selinux kills firefox?

[Per Bothner]

$ firefox
/usr/lib/firefox-3.5.3/run-mozilla.sh: line 131:  2334 Segmentation 
fault      "$prog" ${1+"$@"}
$ /usr/lib/firefox-3.5.3/firefox
Segmentation fault

However, when I disable SELinux (by SELINUX=permissive in
editing /etc/sysconfig/selinux), it works.

Diagnosing this is more complicated than it should be,
because Applications->System Tools->SELinux Troubleshooter
does nothing.  And I don't see anything SELinux-related in
System->Administration.  (This is probably a non-standard
menu bar, because I'm using the same /home as Fedora 11.)

Related: When an SELinux problem happens, a pop-up
happens, with an option to "show" the denial.
That doesn't do anything either.
-- 
	--Per Bothner
per(a)bothner.com   http://per.bothner.com/

[David L]

On Fri, Sep 25, 2009 at 12:27 PM, Per Bothner wrote:
>  $ firefox
>  /usr/lib/firefox-3.5.3/run-mozilla.sh: line 131:  2334 Segmentation fault
>     "$prog" ${1+"$@"}
>  $ /usr/lib/firefox-3.5.3/firefox
>  Segmentation fault
>
>  However, when I disable SELinux (by SELINUX=permissive in
>  editing /etc/sysconfig/selinux), it works. 
firefox stopped working for me (except in -safe-mode) a week
or so ago:

https://bugzilla.redhat.com/show_bug.cgi?id=524635

I'm not sure if that's your problem.

Eventually, I had to disable selinux for another firefox problem
that I decided not to bother tracking down.  I get so many selinux
errors that I can't test other stuff with selinux enabled.

On a related note, system-config-selinux doesn't work for me...
I had to edit the config file by hand.

Cheers...

             David

[Daniel J Walsh]

On 09/25/2009 12:27 PM, Per Bothner wrote:
>  $ firefox
>  /usr/lib/firefox-3.5.3/run-mozilla.sh: line 131:  2334 Segmentation
>  fault      "$prog" ${1+"$@"}
>  $ /usr/lib/firefox-3.5.3/firefox
>  Segmentation fault
>  
>  However, when I disable SELinux (by SELINUX=permissive in
>  editing /etc/sysconfig/selinux), it works.
>  
>  Diagnosing this is more complicated than it should be,
>  because Applications->System Tools->SELinux Troubleshooter
>  does nothing.  And I don't see anything SELinux-related in
>  System->Administration.  (This is probably a non-standard
>  menu bar, because I'm using the same /home as Fedora 11.)
>  
>  Related: When an SELinux problem happens, a pop-up
>  happens, with an option to "show" the denial.
>  That doesn't do anything either. 
If you turn on the allow_execmem boolean or
the 
allow_unconfined_nsplugin_transition off, your firefox will run.

setsebool -P allow_execmen 1
setsebool -P allow_unconfined_nsplugin_transition 0

Both of these will allow firefox to run with the breakage.  In Rawhide we turn these
booleans off to try to reveal
where we have badly written code.  Firefox/Xulrunner/FlashPlugin have an execmem problem. 
It has been reported for a while.

setroubleshoot should be reporting this to you.

Tonights build will turn off the 

setsebool -P allow_unconfined_nsplugin_transition 0

for fresh installs, as we get closer to Beta, I have to start loosening up the controls so
that SELinux can not block 
badly written programs any longer.

What version of setroubleshoot are you running that you are not seeing AVC messages?

[Eric Springer]

On Sat, Sep 26, 2009 at 5:27 AM, Per Bothner <per(a)bothner.com&gt; wrote:
>  $ firefox
>  /usr/lib/firefox-3.5.3/run-mozilla.sh: line 131:  2334 Segmentation fault
>     "$prog" ${1+"$@"}
>  $ /usr/lib/firefox-3.5.3/firefox
>  Segmentation fault 
Probably different, but i had this exact error caused by flash (x64
alpha) . After installing flashblock it only ever happened when I
clicked to view flash.

[Per Bothner]

On 09/25/2009 05:28 PM, Eric Springer wrote:
>  On Sat, Sep 26, 2009 at 5:27 AM, Per Bothner<per(a)bothner.com> 
> wrote:
> > $ firefox
> > /usr/lib/firefox-3.5.3/run-mozilla.sh: line 131:  2334 Segmentation fault
> >     "$prog" ${1+"$@"}
> > $ /usr/lib/firefox-3.5.3/firefox
> > Segmentation fault
>
>  Probably different, but i had this exact error caused by flash (x64
>  alpha) . After installing flashblock it only ever happened when I
>  clicked to view flash. 
I don't have flash installed on rawhide yet.  And I'm running
32-bit i686.  (I only have 3GB memory, and in the past I've
found that 64-bit Fedora pushes my memory usage too high.)
-- 
	--Per Bothner
per(a)bothner.com   http://per.bothner.com/

[Per Bothner]

On 09/25/2009 01:33 PM, Daniel J Walsh wrote:
>  What version of setroubleshoot are you running that you are not
> seeing AVC messages? 
$ yum info setroubleshoot

reports:

Name       : setroubleshoot
Arch       : i686
Version    : 2.2.30
Release    : 1.fc12
Size       : 284 k

But as I said nothing happens when I click
Applications->System Tools->SELinux Troubleshooter

I don't know the appropriate command line to try.
-- 
	--Per Bothner
per(a)bothner.com   http://per.bothner.com/

[Daniel J Walsh]

On 09/25/2009 08:40 PM, Per Bothner wrote:
>  On 09/25/2009 05:28 PM, Eric Springer wrote:
> > On Sat, Sep 26, 2009 at 5:27 AM, Per Bothner<per(a)bothner.com>  wrote:
> >> $ firefox
> >> /usr/lib/firefox-3.5.3/run-mozilla.sh: line 131:  2334 Segmentation
> >> fault
> >>     "$prog" ${1+"$@"}
> >> $ /usr/lib/firefox-3.5.3/firefox
> >> Segmentation fault
> >
> > Probably different, but i had this exact error caused by flash (x64
> > alpha) . After installing flashblock it only ever happened when I
> > clicked to view flash.
>  
>  I don't have flash installed on rawhide yet.  And I'm running
>  32-bit i686.  (I only have 3GB memory, and in the past I've
>  found that 64-bit Fedora pushes my memory usage too high.) 
xulrunner has had some
execmem problems that have been reported.


setsebool -P allow_unconfined_nsplugin_transition 0

Should allow your firefox to run without this protection, for now.