| 1 |
commit: 2a26ba597c47fe006e1c18cdd9224e74aba02bf8 |
| 2 |
Author: Jason Zaman <jason <AT> perfinion <DOT> com> |
| 3 |
AuthorDate: Sun Sep 6 10:58:43 2015 +0000 |
| 4 |
Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org> |
| 5 |
CommitDate: Sun Sep 6 10:58:43 2015 +0000 |
| 6 |
URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=2a26ba59 |
| 7 |
|
| 8 |
chromium: v45 needs setcap perms |
| 9 |
|
| 10 |
type=AVC msg=audit(1441536942.937:329): avc: denied { setcap } for |
| 11 |
pid=4857 comm="chrome" scontext=staff_u:staff_r:chromium_t:s0-s0:c0.c511 |
| 12 |
tcontext=staff_u:staff_r:chromium_t:s0-s0:c0.c511 tclass=process |
| 13 |
permissive=0 |
| 14 |
type=SYSCALL msg=audit(1441536942.937:329): arch=c000003e syscall=126 |
| 15 |
success=no exit=-13 a0=3f40091b950 a1=3f40091b960 a2=3ce87534090 |
| 16 |
a3=3ce87530010 items=0 ppid=4772 pid=4857 auid=1000 uid=1000 gid=100 |
| 17 |
euid=1000 suid=1000 fsuid=1000 egid=100 sgid=100 fsgid=100 tty=pts4 |
| 18 |
ses=3 comm="chrome" exe="/usr/lib64/chromium-browser/chrome" |
| 19 |
subj=staff_u:staff_r:chromium_t:s0-s0:c0.c511 key=(null) |
| 20 |
type=ANOM_ABEND msg=audit(1441536942.937:330): auid=1000 uid=1000 |
| 21 |
gid=100 ses=3 subj=staff_u:staff_r:chromium_t:s0-s0:c0.c511 pid=4857 |
| 22 |
comm="chrome" exe="/usr/lib64/chromium-browser/chrome" sig=6 |
| 23 |
|
| 24 |
[4:4:0906/185542:FATAL:credentials.cc(306)] Check failed: |
| 25 |
DropAllCapabilitiesOnCurrentThread(). : Permission denied |
| 26 |
[4765:4783:0906/185542:ERROR:zygote_host_impl_linux.cc(374)] Did not |
| 27 |
receive ping from zygote child |
| 28 |
[3:3:0906/185542:ERROR:zygote_linux.cc(573)] Zygote could not fork: |
| 29 |
process_type renderer numfds 5 child_pid -1 |
| 30 |
|
| 31 |
policy/modules/contrib/chromium.te | 2 +- |
| 32 |
1 file changed, 1 insertion(+), 1 deletion(-) |
| 33 |
|
| 34 |
diff --git a/policy/modules/contrib/chromium.te b/policy/modules/contrib/chromium.te |
| 35 |
index b2c9ccc..3185640 100644 |
| 36 |
--- a/policy/modules/contrib/chromium.te |
| 37 |
+++ b/policy/modules/contrib/chromium.te |
| 38 |
@@ -88,7 +88,7 @@ xdg_cache_home_content(chromium_xdg_cache_t) |
| 39 |
# chromium local policy |
| 40 |
# |
| 41 |
|
| 42 |
-allow chromium_t self:process { getsched setrlimit setsched sigkill signal }; |
| 43 |
+allow chromium_t self:process { getsched setcap setrlimit setsched sigkill signal }; |
| 44 |
allow chromium_t self:fifo_file rw_fifo_file_perms;; |
| 45 |
allow chromium_t self:sem create_sem_perms; |
| 46 |
allow chromium_t self:netlink_kobject_uevent_socket client_stream_socket_perms; |
Archives