SELinux is preventing /usr/lib64/firefox/plugin-container from 'name_bind' accesses on the tcp_socket
Issue
- SELinux setroubleshoot program generates the following error message
:***** Plugin mozplugger (99.1 confidence) suggests ************************
:
:If you want to use the plugin package
:Then you must turn off SELinux controls on the Firefox plugins.
:Do
:# setsebool -P unconfined_mozilla_plugin_transition 0
:
:***** Plugin catchall (1.81 confidence) suggests **************************
:
:If you believe that plugin-container should be allowed name_bind access on the tcp_socket by default.
:Then you should report this as a bug.
:You can generate a local policy module to allow this access.
:Do
:allow this access for now by executing:
:# grep plugin-containe /var/log/audit/audit.log | audit2allow -M mypol
:# semodule -i mypol.pp
:
:Additional Information:
:Source Context unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c
: 0.c1023
:Target Context system_u:object_r:amqp_port_t:s0
:Target Objects [ tcp_socket ]
:Source plugin-containe
:Source Path /usr/lib64/firefox/plugin-container
:Port 5672
:Host (removed)
:Source RPM Packages firefox-31.2.0-3.el7_0.x86_64
:Target RPM Packages
:Policy RPM selinux-policy-3.12.1-153.el7_0.11.noarch
:Selinux Enabled True
:Policy Type targeted
:Enforcing Mode Enforcing
:Host Name (removed)
:Platform Linux (removed) 3.10.0-123.8.1.el7.x86_64 #1 SMP
: Mon Aug 11 13:37:49 EDT 2014 x86_64 x86_64
:Alert Count 1
:First Seen 2014-10-22 16:58:24 CEST
:Last Seen 2014-10-22 16:58:24 CEST
:Local ID f7f0b847-5ed0-4b66-9212-a8502d46cfa4
:
:Raw Audit Messages
:type=AVC msg=audit(1413989904.770:3522): avc: denied { name_bind } for pid=22618 comm="plugin-containe" src=5672 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:amqp_port_t:s0 tclass=tcp_socket
:
:
:type=SYSCALL msg=audit(1413989904.770:3522): arch=x86_64 syscall=bind success=no exit=EACCES a0=31 a1=7ffb1d4fb360 a2=10 a3=7ffb1d4fb39c items=0 ppid=6365 pid=22618 auid=14411 uid=14411 gid=14411 euid=14411 suid=14411 fsuid=14411 egid=14411 sgid=14411 fsgid=14411 tty=(none) ses=1 comm=plugin-containe exe=/usr/lib64/firefox/plugin-container subj=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 key=(null)
:
:Hash: plugin-containe,mozilla_plugin_t,amqp_port_t,tcp_socket,name_bind
Environment
- Red Hat Enterprise Linux 7
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.
Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.
