-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Antonio Olivares wrote: > Dear all, > > I have set settroubleshoot to allow the following: > chcon -t unconfined_execmem_exec_t > '/usr/lib/firefox-3.0b4pre/firefox' > > But it is happening again, I do not understand why I > need to do it multiple of times. I see a pattern > occuring: I have filed a bug report against > firefox-b3 > > https://bugzilla.redhat.com/show_bug.cgi?id=432198 > > I hope that firefox and selinux start to work together > and not against each other. :) > > Summary: > > SELinux is preventing firefox from making the program > stack executable. > > Detailed Description: > > The firefox application attempted to make its stack > executable. This is a > potential security problem. This should never ever be > necessary. Stack memory is > not executable on most OSes these days and this will > not change. Executable > stack memory is one of the biggest security problems. > An execstack error might > in fact be most likely raised by malicious code. > Applications are sometimes > coded incorrectly and request this permission. The > SELinux Memory Protection > Tests > (http://people.redhat.com/drepper/selinux-mem.html) > web page explains how > to remove this requirement. If firefox does not work > and you need it to work, > you can configure SELinux temporarily to allow this > access until the application > is fixed. Please file a bug report > (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) > against this package. > > Allowing Access: > > Sometimes a library is accidentally marked with the > execstack flag, if you find > a library with this flag you can clear it with the > execstack -c LIBRARY_PATH. > Then retry your application. If the app continues to > not work, you can turn the > flag back on with execstack -s LIBRARY_PATH. > Otherwise, if you trust firefox to > run correctly, you can change the context of the > executable to > unconfined_execmem_exec_t. "chcon -t > unconfined_execmem_exec_t > '/usr/lib/firefox-3.0b4pre/firefox'" You must also > change the default file > context files on the system in order to preserve them > even on a full relabel. > "semanage fcontext -a -t unconfined_execmem_exec_t > '/usr/lib/firefox-3.0b4pre/firefox'" > > The following command will allow this access: > > chcon -t unconfined_execmem_exec_t > '/usr/lib/firefox-3.0b4pre/firefox' > > Additional Information: > > Source Context > unconfined_u:unconfined_r:unconfined_t:SystemLow- > SystemHigh > Target Context > unconfined_u:unconfined_r:unconfined_t:SystemLow- > SystemHigh > Target Objects None [ process ] > Source firefox > Source Path > /usr/lib/firefox-3.0b3pre/firefox > Port <Unknown> > Host localhost > Source RPM Packages > firefox-3.0-0.beta2.16.nightly20080206.fc9 > Target RPM Packages > Policy RPM > selinux-policy-3.2.7-1.fc9 > Selinux Enabled True > Policy Type targeted > MLS Enabled True > Enforcing Mode Enforcing > Plugin Name allow_execstack > Host Name localhost > Platform Linux localhost > 2.6.24-23.fc9 #1 SMP Wed Feb 6 > 11:36:31 EST 2008 i686 > athlon > Alert Count 11 > First Seen Fri 01 Feb 2008 05:08:54 > PM CST > Last Seen Sat 09 Feb 2008 12:35:06 > PM CST > Local ID > c4806f30-a6dc-43b0-8901-5531075795f7 > Line Numbers > > Raw Audit Messages > > host=localhost type=AVC msg=audit(1202582106.621:28): > avc: denied { execstack } for pid=9246 > comm="firefox" > scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 > tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 > tclass=process > > host=localhost type=SYSCALL > msg=audit(1202582106.621:28): arch=40000003 > syscall=125 success=no exit=-13 a0=bfa71000 a1=1000 > a2=1000007 a3=fffff000 items=0 ppid=9232 pid=9246 > auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 > egid=500 sgid=500 fsgid=500 tty=(none) comm="firefox" > exe="/usr/lib/firefox-3.0b4pre/firefox" > subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 > key=(null) > > > > Regards, > > Antonio > > > ____________________________________________________________________________________ > Never miss a thing. Make Yahoo your home page. > http://www.yahoo.com/r/hs > chcon -t unconfined_execmem_exec_t '/usr/lib/firefox-3.0b4pre/firefox' This will only survive until the next relabel. selinux-policy update can trigger partial relabels. # semanage fcontext -a -t unconfined_execmem_exec_t '/usr/lib/firefox-3.0b4pre/firefox' # restorecon '/usr/lib/firefox-3.0b4pre/firefox' Would set the file systems default labeling for firefox and make it survive a relabel. As other replies have indicated, this problem is probably a bad plugin. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iEYEARECAAYFAkexqmoACgkQrlYvE4MpobPeAwCg4DfcKCUrh/31D5ktqc2vH6JL pqUAnRiP4HtUCMkKNxdK0xeT5+kVzIqA =dfRo -----END PGP SIGNATURE----- -- fedora-selinux-list mailing list fedora-selinux-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-selinux-list
