selinux August 2008

selinux@lists.fedoraproject.org

26 participants
29 discussions

avcs for readahead :(
by Antonio Olivares 29 Aug '08

29 Aug '08

Dear fellow testers and Selinux experts, Upon applying the most recent updates, I am encountering some denied avcs for readahead. I previously posted about readahead, but i got no response, maybe implying that they are not important or that it is okay for selinux to step in and stop readhead from creating trouble. SELinux: initialized (dev binfmt_misc, type binfmt_misc), uses genfs_contexts type=1400 audit(1220049017.315:7): avc: denied { fowner } for pid=653 comm="readahead" capability=3 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:readahead_t:s0 tclass=capability type=1400 audit(1220049017.685:8): avc: denied { fowner } for pid=653 comm="readahead" capability=3 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:readahead_t:s0 tclass=capability type=1400 audit(1220049017.685:9): avc: denied { fowner } for pid=653 comm="readahead" capability=3 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:readahead_t:s0 tclass=capability type=1400 audit(1220049017.685:10): avc: denied { fowner } for pid=653 comm="readahead" capability=3 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:readahead_t:s0 tclass=capability IA-32 Microcode Update Driver: v1.14a <tigran(a)aivazian.fsnet.co.uk> Thanks in Advance, Antonio

1 0

Postfix, /root/.forward, SELinux, F9, Strange AVC
by Brian Chadwick 24 Aug '08

24 Aug '08

Hi All. Well, I have scoured the docs and cant find anything that looks like the problem I am having here. I have a .forward file in /root .. Mail to root should divert to my user account, but SELinux stops Postfix from doing so. If I set SELinux to permissive, then it works, but of course logs the same AVC. SETroubleshooter says to restorecon -R './root' ... ./root is a relative path ... so what does this mean? It doesnt work. [root@admin ~]# restorecon -R -v './root' restorecon: stat error on ./root: No such file or directory [root@admin ~]# .forward File Context: [root@admin ~]# ls -Z /root/.forward -rw-r--r-- root root unconfined_u:object_r:admin_home_t:s0 /root/.forward [root@admin ~]# Postix Booleans: getsebool -a | grep post allow_postfix_local_write_mail_spool --> on allow_user_postgresql_connect --> off [root@admin ~]# Raw Audit Messages : host=admin.brianac.com.au type=AVC msg=audit(1219546087.579:2125): avc: denied { search } for pid=26716 comm="local" name="root" dev=dm-7 ino=63489 scontext=system_u:system_r:postfix_local_t:s0 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir host=admin.brianac.com.au type=SYSCALL msg=audit(1219546087.579:2125): arch=40000003 syscall=196 success=no exit=-13 a0=b8079568 a1=bfe2b844 a2=7dfff4 a3=0 items=0 ppid=3274 pid=26716 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="local" exe="/usr/libexec/postfix/local" subj=system_u:system_r:postfix_local_t:s0 key=(null) Output from Troubleshooter: Summary SELinux is preventing the local from using potentially mislabeled files (./root). Detailed Description SELinux has denied local access to potentially mislabeled file(s) (./root). This means that SELinux will not allow local to use these files. It is common for users to edit files in their home directory or tmp directories and then move (mv) them to system directories. The problem is that the files end up with the wrong file context which confined applications are not allowed to access. Allowing Access If you want local to access this files, you need to relabel them using restorecon -v './root'. You might want to relabel the entire directory using restorecon -R -v './root'. Additional Information Source Context: system_u:system_r:postfix_local_t:s0 Target Context: system_u:object_r:admin_home_t:s0 Target Objects: ./root [ dir ]Source: local Source Path: /usr/libexec/postfix/local Port: <Unknown> Host: admin.brianac.com.au Source RPM Packages: postfix-2.5.1-2.fc9 Target RPM Packages: filesystem-2.4.13-1.fc9 Policy RPM: selinux-policy-3.3.1-84.fc9 Selinux Enabled: True Policy Type: targeted MLS Enabled: True Enforcing Mode: Enforcing Plugin Name: home_tmp_bad_labels Host Name: admin.brianac.com.au Platform: Linux admin.brianac.com.au 2.6.25.14-108.fc9.i686 #1 SMP Mon Aug Troubleshooter says to restorecon for ./root. What is this? .. That is a relative path, not a full path. Can anyone help decipher this AVC and provide a fix? Cheers and Beers Brian -- Political Correctness is a doctrine, fostered by a delusional, illogical minority, and rabidly promoted by an unscrupulous mainstream media, which holds forth the proposition that it is entirely possible to pick up a turd by the clean end.

2 1

SELinux and Nagios (Fedora 9 + Nagios)
by dbcooper 20 Aug '08

20 Aug '08

Hello, I've setup (via default yum repos) Nagios (nagios-2.11-3.fc9.i386 and all the needed plugs). I'm getting the following messages when using SELinux in Target/Enabled mode. My knowledge is very limited with SELinux and I'm trying to learn the proper way to troubleshoot/resolve issues on my own, and hopefully I can use this as my firts learning curve with it. Thanks for any suggestions. --------------------------------------------------------------------------------------------------------------- Summary: SELinux is preventing ping (ping_t) "read" to /var/spool/nagios/cmd/nagios.cmd (nagios_spool_t). Detailed Description: SELinux denied access requested by ping. It is not expected that this access is required by ping and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:ping_t:s0 Target Context unconfined_u:object_r:nagios_spool_t:s0 Target Objects /var/spool/nagios/cmd/nagios.cmd [ fifo_file ] Source ping Source Path /bin/ping Port <Unknown> Host xxxxxxxxxx Source RPM Packages iputils-20071127-2.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-84.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name xxxxxxxxxxxxxx Platform Linux xxxxxxxxxxxxx 2.6.25.14-108.fc9.i686 #1 SMP Mon Aug 4 14:08:11 EDT 2008 i686 i686 Alert Count 23 First Seen Sun 17 Aug 2008 02:06:45 AM EDT Last Seen Mon 18 Aug 2008 06:11:31 PM EDT Local ID 67986880-653f-455c-88bb-5598d451bb14 Line Numbers Raw Audit Messages host=xxxxxxxxxxx type=AVC msg=audit(1219097491.87:211): avc: denied { read } for pid=6420 comm="ping" path="/var/spool/nagios/cmd/nagios.cmd" dev=dm-0 ino=728571 scontext=system_u:system_r:ping_t:s0 tcontext=unconfined_u:object_r:nagios_spool_t:s0 tclass=fifo_file host=xxxxxxxxxxxxx type=SYSCALL msg=audit(1219097491.87:211): arch=40000003 syscall=11 success=yes exit=0 a0=96dda38 a1=96ddb18 a2=bfec6ae4 a3=0 items=0 ppid=6419 pid=6420 auid=4294967295 uid=493 gid=489 euid=0 suid=0 fsuid=0 egid=489 sgid=489 fsgid=489 tty=(none) ses=4294967295 comm="ping" exe="/bin/ping" subj=system_u:system_r:ping_t:s0 key=(null) ---------------------------------------------------------------------------------------------------------

3 2

selinux - nspluginscan, and xine denials
by Antonio Olivares 19 Aug '08

19 Aug '08

Two alerts from selinux Summary: SELinux is preventing nspluginviewer from changing a writable memory segment executable. Detailed Description: The nspluginviewer application attempted to change the access protection of memory (e.g., allocated using malloc). This is a potential security problem. Applications should not be doing this. Applications are sometimes coded incorrectly and request this permission. The SELinux Memory Protection Tests (http://people.redhat.com/drepper/selinux-mem.html) web page explains how to remove this requirement. If nspluginviewer does not work and you need it to work, you can configure SELinux temporarily to allow this access until the application is fixed. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Allowing Access: If you trust nspluginviewer to run correctly, you can change the context of the executable to unconfined_execmem_exec_t. "chcon -t unconfined_execmem_exec_t '/usr/bin/nspluginviewer'". You must also change the default file context files on the system in order to preserve them even on a full relabel. "semanage fcontext -a -t unconfined_execmem_exec_t '/usr/bin/nspluginviewer'" Fix Command: chcon -t unconfined_execmem_exec_t '/usr/bin/nspluginviewer' Additional Information: Source Context unconfined_u:unconfined_r:unconfined_t:SystemLow- SystemHigh Target Context unconfined_u:unconfined_r:unconfined_t:SystemLow- SystemHigh Target Objects None [ process ] Source nspluginviewer Source Path /usr/bin/nspluginviewer Port <Unknown> Host localhost.localdomain Source RPM Packages kdebase-4.1.0-1.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.1-4.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name allow_execmem Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.26.1 #1 SMP Sat Aug 2 21:36:01 CDT 2008 i686 i686 Alert Count 29 First Seen Sun 03 Aug 2008 12:55:21 PM CDT Last Seen Sun 03 Aug 2008 12:55:21 PM CDT Local ID 865503d3-baab-4dcd-adc0-47f8fff6ade6 Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1217786121.365:53): avc: denied { execmem } for pid=3262 comm="nspluginviewer" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process host=localhost.localdomain type=SYSCALL msg=audit(1217786121.365:53): arch=40000003 syscall=125 success=no exit=-13 a0=b1aaa000 a1=1000 a2=5 a3=bfa32acc items=0 ppid=3222 pid=3262 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="nspluginviewer" exe="/usr/bin/nspluginviewer" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) I have recently installed xine(xine-lib-1.1.15 and xine-ui from source) and I got this one immediately following: What should I do? Should I just apply the fix and move on? Summary: SELinux is preventing xine from making the program stack executable. Detailed Description: The xine application attempted to make its stack executable. This is a potential security problem. This should never ever be necessary. Stack memory is not executable on most OSes these days and this will not change. Executable stack memory is one of the biggest security problems. An execstack error might in fact be most likely raised by malicious code. Applications are sometimes coded incorrectly and request this permission. The SELinux Memory Protection Tests (http://people.redhat.com/drepper/selinux-mem.html) web page explains how to remove this requirement. If xine does not work and you need it to work, you can configure SELinux temporarily to allow this access until the application is fixed. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Allowing Access: Sometimes a library is accidentally marked with the execstack flag, if you find a library with this flag you can clear it with the execstack -c LIBRARY_PATH. Then retry your application. If the app continues to not work, you can turn the flag back on with execstack -s LIBRARY_PATH. Otherwise, if you trust xine to run correctly, you can change the context of the executable to unconfined_execmem_exec_t. "chcon -t unconfined_execmem_exec_t '/usr/bin/xine'" You must also change the default file context files on the system in order to preserve them even on a full relabel. "semanage fcontext -a -t unconfined_execmem_exec_t '/usr/bin/xine'" Fix Command: chcon -t unconfined_execmem_exec_t '/usr/bin/xine' Additional Information: Source Context unconfined_u:unconfined_r:unconfined_t:SystemLow- SystemHigh Target Context unconfined_u:unconfined_r:unconfined_t:SystemLow- SystemHigh Target Objects None [ process ] Source nspluginscan Source Path /usr/bin/nspluginscan Port <Unknown> Host localhost.localdomain Source RPM Packages xine-0.99.5-1.lvn8 Target RPM Packages Policy RPM selinux-policy-3.5.1-4.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name allow_execstack Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27-0.244.rc2.git1.fc10.i686 #1 SMP Fri Aug 8 13:26:20 EDT 2008 i686 i686 Alert Count 4 First Seen Mon 28 Jul 2008 10:50:50 PM CDT Last Seen Tue 19 Aug 2008 08:01:26 AM CDT Local ID d1193200-ba21-44ee-bdf0-5b24a80cdb04 Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1219150886.174:61): avc: denied { execstack } for pid=18915 comm="xine" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process host=localhost.localdomain type=SYSCALL msg=audit(1219150886.174:61): arch=40000003 syscall=125 success=no exit=-13 a0=bfaed000 a1=1000 a2=1000007 a3=fffff000 items=0 ppid=4154 pid=18915 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts4 ses=1 comm="xine" exe="/usr/bin/xine" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) Thanks, Antonio

2 1

[BUG] legacy typenames of se-postgresql still remain
by KaiGai Kohei 14 Aug '08

14 Aug '08

I got the following access denied logs, when I tries to connect SE-PostgreSQL (postgresql_t) from PHP script (httpd_t) via unix domain socket (/tmp/.s.PGSQL.5432). type=AVC msg=audit(1218613044.484:10388): avc: denied { write } for pid=4805 comm="httpd" name=".s.PGSQL.5432" dev=sda6 ino=1079246 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:postgresql_tmp_t:s0 tclass=sock_file type=AVC msg=audit(1218613044.484:10388): avc: denied { connectto } for pid=4805 comm="httpd" path="/tmp/.s.PGSQL.5432" scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:system_r:postgresql_t:s0 tclass=unix_stream_socket However, both permissions are allowed via postgresql_stream_connect() independent from any booleans, if required types are provided by postgresql.te. postgresql_stream_connect() and postgresql_unpriv_client() are put within same optional_policy section at apache.te. postgresql_unpriv_client() requires trusted procedure related types, but postgresql.te declares them in legacy names. old: sepgsql_trusted_domain_t --> new: sepgsql_trusted_proc_t old: sepgsql_trusted_proc_t --> new: sepgsql_trusted_proc_exec_t Could you apply the attached patch? It fixes them as upstream doing. Thanks, -- OSS Platform Development Division, NEC KaiGai Kohei <kaigai(a)ak.jp.nec.com>

3 5

file contexts change on reboot
by Johnson, Richard 13 Aug '08

13 Aug '08

I'm not sure, but I think I'm hitting a precedence issue which is causing files to be relabeled on boot. The symptom is: root@lstlinux57 13:32:21 ~> restorecon -R /var/opt/ft/log root@lstlinux57 13:32:28 ~> ls -lZ /var/opt/ft/log/libft_sra_alarm_server.log -rw------- root root system_u:object_r:lsb-ft-asn_rw_t /var/opt/ft/log/libft_sra_alarm_server.log root@lstlinux57 13:32:36 ~> init 6 root@lstlinux57 13:32:40 ~> logout Connection to 134.111.82.122 closed. bash-3.1$ ssh 134.111.82.122 -l root root(a)134.111.82.122's password: Last login: Wed Aug 13 13:08:02 2008 from rjlinux2.mno.stratus.com root@lstlinux57 13:39:22 ~> ls -lZ /var/opt/ft/log/libft_sra_alarm_server.log -rw------- root root system_u:object_r:var_log_t /var/opt/ft/log/libft_sra_alarm_server.log root@lstlinux57 13:39:24 ~> restorecon -R /var/opt/ft/log root@lstlinux57 13:39:45 ~> ls -lZ /var/opt/ft/log/libft_sra_alarm_server.log -rw------- root root system_u:object_r:lsb-ft-asn_rw_t /var/opt/ft/log/libft_sra_alarm_server.log The situation is a standard RHEL5.2 with all errata applied; plus the following modifications I have a local policy modification introduced by one rpm: /usr/sbin/semanage fcontext -a -t var_log_t -s system_u '/var/opt/ft/log' And a separate policy module containing: /var/opt/ft/log/libft_.* -- gen_context(system_u:object_r:lsb-ft-asn_rw_t,s0) The net result is: root@lstlinux57 14:56:56 ~> semanage fcontext -l | grep '/opt/ft' /var/opt/ft/asn(/.*)? all files system_u:object_r:lsb-ft-asn_rw_t:s0 /var/opt/ft/log/libft_.* regular file system_u:object_r:lsb-ft-asn_rw_t:s0 /opt/ft/sbin/sra_alarm regular file system_u:object_r:lsb-ft-asn_exec_t:s0 /etc/opt/ft/asn/sra_ppp/ASN_CallHome regular file system_u:object_r:lsb-ft-asn_script_t:s0 /etc/opt/ft/asn/sra_ppp/SetUPCallHome regular file system_u:object_r:lsb-ft-asn_script_t:s0 /var/opt/ft/log all files system_u:object_r:var_log_t:s0 /var/opt/ft/log/snmpd\.log all files system_u:object_r:snmpd_log_t:s0 I suspect that the problem lies with the ordering of those '/var/opt/ft/log' lines. Am I on the right track? How can I sort things out? Thx, --rich

2 4

Clamd getting out of hand...
by Arthur Dent 13 Aug '08

13 Aug '08

Hello All, I have been using SELinux in enforcing mode on my F8 box for some time now. I had to go through a bit of pain to get clamassassin working with clamd to scan my emails but it worked OK. This weekend I upgraded to F9 and have now had about a gazillion AVC denials related to clamd. I have therefore been forced to use audit2allow to add to the already pretty cumbersome local policy I had with F8. I list the policy below. All of the entries are as a result of some denial and subsequent audit2allow policy generation. My question is basically - can one of you gurus tell me if all this stuff is still necessary? Is there a policy in the works that might avoid all this? Thanks in advance AD ########################################## # cat myclamd.te policy_module(myclamd, 1.1.11) require { type clamscan_t; type clamd_t; class tcp_socket { write create connect }; type var_run_t; type user_home_t; class sock_file { write unlink create }; class file append; type unlabeled_t; class association recvfrom; } #============= clamd_t ============== allow clamd_t var_run_t:sock_file { unlink create }; corenet_tcp_bind_generic_port(clamd_t) userdom_read_generic_user_home_content_files(clamd_t) #============= clamscan_t ============== allow clamscan_t self:tcp_socket { write create connect }; allow clamscan_t user_home_t:file append; allow clamscan_t var_run_t:sock_file write; corenet_tcp_connect_generic_port(clamscan_t) corenet_sendrecv_unlabeled_packets(clamscan_t) mta_read_queue(clamscan_t) procmail_rw_tmp_files(clamscan_t) userdom_read_generic_user_home_content_files(clamscan_t) allow clamscan_t unlabeled_t:association recvfrom; ##########################################

2 13

Running a script from Samba
by Tony Molloy 13 Aug '08

13 Aug '08

This is on Centos not Fedora but that shouldn't matter. If I want Samba to run a script ( logon logout scripts ) what context should I set the scripts to. Thanks,, Tony

3 5

nspluginwrapper policy issue
by Rahul Sundaram 13 Aug '08

13 Aug '08

Hi, Summary: SELinux is preventing npviewer.bin (nsplugin_t) "getattr" to /dev/dri/card0 (dri_device_t). Detailed Description: SELinux denied access requested by npviewer.bin. It is not expected that this access is required by npviewer.bin and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for /dev/dri/card0, restorecon -v '/dev/dri/card0' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c102 3 Target Context system_u:object_r:dri_device_t:s0 Target Objects /dev/dri/card0 [ chr_file ] Source npviewer.bin Source Path /usr/lib/nspluginwrapper/npviewer.bin Port <Unknown> Host localhost.localdomain Source RPM Packages nspluginwrapper-1.1.0-5.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.1-4.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27-0.244.rc2.git1.fc10.i686 #1 SMP Fri Aug 8 13:26:20 EDT 2008 i686 i686 Alert Count 200 First Seen Wed 13 Aug 2008 12:46:15 AM IST Last Seen Wed 13 Aug 2008 02:22:02 AM IST Local ID de968e68-bfda-46a2-b7bb-624dd3967d16 Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1218574322.776:773): avc: denied { getattr } for pid=12887 comm="npviewer.bin" path="/dev/dri/card0" dev=tmpfs ino=9434 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:dri_device_t:s0 tclass=chr_file host=localhost.localdomain type=SYSCALL msg=audit(1218574322.776:773): arch=40000003 syscall=195 success=no exit=-13 a0=bfccaed4 a1=bfccae60 a2=6c7ff4 a3=32 items=0 ppid=14557 pid=12887 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null) Rahul

3 3

Realplayer problem
by Rahul Sundaram 12 Aug '08

12 Aug '08

Hi Summary: SELinux is preventing the plugin-config (nsplugin_config_t) from executing /opt/real/RealPlayer/mozilla/nphelix.so. Detailed Description: SELinux has denied the plugin-config from executing /opt/real/RealPlayer/mozilla/nphelix.so. If plugin-config is supposed to be able to execute /opt/real/RealPlayer/mozilla/nphelix.so, this could be a labeling problem. Most confined domains are allowed to execute files labeled bin_t. So you could change the labeling on this file to bin_t and retry the application. If this plugin-config is not supposed to execute /opt/real/RealPlayer/mozilla/nphelix.so, this could signal a intrusion attempt. Allowing Access: If you want to allow plugin-config to execute /opt/real/RealPlayer/mozilla/nphelix.so: chcon -t bin_t '/opt/real/RealPlayer/mozilla/nphelix.so' If this fix works, please update the file context on disk, with the following command: semanage fcontext -a -t bin_t '/opt/real/RealPlayer/mozilla/nphelix.so' Please specify the full path to the executable, Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this selinux-policy to make sure this becomes the default labeling. Additional Information: Source Context unconfined_u:unconfined_r:nsplugin_config_t:s0-s0: c0.c1023 Target Context system_u:object_r:usr_t:s0 Target Objects /opt/real/RealPlayer/mozilla/nphelix.so [ file ] Source plugin-config Source Path /usr/lib/nspluginwrapper/plugin-config Port <Unknown> Host localhost.localdomain Source RPM Packages nspluginwrapper-1.1.0-5.fc10 Target RPM Packages RealPlayer-11.0.0.4028-20080225 Policy RPM selinux-policy-3.5.1-4.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name execute Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27-0.244.rc2.git1.fc10.i686 #1 SMP Fri Aug 8 13:26:20 EDT 2008 i686 i686 Alert Count 104 First Seen Sat 09 Aug 2008 06:54:03 PM IST Last Seen Wed 13 Aug 2008 07:51:33 AM IST Local ID c324c12a-83ab-424c-bf42-85849f4f3fba Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1218594093.968:857): avc: denied { execute } for pid=28902 comm="plugin-config" path="/opt/real/RealPlayer/mozilla/nphelix.so" dev=dm-1 ino=1785954 scontext=unconfined_u:unconfined_r:nsplugin_config_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usr_t:s0 tclass=file host=localhost.localdomain type=SYSCALL msg=audit(1218594093.968:857): arch=40000003 syscall=192 success=no exit=-13 a0=0 a1=9eec a2=5 a3=802 items=0 ppid=28900 pid=28902 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="plugin-config" exe="/usr/lib/nspluginwrapper/plugin-config" subj=unconfined_u:unconfined_r:nsplugin_config_t:s0-s0:c0.c1023 key=(null) Rahul

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux August 2008