[running latest FC3T1 w/ mods from devel tree, strict/enforcing]
When starting up mozilla as normal user, I noticed the following avc's:
Jul 22 06:58:24 fedora kernel: audit(1090504704.981:0): avc: denied {
execute } for pid=3527
path=/usr/java/j2sdk1.5.0/jre/lib/i386/client/libjvm.so dev=hda2
ino=4279850 scontext=user_u:user_r:user_mozilla_t
tcontext=system_u:object_r:lib_t tclass=file
Jul 22 06:58:34 fedora kernel: audit(1090504714.317:0): avc: denied {
execute } for pid=3517
path=/usr/java/j2sdk1.5.0/jre/lib/i386/libjavaplugin_nscp.so dev=hda2
ino=4279868 scontext=user_u:user_r:user_mozilla_t
tcontext=system_u:object_r:lib_t tclass=file
Jul 22 06:59:06 fedora kernel: audit(1090504746.751:0): avc: denied {
read } for pid=3517 exe=/usr/lib/mozilla-1.7/mozilla-bin name=tmp
dev=hda2 ino=4112506 scontext=user_u:user_r:user_mozilla_t
tcontext=system_u:object_r:tmp_t tclass=lnk_file
The last of these describes an access to the link '/usr/tmp->../var/tmp'.
[I can't tell if this is 'breaking' anything, so I don't know if anything
needs to change here. Help anyone?]
The first 2 denials appear to interfere with plugins.
Going into permissive mode identifies the following list of
'java library executes' from scontext=user_u:user_r:user_mozilla_t:
/usr/java/j2sdk1.5.0/jre/lib/i386/client/libjvm.so
/usr/java/j2sdk1.5.0/jre/lib/i386/libjavaplugin_nscp.so
/usr/java/j2sdk1.5.0/jre/lib/i386/native_threads/libhpi.so
/usr/java/j2sdk1.5.0/jre/lib/i386/libverify.so
/usr/java/j2sdk1.5.0/jre/lib/i386/libjava.so
/usr/java/j2sdk1.5.0/jre/lib/i386/libzip.so
I changed their contexts to 'system_u:object_r:shlib_t'
and plugins started working again.
The j2 entries in types.fc are:
/usr/java/j2.*/bin(/.*)? system_u:object_r:bin_t
/usr/java/j2.*/jre/lib(64)?/i386(/.*)? system_u:object_r:lib_t
/usr/java/j2.*/plugin/i386(/.*)?/lib[^/]*\.so(\.[^/]*)* --
system_u:object_r:shlib_t
I admit to not really understanding what needs to be here.
Is it appropriate to change the second line to
/usr/java/j2.*/jre/lib(64)?/i386(/.*)? system_u:object_r:shlib_t
or something more specific to 1.5.0?
tom
| 
