Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1345836 - SELinux is preventing google-chrome-s from 'create' accesses on the file 63.
Summary: SELinux is preventing google-chrome-s from 'create' accesses on the file 63.
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:a860b9cf7ea49b9731e3a1b8248...
: 1339410 1370003 1370098 1372909 1372931 1373023 1373669 1374258 1374318 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-06-13 09:45 UTC by lejeczek
Modified: 2017-01-09 16:35 UTC (History)
98 users (show)

Fixed In Version: selinux-policy-3.13.1-191.14.fc24
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1370098 (view as bug list)
Environment:
Last Closed: 2016-09-16 10:51:14 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 1374030 0 unspecified CLOSED SELinux is preventing python from 'create' accesses on the file 1. 2021-02-22 00:41:40 UTC

Internal Links: 1374030

Description lejeczek 2016-06-13 09:45:34 UTC
Description of problem:
latest chrome

7880:7880:0613/104503:ERROR:shared_memory_posix.cc(290)] Creating shared memory in /dev/shm/.com.google.Chrome.aGwmG9 failed: Permission denied
[7880:7880:0613/104503:ERROR:shared_memory_posix.cc(293)] Unable to access(W_OK|X_OK) /dev/shm: Permission denied
[7880:7880:0613/104503:FATAL:shared_memory_posix.cc(295)] This is frequently caused by incorrect permissions on /dev/shm.  Try 'sudo chmod 1777 /dev/shm' to fix.
Aborted (core dumped)
SELinux is preventing google-chrome-s from 'create' accesses on the file 63.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that google-chrome-s should be allowed create access on the 63 file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'google-chrome-s' --raw | audit2allow -M my-googlechromes
# semodule -X 300 -i my-googlechromes.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Target Context                unconfined_u:object_r:unconfined_t:s0
Target Objects                63 [ file ]
Source                        google-chrome-s
Source Path                   google-chrome-s
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-194.fc25.noarch selinux-
                              policy-3.13.1-195.fc25.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.7.0-0.rc2.git1.1.fc25.x86_64 #1
                              SMP Tue Jun 7 13:28:43 UTC 2016 x86_64 x86_64
Alert Count                   5
First Seen                    2016-05-26 15:42:46 BST
Last Seen                     2016-06-13 10:28:38 BST
Local ID                      451ced9a-8fe3-4a2b-9718-57c538f7c220

Raw Audit Messages
type=AVC msg=audit(1465810118.119:243): avc:  denied  { create } for  pid=7433 comm="google-chrome-s" name="63" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:unconfined_t:s0 tclass=file permissive=0


Hash: google-chrome-s,unconfined_t,unconfined_t,file,create

Version-Release number of selected component:
selinux-policy-3.13.1-194.fc25.noarch
selinux-policy-3.13.1-195.fc25.noarch

Additional info:
reporter:       libreport-2.7.1
hashmarkername: setroubleshoot
kernel:         4.7.0-0.rc2.git1.1.fc25.x86_64
reproducible:   Not sure how to reproduce the problem
type:           libreport

Comment 1 Daniel Walsh 2016-06-13 16:00:07 UTC
Fixed in selinux-policy-3.13.1-196.fc25.noarch

Comment 2 Benjamin Xiao 2016-09-01 18:21:30 UTC
This problem is now affecting Fedora 24 with the 4.7.2 kernel. Will this fix be backported?

Comment 3 Antonio Murdaca 2016-09-03 19:47:29 UTC
Getting the same avc on F24 + 4.7.2

Comment 4 Dolmio 2016-09-03 22:06:01 UTC
Got this error today after update on F24 + 4.7.2

Comment 5 Daniel Walsh 2016-09-04 10:48:02 UTC
*** Bug 1372909 has been marked as a duplicate of this bug. ***

Comment 6 Daniel Walsh 2016-09-04 10:48:06 UTC
*** Bug 1372931 has been marked as a duplicate of this bug. ***

Comment 7 Daniel Walsh 2016-09-04 10:48:53 UTC
Need this back ported to f23, f24, f25

Comment 8 Michael Schechter 2016-09-04 23:47:43 UTC
Description of problem:
Happened in the background on restoring Chrome windows after upgrade of Chrome and reboot

Version-Release number of selected component:
selinux-policy-3.13.1-158.21.fc23.noarch

Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.7.2-101.fc23.x86_64
type:           libreport

Comment 9 mindenreezthasznalom 2016-09-05 14:57:52 UTC
Description of problem:
Indításkor jelzett

Version-Release number of selected component:
selinux-policy-3.13.1-158.21.fc23.noarch

Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.7.2-101.fc23.x86_64
type:           libreport

Comment 10 Mohamed 2016-09-05 17:41:16 UTC
same problem 
++++

SELinux is preventing google-chrome-s from create access on the file 63.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that google-chrome-s should be allowed create access on the 63 file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'google-chrome-s' --raw | audit2allow -M my-googlechromes
# semodule -X 300 -i my-googlechromes.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Target Context                unconfined_u:object_r:unconfined_t:s0
Target Objects                63 [ file ]
Source                        google-chrome-s
Source Path                   google-chrome-s
Port                          <Unknown>
Host                          
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-191.14.fc24.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     
Platform                      Linux  4.7.2-201.fc24.x86_64 #1 SMP Fri
                              Aug 26 15:58:40 UTC 2016 x86_64 x86_64
Alert Count                   1
First Seen                    2016-09-05 19:28:43 EET
Last Seen                     2016-09-05 19:28:43 EET
Local ID                      c3983017-3e9e-4e15-b57f-55ec1d4d5b58

Raw Audit Messages
type=AVC msg=audit(1473096523.992:226): avc:  denied  { create } for  pid=2126 comm="google-chrome-s" name="63" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:unconfined_t:s0 tclass=file permissive=0


Hash: google-chrome-s,unconfined_t,unconfined_t,file,create

Comment 11 Experimenter 2016-09-06 07:35:23 UTC
Description of problem:
On opening Version 53.0.2785.92 (64-bit) of Google Chrome, SELinux Alert popped up. 

Version-Release number of selected component:
selinux-policy-3.13.1-158.21.fc23.noarch

Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.7.2-101.fc23.x86_64
type:           libreport

Comment 12 veikok 2016-09-06 09:49:46 UTC
This still happens. fedora 24 and google-chrome-stable 53.0.2785.92-1

SELinux is preventing google-chrome-s from create access on the file 63.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that google-chrome-s should be allowed create access on the 63 file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'google-chrome-s' --raw | audit2allow -M my-googlechromes
# semodule -X 300 -i my-googlechromes.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Target Context                unconfined_u:object_r:unconfined_t:s0
Target Objects                63 [ file ]
Source                        google-chrome-s
Source Path                   google-chrome-s
Port                          <Unknown>
Host                          w520
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-191.14.fc24.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     w520
Platform                      Linux w520 4.7.2-201.fc24.x86_64 #1 SMP Fri Aug 26
                              15:58:40 UTC 2016 x86_64 x86_64
Alert Count                   1
First Seen                    2016-09-06 12:43:26 EEST
Last Seen                     2016-09-06 12:43:26 EEST
Local ID                      e412f736-ea88-44a3-9dcb-162c77a5b0fe

Raw Audit Messages
type=AVC msg=audit(1473155006.704:211): avc:  denied  { create } for  pid=4562 comm="google-chrome-s" name="63" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:unconfined_t:s0 tclass=file permissive=0


Hash: google-chrome-s,unconfined_t,unconfined_t,file,create

Comment 13 Tiago M. Vieira 2016-09-06 11:10:25 UTC
F24 and latest Chrome stable (53.0.2785.92).

SELinux is preventing google-chrome-s from 'create' accesses on the file 63.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that google-chrome-s should be allowed create access on the 63 file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'google-chrome-s' --raw | audit2allow -M my-googlechromes
# semodule -X 300 -i my-googlechromes.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Target Context                unconfined_u:object_r:unconfined_t:s0
Target Objects                63 [ file ]
Source                        google-chrome-s
Source Path                   google-chrome-s
Port                          <Unknown>
Host                          t450s
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-191.14.fc24.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     t450s
Platform                      Linux t450s 4.7.2-201.fc24.x86_64 #1 SMP Fri
                              Aug 26 15:58:40 UTC 2016 x86_64 x86_64
Alert Count                   1
First Seen                    2016-09-06 07:59:19 BRT
Last Seen                     2016-09-06 07:59:19 BRT
Local ID                      ee903a0b-d197-4bea-a617-2e2a60ee9168

Raw Audit Messages
type=AVC msg=audit(1473159559.702:264): avc:  denied  { create } for  pid=2974 comm="google-chrome-s" name="63" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:unconfined_t:s0 tclass=file permissive=0


Hash: google-chrome-s,unconfined_t,unconfined_t,file,create

Comment 14 Stephen Smalley 2016-09-06 12:51:30 UTC
This should not be allowed.
Aside from the /dev/shm error (which may be unrelated), this seems identical to bug 1370475, which seems to be a kernel bug, but does not cause a fatal error to applications.

Comment 15 Daniel Walsh 2016-09-06 12:53:58 UTC
I agree, I am now seeing this in other domains. we need to add

dontaudit domain self:file create;

Comment 16 Rafael 2016-09-06 23:17:34 UTC
Description of problem:
Run google chrome right after start-up

Version-Release number of selected component:
selinux-policy-3.13.1-158.21.fc23.noarch

Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.7.2-101.fc23.x86_64
type:           libreport

Comment 17 PARIJATHA KUMAR PASUPULETI 2016-09-07 12:38:38 UTC
I am also facing the same problem.

Fedora-24 KDE
Kernel : 4.7.2
SE Linux Policy : 3.13.1-191.14

Comment 18 hellishglare 2016-09-08 10:53:41 UTC
Description of problem:
Google Chrome browser was updated to version 53.0.2785.101-1. When I started the browser, this SELinux warning came up.

Version-Release number of selected component:
selinux-policy-3.13.1-158.21.fc23.noarch

Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.7.2-101.fc23.x86_64
type:           libreport

Comment 19 Daniel Walsh 2016-09-08 19:15:34 UTC
*** Bug 1339410 has been marked as a duplicate of this bug. ***

Comment 20 Daniel Walsh 2016-09-08 19:17:53 UTC
*** Bug 1370098 has been marked as a duplicate of this bug. ***

Comment 21 Daniel Walsh 2016-09-08 19:20:07 UTC
*** Bug 1373023 has been marked as a duplicate of this bug. ***

Comment 22 Daniel Walsh 2016-09-08 19:21:39 UTC
*** Bug 1370003 has been marked as a duplicate of this bug. ***

Comment 23 Daniel Walsh 2016-09-08 19:22:08 UTC
*** Bug 1373669 has been marked as a duplicate of this bug. ***

Comment 24 Daniel Walsh 2016-09-08 19:25:21 UTC
*** Bug 1374258 has been marked as a duplicate of this bug. ***

Comment 25 Daniel Walsh 2016-09-08 19:48:13 UTC
*** Bug 1374318 has been marked as a duplicate of this bug. ***

Comment 26 RyanEatsFish 2016-09-09 05:47:42 UTC
Description of problem:
Start-up after most recent update.  Chrome is running Hangouts and Keep "apps" maybe one of those fired this off?

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 27 Biji 2016-09-09 11:29:42 UTC
Description of problem:
each time starting google chrome

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 28 Joseph Bennett 2016-09-10 13:26:51 UTC
Description of problem:
Make sure google chrome application is closed.

Open google chrome, SELinux Alert appears in lower corner.

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 29 Veteran 2016-09-10 16:18:13 UTC
Description of problem:
run google chrome stable following update
selinux pops up avc denial

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 30 cyassis 2016-09-10 17:10:48 UTC
Description of problem:
Everytime I try to open google chrome for the first time after booting my notebook this happens.
It started to trigger after I made and update on my SO.

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 31 Markus 2016-09-10 20:50:50 UTC
Description of problem:
After updating to Google Chrome (google-chrome-stable-53.0.2785.101-1.x86_64) I started receiving the warning message from SElinux. Unfortunately, it's not clear to me what the path for the file "63" is. Doing a search of the filesystem, it appears like it may be a file in /proc. I may be submitting this report to the wrong people but just in case.

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 32 Leguis A. Gomez 2016-09-11 11:36:36 UTC
Description of problem:
Every time i opened the chrome the systme show the notice of avc denial. It shows an attemp from chrome to access file 63.

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 33 Raffaello Bertini 2016-09-11 12:01:15 UTC
Description of problem:
start chrome

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 34 Luis Ricardo Flores de Anda 2016-09-11 16:28:02 UTC
Description of problem:
Las pestañas de google chrome se encontraban abiertas, seleccione reiniciar equipo y actualizar sin cerrar chrome y el evento sucedió.

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 35 Sureyya Sahin 2016-09-12 00:26:00 UTC
Description of problem:
google chrome is giving selinux alert on start.

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 36 piapoco 2016-09-12 07:20:09 UTC
Description of problem:
I was booting the computer.

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 37 Simone Tolotti 2016-09-12 17:14:34 UTC
Description of problem:
Starting Google Chrome

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 38 mclong 2016-09-12 18:49:16 UTC
Description of problem:
Most recent dnf update caused this error.

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 39 Ben 2016-09-13 03:50:10 UTC
Description of problem:
Opening google-chrome version 53.0.2785.101 (64 bit).

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 40 Stephen Gallagher 2016-09-13 11:40:53 UTC
Description of problem:
I launched google chrome and this immediately happened

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 41 Bob Rasey 2016-09-13 14:02:42 UTC
Description of problem:
Start Chrome, get SE alert.

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 42 seven43 2016-09-14 11:43:35 UTC
Description of problem:
dwnlded  Vivaldi 1.4 64bit RPM
choose to open with yumex
installed 
first open produced alert

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 43 Andrej Šišila 2016-09-14 12:23:58 UTC
Description of problem:
I just opened Google Chrome

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 44 Torgny Bjers 2016-09-14 14:10:57 UTC
Description of problem:
Logged into machine after it was powered off.

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 45 scotmotox 2016-09-14 15:44:33 UTC
Description of problem:
After installing google chrome the error comes up every so often.

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 46 czman11 2016-09-14 16:32:31 UTC
Description of problem:
opened chrome browser

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 47 Paul Moore 2016-09-14 19:07:36 UTC
FYI, we need to backport this policy fix to systems running kernel v4.7 or higher.

Comment 48 Csaba 2016-09-14 19:24:36 UTC
Description of problem:
I have a google account attached to google chrome and it automatically logs in at each chrome start.

1. Open google chrome.
2. Reboot.
3. Open google chrome again.

Chrome doesn't complain but SElinux does.

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 49 bkleszyk 2016-09-14 22:35:53 UTC
Description of problem:
Was just using chrome with a couple of tabs open.

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 50 Lukas Vrabec 2016-09-15 12:06:18 UTC
This issue is dontaudited in all supported Fedoras (23,24,25,Rawhide.)
Fix will be part of new updates.

Comment 51 Andrej Šišila 2016-09-15 15:58:05 UTC
Description of problem:
Error occured right after opening Google Chrome.

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.3-200.fc24.x86_64
type:           libreport

Comment 52 Dario Castellarin 2016-09-15 21:13:31 UTC
Description of problem:
Happens every time I open Google Chrome

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.3-200.fc24.x86_64
type:           libreport

Comment 53 xzj8b3 2016-09-15 22:01:36 UTC
Exactly the problem occurs every time you open the last stable kernel as well as with 4.7.3 relace Chrome-200. x86_64 fc24 rack-.

Comment 54 vikram goyal 2016-09-16 08:13:47 UTC
Description of problem:

This has been happening for some time now.
I was thinkning that it will resolve after some updates but it seems that it needs to be reported.
Sorry for the noise if it's unrelated or not a bug. Thanks.

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.3-200.fc24.x86_64
type:           libreport

Comment 55 Laurent Rineau 2016-09-16 10:19:19 UTC
Description of problem:
I just launched Google Chrome.

I know Google Chrome is not part of Fedora, and is not a FLOSS either. But audit2allow suggests:

  allow unconfined_t self:file create;

and that is strange. I do not know well SELinux but it seems that chrome, even being unconfined_t, cannot create a file. It that the correct interpretation?

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.3-200.fc24.x86_64
type:           libreport

Comment 56 Laurent Rineau 2016-09-16 10:23:53 UTC
There are so many reports from F24 (including mine), that I think the bug must be reopened against F24.

I would have preferred to open a new one, but setroubleshoot consider this bug as a duplicate, even if its resolution is RAWHIDE. So let's reopen this bug, and target it to F24.

Comment 57 Lukas Vrabec 2016-09-16 10:51:14 UTC
Please leave it reported on Rawhide. For F24 we have another BZ. 
Update with fix for this issue is in fedora-testing repos.

https://bodhi.fedoraproject.org/updates/FEDORA-2016-fe39b806b6

Comment 58 ARIKO 2016-09-16 15:50:24 UTC
Description of problem:
juste launching google chrome, not first time...

maybe after update... look like it wants to access and create files withour permissions


should we trust google ?


Regarde Arikomagik

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 59 Saurabh Sharma 2016-09-16 18:20:07 UTC
Description of problem:
When I open Google Chrome Application then this message is displayed via SELinux.

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.3-200.fc24.x86_64
type:           libreport

Comment 60 sam.schmalzried 2016-09-16 19:36:30 UTC
Description of problem:
Using XFCE on Fedora 24, Google Chrome throws an SELinux access error.  This occurs when Chrome is opened from the Applications menu or when it is opened with a keyboard shortcut (Super + b).
This seems to be a error caused by the application itself, not by how it is opened.

Although instructions are provided on how to resolve this temporarily, I am unsure of the root cause and don't know how to resolve it more permanently.

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.3-200.fc24.x86_64
type:           libreport

Comment 61 Jean-Christophe Baptiste 2016-09-16 21:06:49 UTC
I also had this issue, and I can confirm that the update from testing solves it.

Thanks !

Comment 62 NoIsE 2016-09-17 07:10:34 UTC
Description of problem:
avvio google-chrome

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 63 pjhavariotis 2016-09-17 07:14:19 UTC
Description of problem:
This problem is happening after starting the latest version of Google Chrome (53.0.2785.116)


Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.3-200.fc24.x86_64
type:           libreport

Comment 64 phil 2016-09-17 07:22:06 UTC
Description of problem:
start chrome

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.3-200.fc24.x86_64
type:           libreport

Comment 65 seracon 2016-09-17 10:31:52 UTC
Description of problem:
Each time you start the Google Chrome browser gives me this error in Fedora 24 - 64 bits

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 66 Zdenek Chmelar 2016-09-17 22:23:33 UTC
Description of problem:
Started Chrome

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.3-200.fc24.x86_64
type:           libreport

Comment 67 Raffaello Bertini 2016-09-18 01:13:15 UTC
Description of problem:
starting chrome

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.3-200.fc24.x86_64
type:           libreport

Comment 68 shameek bhattacharya 2016-09-18 15:07:10 UTC
Description of problem:
I frist did a fresh install of fedora 
then ran dnf distro-sync 
then downloaded google-chrome rpm file the google's site 
then installed rpm using gnome software center 
then launched the program and the bug report got generated 

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.3-200.fc24.x86_64
type:           libreport

Comment 69 Edward 2016-09-18 16:14:21 UTC
Description of problem:
Launched Google Chrome.

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.3-200.fc24.x86_64
type:           libreport

Comment 70 Anass Ahmed 2016-09-18 22:11:50 UTC
Description of problem:
Just opened a new terminal with zsh (Terminix Quake mode to be specific), but the issue is happening with bash, so I don't know what really happened.


Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.2-201.fc24.x86_64
type:           libreport

Comment 71 Anass Ahmed 2016-09-18 22:36:05 UTC
Oh, I see it now, it happened with the command `screenfetch` which I use in my ~/.zshrc.

Comment 72 John Millner 2016-09-19 14:05:15 UTC
Description of problem:
Errors occurs on startup of Google Chrome consistantly. 

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.3-200.fc24.x86_64
type:           libreport

Comment 73 Anshuman Shukla 2016-09-20 16:43:33 UTC
Description of problem:
Launch google chrome (current version 53.0.2785.116 (64-bit))

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.3-200.fc24.x86_64
type:           libreport

Comment 74 Julien Vantyghem 2016-09-20 19:37:19 UTC
Description of problem:
On opening Google Chrome right after starting up Fedora, I get this SELinux Alert. I haven't had any usability problem following the alert.

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.3-200.fc24.x86_64
type:           libreport

Comment 75 Joshua Ward 2016-09-20 23:24:47 UTC
+1 To this happening with me:

SELinux is preventing google-chrome-s from create access on the file 63.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that google-chrome-s should be allowed create access on the 63 file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'google-chrome-s' --raw | audit2allow -M my-googlechromes
# semodule -X 300 -i my-googlechromes.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Target Context                unconfined_u:object_r:unconfined_t:s0
Target Objects                63 [ file ]
Source                        google-chrome-s
Source Path                   google-chrome-s
Port                          <Unknown>
Host                          eldenador.giftdigital
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-191.14.fc24.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     eldenador.giftdigital
Platform                      Linux eldenador.giftdigital 4.7.3-200.fc24.x86_64
                              #1 SMP Wed Sep 7 17:31:21 UTC 2016 x86_64 x86_64
Alert Count                   1
First Seen                    2016-09-21 09:15:56 AEST
Last Seen                     2016-09-21 09:15:56 AEST
Local ID                      b706b9dd-148b-47ed-8fe9-bbfa5ec62be9

Raw Audit Messages
type=AVC msg=audit(1474413356.348:205): avc:  denied  { create } for  pid=2245 comm="google-chrome-s" name="63" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:unconfined_t:s0 tclass=file permissive=0


Hash: google-chrome-s,unconfined_t,unconfined_t,file,create

Comment 76 IPl 2016-09-21 17:44:00 UTC
Description of problem:
Every start Google-chrome

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.3-200.fc24.x86_64
type:           libreport

Comment 77 Jonathan Haas 2016-09-22 12:42:41 UTC
Description of problem:
Starting google-chrome

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.3-200.fc24.x86_64
type:           libreport

Comment 78 egexe9 2016-09-26 13:24:41 UTC
Description of problem:
It happened while using chrome to watch videos

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.3-200.fc24.x86_64
type:           libreport

Comment 79 Jesse Barnes 2017-01-09 16:35:06 UTC
Description of problem:
started chrome after a power failure

Version-Release number of selected component:
selinux-policy-3.13.1-191.14.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.7.3-200.fc24.x86_64
type:           libreport


Note You need to log in before you can comment on or make changes to this bug.