I notice when I start up google-chrome (F15) I get this:
SELinux is preventing /opt/google/chrome/chrome from execmod access on the file /opt/google/chrome/chrome.
***** Plugin allow_execmod (91.4 confidence) suggests **********************
If you want to allow chrome to have execmod access on the chrome file Then you need to change the label on '/opt/google/chrome/chrome' Do # semanage fcontext -a -t textrel_shlib_t '/opt/google/chrome/chrome' # restorecon -v '/opt/google/chrome/chrome'
***** Plugin catchall (9.59 confidence) suggests ***************************
Is the above suggestion a reasonable fix ?
thanks as always !!
gene/
On Wed, 2011-06-29 at 13:05 -0400, Genes MailLists wrote:
# semanage fcontext -a -t textrel_shlib_t '/opt/google/chrome/chrome' # restorecon -v '/opt/google/chrome/chrome'
If it really needs it then I would probably go with the above.
Is it reasonable? No:
http://www.akkadia.org/drepper/textrelocs.html
Quote:
"There is usually no reason to not fix the problems. While a programs with text relocations can be made to run by relaxing the SELinux security this is a bad idea. The kind of permissions which have to be granted to the program create a gaping hole in the security policy. Attackers will be able to modify the memory as well. If this is not the case a program can enforce a strict W^X policy. I.e., no memory page is writable and executable at the same time. And more: SElinux can also enforce that no writable page can be marked as read/exec-only. With these provisions an attacker has no room where to place his/her exploit code. This is a huge win. So, always fix all text relocations. We've made it as easy as possible."
On 06/29/2011 01:22 PM, Dominick Grift wrote:
On Wed, 2011-06-29 at 13:05 -0400, Genes MailLists wrote:
# semanage fcontext -a -t textrel_shlib_t '/opt/google/chrome/chrome' # restorecon -v '/opt/google/chrome/chrome'
If it really needs it then I would probably go with the above.
Is it reasonable? No:
Thanks ... are you guys in touch with google about how to improve selinux/google-chrome interoperability?
Thank you for your feedback.
gene
On Wed, 2011-06-29 at 13:36 -0400, Genes MailLists wrote:
Thanks ... are you guys in touch with google about how to improve selinux/google-chrome interoperability?
Thank you for your feedback.
gene
There are actually some ideas/ requests for co-operation from the fedora people and chrome people but i am not sure if that will work out.
https://bugzilla.redhat.com/show_bug.cgi?id=717417 https://bugzilla.redhat.com/show_bug.cgi?id=710273
theres more but couldnt find it on short notice
-- selinux mailing list selinux@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux
selinux@lists.fedoraproject.org