Re: firefox and selinux

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Antonio Olivares wrote:
>  Dear all,
>  
>  I have set settroubleshoot to allow the following:
>  chcon -t unconfined_execmem_exec_t
>  '/usr/lib/firefox-3.0b4pre/firefox'
>  
>  But it is happening again, I do not understand why I
>  need to do it multiple of times.  I see a pattern
>  occuring:  I have filed a bug report against
>  firefox-b3
>  
>  https://bugzilla.redhat.com/show_bug.cgi?id=432198
>  
>  I hope that firefox and selinux start to work together
>  and not against each other. :)
>  
>  Summary:
>  
>  SELinux is preventing firefox from making the program
>  stack executable.
>  
>  Detailed Description:
>  
>  The firefox application attempted to make its stack
>  executable. This is a
>  potential security problem. This should never ever be
>  necessary. Stack memory is
>  not executable on most OSes these days and this will
>  not change. Executable
>  stack memory is one of the biggest security problems.
>  An execstack error might
>  in fact be most likely raised by malicious code.
>  Applications are sometimes
>  coded incorrectly and request this permission. The
>  SELinux Memory Protection
>  Tests
>  (http://people.redhat.com/drepper/selinux-mem.html)
>  web page explains how
>  to remove this requirement. If firefox does not work
>  and you need it to work,
>  you can configure SELinux temporarily to allow this
>  access until the application
>  is fixed. Please file a bug report
>  (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
>  against this package.
>  
>  Allowing Access:
>  
>  Sometimes a library is accidentally marked with the
>  execstack flag, if you find
>  a library with this flag you can clear it with the
>  execstack -c LIBRARY_PATH.
>  Then retry your application. If the app continues to
>  not work, you can turn the
>  flag back on with execstack -s LIBRARY_PATH.
>  Otherwise, if you trust firefox to
>  run correctly, you can change the context of the
>  executable to
>  unconfined_execmem_exec_t. "chcon -t
>  unconfined_execmem_exec_t
>  '/usr/lib/firefox-3.0b4pre/firefox'" You must also
>  change the default file
>  context files on the system in order to preserve them
>  even on a full relabel.
>  "semanage fcontext -a -t unconfined_execmem_exec_t
>  '/usr/lib/firefox-3.0b4pre/firefox'"
>  
>  The following command will allow this access:
>  
>  chcon -t unconfined_execmem_exec_t
>  '/usr/lib/firefox-3.0b4pre/firefox'
>  
>  Additional Information:
>  
>  Source Context               
>  unconfined_u:unconfined_r:unconfined_t:SystemLow-
>                                SystemHigh
>  Target Context               
>  unconfined_u:unconfined_r:unconfined_t:SystemLow-
>                                SystemHigh
>  Target Objects                None [ process ]
>  Source                        firefox
>  Source Path                  
>  /usr/lib/firefox-3.0b3pre/firefox
>  Port                          <Unknown>
>  Host                          localhost
>  Source RPM Packages          
>  firefox-3.0-0.beta2.16.nightly20080206.fc9
>  Target RPM Packages           
>  Policy RPM                   
>  selinux-policy-3.2.7-1.fc9
>  Selinux Enabled               True
>  Policy Type                   targeted
>  MLS Enabled                   True
>  Enforcing Mode                Enforcing
>  Plugin Name                   allow_execstack
>  Host Name                     localhost
>  Platform                      Linux localhost
>  2.6.24-23.fc9 #1 SMP Wed Feb 6
>                                11:36:31 EST 2008 i686
>  athlon
>  Alert Count                   11
>  First Seen                    Fri 01 Feb 2008 05:08:54
>  PM CST
>  Last Seen                     Sat 09 Feb 2008 12:35:06
>  PM CST
>  Local ID                     
>  c4806f30-a6dc-43b0-8901-5531075795f7
>  Line Numbers                  
>  
>  Raw Audit Messages            
>  
>  host=localhost type=AVC msg=audit(1202582106.621:28):
>  avc:  denied  { execstack } for  pid=9246
>  comm="firefox"
>  scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>  tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>  tclass=process
>  
>  host=localhost type=SYSCALL
>  msg=audit(1202582106.621:28): arch=40000003
>  syscall=125 success=no exit=-13 a0=bfa71000 a1=1000
>  a2=1000007 a3=fffff000 items=0 ppid=9232 pid=9246
>  auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500
>  egid=500 sgid=500 fsgid=500 tty=(none) comm="firefox"
>  exe="/usr/lib/firefox-3.0b4pre/firefox"
>  subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>  key=(null)
>  
>  
>  
>  Regards,
>  
>  Antonio 
>  
>  
>       
> ____________________________________________________________________________________
>  Never miss a thing.  Make Yahoo your home page. 
>  http://www.yahoo.com/r/hs
>   
chcon -t unconfined_execmem_exec_t
'/usr/lib/firefox-3.0b4pre/firefox'

This will only survive until the next relabel.  selinux-policy update
can trigger partial relabels.

# semanage fcontext -a -t unconfined_execmem_exec_t
'/usr/lib/firefox-3.0b4pre/firefox'
# restorecon '/usr/lib/firefox-3.0b4pre/firefox'

Would set the file systems default labeling for firefox and make it
survive a relabel.

As other replies have indicated, this problem is probably a bad plugin.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.8 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkexqmoACgkQrlYvE4MpobPeAwCg4DfcKCUrh/31D5ktqc2vH6JL
> pqUAnRiP4HtUCMkKNxdK0xeT5+kVzIqA
> =dfRo
> -----END PGP SIGNATURE-----