Re: (not sandboxed) firefox AVCs (execstack)

[Paul Howarth]

On Fri, 03 Jun 2011 01:35:33 +0200
"Christoph A." <casmls(a)gmail.com&gt; wrote:

>  Hi,
>  
>  by coincidence I saw the following AVCs in my audit log when starting
>  firefox (firefox runs fine).
>  
>  type=1400 audit(1307056986.733:2965): avc:  denied  { execstack } for
>  pid=13470 comm="plugin-config"
>  scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>  tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>  tclass=process
>  type=1400 audit(1307056986.734:2966): avc:  denied  { execstack } for
>  pid=13470 comm="plugin-config"
>  scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>  tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>  tclass=process
>  type=1400 audit(1307056987.922:2967): avc:  denied  { execstack } for
>  pid=13465 comm="firefox"
>  scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>  tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>  tclass=process
>  type=1400 audit(1307056987.922:2968): avc:  denied  { execstack } for
>  pid=13465 comm="firefox"
>  scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>  tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>  tclass=process
>  type=1400 audit(1307056987.938:2969): avc:  denied  { execstack } for
>  pid=13465 comm="firefox"
>  scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>  tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>  tclass=process
>  type=1400 audit(1307056987.938:2970): avc:  denied  { execstack } for
>  pid=13465 comm="firefox"
>  scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>  tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>  tclass=process
>  
>  Should I classify these AVCs as suspicious? 
Could be a plugin, e.g. the Sun Java plugin causes this.

Paul.