Mozilla vs ORBit tmp files

Mozilla vs ORBit tmp files

[Ivan Gyurdiev]

Hi,

Mozilla was recently changed in the Fedora policy
to prevent writing to user_tmp_t. However that introduced
the following regression:

audit(1108909606.145:0): avc:  denied  { write } for  pid=3830
exe=/usr/lib/firefox-1.0/firefox-bin name=linc-fd0-0-5891c0341b10d
dev=dm-0 ino=827446 scontext=user_u:user_r:user_mozilla_t
tcontext=user_u:object_r:user_tmp_t tclass=sock_file

Should it be changed back? 

The original suggestion was to transition mozilla to user_mozilla_tmp_t,
but file_auto_trans() only works for creating new files, while here
mozilla is using existing sockets in /tmp/orbit-username.  

-- 
Ivan Gyurdiev <ivg2@cornell.edu>
Cornell University


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Mozilla vs ORBit tmp files

[Daniel J Walsh]

Ivan Gyurdiev wrote:

>Hi,
>
>Mozilla was recently changed in the Fedora policy
>to prevent writing to user_tmp_t. However that introduced
>the following regression:
>
>audit(1108909606.145:0): avc:  denied  { write } for  pid=3830
>exe=/usr/lib/firefox-1.0/firefox-bin name=linc-fd0-0-5891c0341b10d
>dev=dm-0 ino=827446 scontext=user_u:user_r:user_mozilla_t
>tcontext=user_u:object_r:user_tmp_t tclass=sock_file
>
>Should it be changed back? 
>
>The original suggestion was to transition mozilla to user_mozilla_tmp_t,
>but file_auto_trans() only works for creating new files, while here
>mozilla is using existing sockets in /tmp/orbit-username.  
>
>  
>
I will add the following back in.
allow user_mozilla_t user_tmp_t:sock_file rw_file_perms;



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.