.0/Reader/intellinux/lib/libJP2K.so

and got this error:

chcon: failed to change context of /usr/local/Adobe/Acrobat7.0/Reader/intellinux/lib/libJP2K.so to system_u:object_r:testrel_shlib_t: Invalid argument

So now what?

Regards,
John

--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list