Hello,
I triggered a Wine app to open up a URL link and Firefox opened up and things went downhill from there. I'm guessing that Wine somehow corrupted all the contexts of the Firefox bookmark/places/etc. storage files and now SELinux is preventing any of them from being accessed ... even after opening up Firefox normally.
Here is an example of the error output by setroubleshoot (but they just keep coming for various Firefox related Target Objects every 10 seconds or so ... on opening Firefox, about 40 are generated immediately):
Summary:
SELinux is preventing firefox from creating a file with a context of unlabeled_t on a filesystem.
Detailed Description:
SELinux is preventing firefox from creating a file with a context of unlabeled_t on a filesystem. Usually this happens when you ask the cp command to maintain the context of a file when copying between file systems, "cp -a" for example. Not all file contexts should be maintained between the file systems. For example, a read-only file type like iso9660_t should not be placed on a r/w system. "cp -P" might be a better solution, as this will adopt the default file context for the destination.
Allowing Access:
Use a command like "cp -P" to preserve all permissions except SELinux context.
Additional Information:
Source Context unconfined_u:object_r:unlabeled_t Target Context system_u:object_r:fs_t Target Objects bookmarks-2008-05-22.json [ filesystem ] Source firefox Source Path /usr/lib/firefox-3.0b5/firefox Port <Unknown> Host localhost.localdomain Source RPM Packages firefox-3.0-0.60.beta5.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-51.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name filesystem_associate Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.25.3-18.fc9.i686 #1 SMP Tue May 13 05:38:53 EDT 2008 i686 athlon Alert Count 6 First Seen Thu 22 May 2008 08:07:34 PM EDT Last Seen Thu 22 May 2008 08:09:49 PM EDT Local ID d083caff-a8e7-4588-b913-798c14cefdac Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC msg=audit(1211501389.186:114): avc: denied { associate } for pid=3676 comm="firefox" name="bookmarks-2008-05-22.json" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem
host=localhost.localdomain type=SYSCALL msg=audit(1211501389.186:114): arch=40000003 syscall=5 success=no exit=-13 a0=ae38748 a1=82c1 a2=180 a3=82c1 items=0 ppid=3662 pid=3676 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="firefox" exe="/usr/lib/firefox-3.0b5/firefox" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
I suspect a 'touch /.autorelabel; reboot' will fix this but I would also suspect that it will just happen again as soon as Wine triggers another URL loading.
I will try to pack some more info into a bugzilla (if there is not already one) but I figured I would give the SELinux gurus a heads up since I haven't seen this issue raised yet.
/Mike
On Thu, May 22, 2008 at 8:20 PM, Michael Wiktowy michael.wiktowy@gmail.com wrote:
Hello,
I triggered a Wine app to open up a URL link and Firefox opened up and things went downhill from there. I'm guessing that Wine somehow corrupted all the contexts of the Firefox bookmark/places/etc. storage files and now SELinux is preventing any of them from being accessed ... even after opening up Firefox normally.
Here is an example of the error output by setroubleshoot (but they just keep coming for various Firefox related Target Objects every 10 seconds or so ... on opening Firefox, about 40 are generated immediately):
Summary:
SELinux is preventing firefox from creating a file with a context of unlabeled_t on a filesystem.
Created: https://bugzilla.redhat.com/show_bug.cgi?id=448031
For anyone else that stumbles across this, a 'restorecon -R ~<user>/.mozilla' as root will get things back to normal with no data loss. At least it did for me ... at least until the next time I open a URL with a Wine app ...
/Mike
Michael Wiktowy wrote:
Hello,
I triggered a Wine app to open up a URL link and Firefox opened up and things went downhill from there. I'm guessing that Wine somehow corrupted all the contexts of the Firefox bookmark/places/etc. storage files and now SELinux is preventing any of them from being accessed ... even after opening up Firefox normally.
Here is an example of the error output by setroubleshoot (but they just keep coming for various Firefox related Target Objects every 10 seconds or so ... on opening Firefox, about 40 are generated immediately):
Summary:
SELinux is preventing firefox from creating a file with a context of unlabeled_t on a filesystem.
Detailed Description:
SELinux is preventing firefox from creating a file with a context of unlabeled_t on a filesystem. Usually this happens when you ask the cp command to maintain the context of a file when copying between file systems, "cp -a" for example. Not all file contexts should be maintained between the file systems. For example, a read-only file type like iso9660_t should not be placed on a r/w system. "cp -P" might be a better solution, as this will adopt the default file context for the destination.
Allowing Access:
Use a command like "cp -P" to preserve all permissions except SELinux context.
Additional Information:
Source Context unconfined_u:object_r:unlabeled_t Target Context system_u:object_r:fs_t Target Objects bookmarks-2008-05-22.json [ filesystem ] Source firefox Source Path /usr/lib/firefox-3.0b5/firefox Port <Unknown> Host localhost.localdomain Source RPM Packages firefox-3.0-0.60.beta5.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-51.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name filesystem_associate Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.25.3-18.fc9.i686 #1 SMP Tue May 13 05:38:53 EDT 2008 i686 athlon Alert Count 6 First Seen Thu 22 May 2008 08:07:34 PM EDT Last Seen Thu 22 May 2008 08:09:49 PM EDT Local ID d083caff-a8e7-4588-b913-798c14cefdac Line Numbers
Raw Audit Messages
host=localhost.localdomain type=AVC msg=audit(1211501389.186:114): avc: denied { associate } for pid=3676 comm="firefox" name="bookmarks-2008-05-22.json" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem
host=localhost.localdomain type=SYSCALL msg=audit(1211501389.186:114): arch=40000003 syscall=5 success=no exit=-13 a0=ae38748 a1=82c1 a2=180 a3=82c1 items=0 ppid=3662 pid=3676 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="firefox" exe="/usr/lib/firefox-3.0b5/firefox" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
I suspect a 'touch /.autorelabel; reboot' will fix this but I would also suspect that it will just happen again as soon as Wine triggers another URL loading.
I will try to pack some more info into a bugzilla (if there is not already one) but I figured I would give the SELinux gurus a heads up since I haven't seen this issue raised yet.
/Mike
Please open a bugzilla.
-
Daniel J Walsh -
Michael Wiktowy