Re: problems after selinux-policy-targeted-1.17.30-3.2 update

[Michael E Locasto]

I have also experienced the error in the new version of the policy boolean
file. However, Colin's advice about setting the execmod boolean to 1
doesn't work for me.

[root@xoren ~]# /usr/sbin/setsebool -P allow_execmod=true
[root@xoren ~]# /usr/sbin/getsebool allow_execmod
allow_execmod --> active
[root@xoren targeted]# grep execmod booleans
allow_execmod=1
[root@xoren targeted]#

However, I still cannot start acroread. The Mozilla Flash plugin is also
still inoperable. I see messages in /var/log/messages of the form:

Jun 15 14:12:28 xoren kernel: audit(1118844748.131:0): avc:  denied  { 
execmod } for  pid=6438 comm=acroread 
path=/usr/local/Adobe/Acrobat7.0/Reader/intellinux/plug_ins/AcroForm.api 
dev=hda5 ino=29374502 scontext=user_u:system_r:unconfined_t 
tcontext=system_u:object_r:usr_t tclass=file

I appreciate any advice. Should I reboot or reinitialize the SELinux
framework? If so, how? I'm a complete newbie in regards to SELinux.
How do I go about disabling selinux (I'd rather not).

Version info:

[root@xoren ~]# uname -r
2.6.11-1.27_FC3
[root@xoren ~]# rpm -qa | grep selinux
libselinux-1.19.1-8
selinux-policy-targeted-1.17.30-3.2
libselinux-devel-1.19.1-8
[root@xoren ~]#

Please CC me, I'm not subscribed to the list.

Cheers,
Michael

problems after selinux-policy-targeted-1.17.30-3.2 update

[Daniel J Walsh]

Michael E Locasto wrote:

>  I have also experienced the error in the new version of the policy 
>  boolean
>  file. However, Colin's advice about setting the execmod boolean to 1
>  doesn't work for me.
>
>  [root@xoren ~]# /usr/sbin/setsebool -P allow_execmod=true
>  [root@xoren ~]# /usr/sbin/getsebool allow_execmod
>  allow_execmod --> active
>  [root@xoren targeted]# grep execmod booleans
>  allow_execmod=1
>  [root@xoren targeted]#
>
>  However, I still cannot start acroread. The Mozilla Flash plugin is also
>  still inoperable. I see messages in /var/log/messages of the form:
>
>  Jun 15 14:12:28 xoren kernel: audit(1118844748.131:0): avc:  denied  { 
>  execmod } for  pid=6438 comm=acroread 
>  path=/usr/local/Adobe/Acrobat7.0/Reader/intellinux/plug_ins/AcroForm.api 
>  dev=hda5 ino=29374502 scontext=user_u:system_r:unconfined_t 
>  tcontext=system_u:object_r:usr_t tclass=file
>
>  I appreciate any advice. Should I reboot or reinitialize the SELinux
>  framework? If so, how? I'm a complete newbie in regards to SELinux.
>  How do I go about disabling selinux (I'd rather not).
>
>  Version info:
>
>  [root@xoren ~]# uname -r
>  2.6.11-1.27_FC3
>  [root@xoren ~]# rpm -qa | grep selinux
>  libselinux-1.19.1-8
>  selinux-policy-targeted-1.17.30-3.2
>  libselinux-devel-1.19.1-8
>  [root@xoren ~]#
>
>  Please CC me, I'm not subscribed to the list.
>
>  Cheers,
>  Michael
>
>  -- 
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  http://www.redhat.com/mailman/listinfo/fedora-selinux-list 
try
chcon -t shlib_t 
/usr/local/Adobe/Acrobat7.0/Reader/intellinux/plug_ins/AcroForm.api

--

problems after selinux-policy-targeted-1.17.30-3.2 update

[Michael E Locasto]

Daniel,

>  try
>  chcon -t shlib_t 
>  /usr/local/Adobe/Acrobat7.0/Reader/intellinux/plug_ins/AcroForm.api 
This worked (I also had to do it for the other plugins and
intellinux/SPPlugins/ADMPlugin.apl)...thanks very much for your help.

Cheers,
Michael