Re: Firefox Acroread plugin not working

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Gene Heskett wrote:
On Monday 24 April 2006 16:27, Paul Howarth wrote:
[...]
You might find selinux denial messages in /var/log/messages - search
for the string "avc:  denied" (note the two spaces after the colon).
You can also check to make sure it's an SELinux problem by doing
"setenforce 0" and see if there's still a problem.

Yeee Gods, the log is drowning in them, and whats more, logrotate isn't rotating the logs. I thought anacron was supposed to take care of that?
Anyway, heres the last few minutes of the log:

(unrelated stuff snipped)

Apr 24 18:41:45 diablo kernel: audit(1145918505.112:334): avc: denied { execmod } for pid=4250 comm="java" name="libawt.so" dev=hda5 ino=9561458 scontext=root:system_r:unconfined_t:s0-s0:c0.c255 tcontext=root:object_r:tmp_t:s0 tclass=file

This java library is running in the default "unconfined_t", which doesn't allow "execmod". Java should run in its own domain, which would then allow this. The reason that no transition has happened is probably either:

1. Java was installed using a non SELinux-aware installer (rpm is SELinux-aware for instance) and hence files didn't have the correct contexts set, or

2. Java was installed into a non-standard place, which would also result in the wrong file contexts being set.

You might also try my Java HOWTO:
http://www.city-fan.org/tips/JpackageJava

I'll take a look at that.

As you've found, installing Java using the JPackage RPMs does not result in these issues.

> But first I've got to get logrotate to rotate
the friggin log, it must be a megabyte or more. No, actually its rapidly approaching 4 megs, dateing back to when I installed FC5 I think. 4/16

WTF is this?
[root@diablo etc]# cron.daily/logrotate
error: freshclam:8 unknown user 'clamav'

and it dies instantly. This is getting frustrating. According to that log I had yum install clamav on the 20th. If clamav needs a user clamav, why the heck didn't make one?

The user is created by the preinstall script of the clamv-data package in Extras. Are you using some other clamav package?

Looking in the firefox plugins dir after installing j2se-1.5.0.6 and
copying the ns7 version of the libhavaplugins.so
to /usr/lib/firefox-version/plugins I see:

[root@diablo plugins]# ls -lZ
-rwxr-xr-x  root     root     root:object_r:lib_t
libjavaplugin_oji.so
-rwxr-xr-x  root     root     system_u:object_r:textrel_shlib_t
libnullplugin.so
-rwxr-xr-x  root     root     system_u:object_r:textrel_shlib_t
libunixprintplugin.so
-rwxr-xr-x  root     root     system_u:object_r:textrel_shlib_t
nppdf.so

Now, maybe I'm slow this morning, but my reading of the semanage
manpage makes no mention of setting a 'default' that a relabel will
leave alone.
Using semanage you can change policy for file contexts amongst other
things. This affects the contexts applied to files using restorecon
etc.

I've used chcon to set libjavaplugin_oji.so to textrel_shlib_t,

root@diablo plugins]# ls -lZ
-rwxr-xr-x  root     root     root:object_r:textrel_shlib_t
libjavaplugin_oji.so
-rwxr-xr-x  root     root     system_u:object_r:textrel_shlib_t
libnullplugin.so
-rwxr-xr-x  root     root     system_u:object_r:textrel_shlib_t
libunixprintplugin.so
-rwxr-xr-x  root     root     system_u:object_r:textrel_shlib_t
nppdf.so

but how do I change it from root: to system_u:?  (I'm assuming that
will allow all users as opposed to just root to use it)
The "root" doesn't matter. In targeted policy you only need worry
about the type, not the user.

If you really want to change it though, try:

# chcon system_u:object_r:textrel_shlib_t libjavaplugin_oji.so

And FWIW, This change did not enable java in the firefox plugins
listings.

And how do we make it permanent in the face of another relabel?
Something like this should work:

# semanage fcontext -a -f -- -t textrel_shlib_t \
'/usr/lib(64)?/firefox.*/plugins/.*\.so'
[root@diablo etc]# semanage fcontext -a -f -- -t textrel_shlib_t \
 '/usr/lib(64)?/firefox.*/plugins/.*\.so'
-bash: /usr/lib(64)?/firefox.*/plugins/.*\.so: No such file or directory

Looks like a mistyped command. Try it all as one long line:

# semanage fcontext -a -f -- -t textrel_shlib_t '/usr/lib(64)?/firefox.*/plugins/.*\.so'

Paul.


[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux