Re: SELinux is preventing npviewer.bin (nsplugin_t) "unix_read unix_write" unconfined_java_t.

[Daniel J Walsh]

On 04/27/2009 06:12 PM, Antonio Olivares wrote:
>  Just as I sent the other message, I got this one:
>
>
>  Summary:
>
>  SELinux is preventing npviewer.bin (nsplugin_t) "unix_read unix_write"
>  unconfined_java_t.
>
>  Detailed Description:
>
>  SELinux denied access requested by npviewer.bin. It is not expected that this
>  access is required by npviewer.bin and this access may signal an intrusion
>  attempt. It is also possible that the specific version or configuration of the
>  application is causing it to require additional access.
>
>  Allowing Access:
>
>  You can generate a local policy module to allow this access - see FAQ
>  (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
>  SELinux protection altogether. Disabling SELinux protection is not recommended.
>  Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
>  against this package.
>
>  Additional Information:
>
>  Source Context                unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c102
>                                 3
>  Target Context                unconfined_u:unconfined_r:unconfined_java_t:s0-s0:
>                                 c0.c1023
>  Target Objects                None [ sem ]
>  Source                        npviewer.bin
>  Source Path                   /usr/lib64/nspluginwrapper/npviewer.bin
>  Port<Unknown>
>  Host                          gray
>  Source RPM Packages           nspluginwrapper-1.3.0-5.fc11
>  Target RPM Packages
>  Policy RPM                    selinux-policy-3.6.12-9.fc11
>  Selinux Enabled               True
>  Policy Type                   targeted
>  MLS Enabled                   True
>  Enforcing Mode                Enforcing
>  Plugin Name                   catchall
>  Host Name                     gray
>  Platform                      Linux gray 2.6.29.1-102.fc11.x86_64 #1 SMP Mon Apr
>                                 20 15:33:38 EDT 2009 x86_64 x86_64
>  Alert Count                   2
>  First Seen                    Tue 28 Apr 2009 05:08:56 PM CDT
>  Last Seen                     Tue 28 Apr 2009 05:08:56 PM CDT
>  Local ID                      9c2334d3-9938-4dac-9be2-41980e1cdcd4
>  Line Numbers
>
>  Raw Audit Messages
>
>  node=gray type=AVC msg=audit(1240956536.52:59): avc:  denied  { unix_read unix_write }
> for  pid=4852 comm="npviewer.bin" key=-583345475
> scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023
> tcontext=unconfined_u:unconfined_r:unconfined_java_t:s0-s0:c0.c1023 tclass=sem
>
>  node=gray type=SYSCALL msg=audit(1240956536.52:59): arch=c000003e syscall=64 success=no
> exit=-13 a0=dd3adabd a1=1 a2=380 a3=7ffffabb11d0 items=0 ppid=3116 pid=4852 auid=500
> uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1
> comm="npviewer.bin" exe="/usr/lib64/nspluginwrapper/npviewer.bin"
> subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
>
>
>
>
>
>
>
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list 
Fixed in selinux-policy-3.6.12-24.fc11.noarch