SELinux ate my bookmarks in F9

[Michael Wiktowy]

Hello,

I triggered a Wine app to open up a URL link and Firefox opened up and
things went downhill from there. I'm guessing that Wine somehow
corrupted all the contexts of the Firefox bookmark/places/etc. storage
files and now SELinux is preventing any of them from being accessed
... even after opening up Firefox normally.

Here is an example of the error output by setroubleshoot (but they
just keep coming for various Firefox related Target Objects every 10
seconds or so ... on opening Firefox, about 40 are generated
immediately):

Summary:

SELinux is preventing firefox from creating a file with a context of unlabeled_t
on a filesystem.

Detailed Description:

SELinux is preventing firefox from creating a file with a context of unlabeled_t
on a filesystem. Usually this happens when you ask the cp command to maintain
the context of a file when copying between file systems, "cp -a" for example.
Not all file contexts should be maintained between the file systems. For
example, a read-only file type like iso9660_t should not be placed on a r/w
system. "cp -P" might be a better solution, as this will adopt the default file
context for the destination.

Allowing Access:

Use a command like "cp -P" to preserve all permissions except SELinux context.

Additional Information:

Source Context                unconfined_u:object_r:unlabeled_t
Target Context                system_u:object_r:fs_t
Target Objects                bookmarks-2008-05-22.json [ filesystem ]
Source                        firefox
Source Path                   /usr/lib/firefox-3.0b5/firefox
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           firefox-3.0-0.60.beta5.fc9
Target RPM Packages
Policy RPM                    selinux-policy-3.3.1-51.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   filesystem_associate
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain 2.6.25.3-18.fc9.i686
                              #1 SMP Tue May 13 05:38:53 EDT 2008 i686 athlon
Alert Count                   6
First Seen                    Thu 22 May 2008 08:07:34 PM EDT
Last Seen                     Thu 22 May 2008 08:09:49 PM EDT
Local ID                      d083caff-a8e7-4588-b913-798c14cefdac
Line Numbers

Raw Audit Messages

host=localhost.localdomain type=AVC msg=audit(1211501389.186:114):
avc:  denied  { associate } for  pid=3676 comm="firefox"
name="bookmarks-2008-05-22.json"
scontext=unconfined_u:object_r:unlabeled_t:s0
tcontext=system_u:object_r:fs_t:s0 tclass=filesystem

host=localhost.localdomain type=SYSCALL msg=audit(1211501389.186:114):
arch=40000003 syscall=5 success=no exit=-13 a0=ae38748 a1=82c1 a2=180
a3=82c1 items=0 ppid=3662 pid=3676 auid=500 uid=500 gid=500 euid=500
suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1
comm="firefox" exe="/usr/lib/firefox-3.0b5/firefox"
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)

I suspect a 'touch /.autorelabel; reboot' will fix this but I would
also suspect that it will just happen again as soon as Wine triggers
another URL loading.

I will try to pack some more info into a bugzilla (if there is not
already one) but I figured I would give the SELinux gurus a heads up
since I haven't seen this issue raised yet.

/Mike