Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- SELinux is preventing /opt/google/chrome/chrome from execmod access on the file /opt/google/chrome/chrome.
- ***** Plugin allow_execmod (91.4 confidence) suggests **********************
- If you want to allow chrome to have execmod access on the chrome file
- Then you need to change the label on '/opt/google/chrome/chrome'
- Do
- # semanage fcontext -a -t textrel_shlib_t '/opt/google/chrome/chrome'
- # restorecon -v '/opt/google/chrome/chrome'
- ***** Plugin catchall (9.59 confidence) suggests ***************************
- If you believe that chrome should be allowed execmod access on the chrome file by default.
- Then you should report this as a bug.
- You can generate a local policy module to allow this access.
- Do
- allow this access for now by executing:
- # grep chrome /var/log/audit/audit.log | audit2allow -M mypol
- # semodule -i mypol.pp
- Additional Information:
- Source Context unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c
- 0.c1023
- Target Context system_u:object_r:execmem_exec_t:s0
- Target Objects /opt/google/chrome/chrome [ file ]
- Source chrome
- Source Path /opt/google/chrome/chrome
- Port <Unknown>
- Host kickass
- Source RPM Packages google-chrome-stable-14.0.835.202-103287
- Target RPM Packages google-chrome-stable-14.0.835.202-103287
- Policy RPM selinux-policy-3.9.7-44.fc14
- Selinux Enabled True
- Policy Type targeted
- Enforcing Mode Enforcing
- Host Name kickass
- Platform Linux kickass 2.6.35.14-96.fc14.i686 #1 SMP Thu
- Sep 1 12:49:38 UTC 2011 i686 i686
- Alert Count 7
- First Seen Thu 06 Oct 2011 12:44:27 AM EDT
- Last Seen Thu 06 Oct 2011 12:48:24 AM EDT
- Local ID dd043535-053b-4cc7-b8ff-fd0d95fa2582
- Raw Audit Messages
- type=AVC msg=audit(1317876504.101:23068): avc: denied { execmod } for pid=2171 comm="chrome" path="/opt/google/chrome/chrome" dev=dm-0 ino=395897 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=system_u:object_r:execmem_exec_t:s0 tclass=file
- type=SYSCALL msg=audit(1317876504.101:23068): arch=i386 syscall=mprotect success=no exit=EACCES a0=b45d7000 a1=31ff000 a2=5 a3=bf9cb440 items=0 ppid=0 pid=2171 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm=chrome exe=/opt/google/chrome/chrome subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 key=(null)
- Hash: chrome,chrome_sandbox_t,execmem_exec_t,file,execmod
- audit2allow
- #============= chrome_sandbox_t ==============
- allow chrome_sandbox_t execmem_exec_t:file execmod;
- audit2allow -R
- #============= chrome_sandbox_t ==============
- allow chrome_sandbox_t execmem_exec_t:file execmod;
- And when I try to enter the code given by the SELinux trouble shooter:
- [root@kickass larry]# semanage fcontext-a-ttextrel_shlib_t'/opt/google/chrome/chrome'
- /usr/sbin/semanage:
- semanage [ -S store ] -i [ input_file | - ]
- semanage [ -S store ] -o [ output_file | - ]
- semanage login -{a|d|m|l|D|E} [-nrs] login_name | %groupname
- semanage user -{a|d|m|l|D|E} [-LnrRP] selinux_name
- semanage port -{a|d|m|l|D|E} [-nrt] [ -p proto ] port | port_range
- semanage interface -{a|d|m|l|D|E} [-nrt] interface_spec
- semanage module -{a|d|m} [--enable|--disable] module
- semanage node -{a|d|m|l|D|E} [-nrt] [ -p protocol ] [-M netmask] addr
- semanage fcontext -{a|d|m|l|D|E} [-efnrst] file_spec
- semanage boolean -{d|m} [--on|--off|-1|-0] -F boolean | boolean_file
- semanage permissive -{d|a|l} [-n] type
- semanage dontaudit [ on | off ]
- Primary Options:
- -a, --add Add a OBJECT record NAME
- -d, --delete Delete a OBJECT record NAME
- -m, --modify Modify a OBJECT record NAME
- -i, --input Input multiple semange commands in a transaction
- -o, --output Output current customizations as semange commands
- -l, --list List the OBJECTS
- -E, --extract extract customizable commands
- -C, --locallist List OBJECTS local customizations
- -D, --deleteall Remove all OBJECTS local customizations
- -h, --help Display this message
- -n, --noheading Do not print heading when listing OBJECTS
- -S, --store Select and alternate SELinux store to manage
- Object-specific Options (see above):
- -f, --ftype File Type of OBJECT
- "" (all files)
- -- (regular file)
- -d (directory)
- -c (character device)
- -b (block device)
- -s (socket)
- -l (symbolic link)
- -p (named pipe)
- -F, --file Treat target as an input file for command, change multiple settings
- -p, --proto Port protocol (tcp or udp) or internet protocol version of node (ipv4 or ipv6)
- -M, --mask Netmask
- -e, --equal Substitue source path for dest path when labeling
- -P, --prefix Prefix for home directory labeling
- -L, --level Default SELinux Level (MLS/MCS Systems only)
- -R, --roles SELinux Roles (ex: "sysadm_r staff_r")
- -s, --seuser SELinux User Name
- -t, --type SELinux Type for the object
- -r, --range MLS/MCS Security Range (MLS/MCS Systems only)
- --enable Enable a module
- --disable Disable a module
- Requires 2 or more arguments
- [root@kickass larry]# semanage fcontext-a-t textrel_shlib_t'/opt/google/chrome/chrome'
- /usr/sbin/semanage:
- semanage [ -S store ] -i [ input_file | - ]
- semanage [ -S store ] -o [ output_file | - ]
- semanage login -{a|d|m|l|D|E} [-nrs] login_name | %groupname
- semanage user -{a|d|m|l|D|E} [-LnrRP] selinux_name
- semanage port -{a|d|m|l|D|E} [-nrt] [ -p proto ] port | port_range
- semanage interface -{a|d|m|l|D|E} [-nrt] interface_spec
- semanage module -{a|d|m} [--enable|--disable] module
- semanage node -{a|d|m|l|D|E} [-nrt] [ -p protocol ] [-M netmask] addr
- semanage fcontext -{a|d|m|l|D|E} [-efnrst] file_spec
- semanage boolean -{d|m} [--on|--off|-1|-0] -F boolean | boolean_file
- semanage permissive -{d|a|l} [-n] type
- semanage dontaudit [ on | off ]
- Primary Options:
- -a, --add Add a OBJECT record NAME
- -d, --delete Delete a OBJECT record NAME
- -m, --modify Modify a OBJECT record NAME
- -i, --input Input multiple semange commands in a transaction
- -o, --output Output current customizations as semange commands
- -l, --list List the OBJECTS
- -E, --extract extract customizable commands
- -C, --locallist List OBJECTS local customizations
- -D, --deleteall Remove all OBJECTS local customizations
- -h, --help Display this message
- -n, --noheading Do not print heading when listing OBJECTS
- -S, --store Select and alternate SELinux store to manage
- Object-specific Options (see above):
- -f, --ftype File Type of OBJECT
- "" (all files)
- -- (regular file)
- -d (directory)
- -c (character device)
- -b (block device)
- -s (socket)
- -l (symbolic link)
- -p (named pipe)
- -F, --file Treat target as an input file for command, change multiple settings
- -p, --proto Port protocol (tcp or udp) or internet protocol version of node (ipv4 or ipv6)
- -M, --mask Netmask
- -e, --equal Substitue source path for dest path when labeling
- -P, --prefix Prefix for home directory labeling
- -L, --level Default SELinux Level (MLS/MCS Systems only)
- -R, --roles SELinux Roles (ex: "sysadm_r staff_r")
- -s, --seuser SELinux User Name
- -t, --type SELinux Type for the object
- -r, --range MLS/MCS Security Range (MLS/MCS Systems only)
- --enable Enable a module
- --disable Disable a module
- Invalid parameter fcontext-a-t not defined
- [root@kickass larry]#
Advertisement
