Add firefox file contexts for binary installations
PATCH 6/15 Add firefox file contexts for binary installations
Binary installations of firefox provide binaries in /opt/firefox by default.
Also, binary can be in /usr/bin (but most often this is a script that calls the binary in /opt/firefox). In both cases, this needs to be marked as mozilla_exec_t too.
--- policy/modules/apps/mozilla.fc | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-)
policy/modules/apps/mozilla.fc +10 -0
@@ -7,6 +7,7 @@ HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) # # /bin # +/usr/bin/firefox(-bin)? -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/bin/netscape -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/bin/mozilla -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/bin/mozilla-snapshot -- gen_context(system_u:object_r:mozilla_exec_t,s0)
@@ -27,3 +28,12 @@ HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) /usr/lib(64)?/[^/]*firefox[^/]*/firefox-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/lib/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/lib64/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0) + +# +# /opt +# +/opt/firefox/libxul\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/opt/firefox/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0) +/opt/firefox/run-mozilla\.sh -- gen_context(system_u:object_r:mozilla_exec_t,s0) +/opt/firefox/firefox-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0) +/opt/firefox/plugin-container -- gen_context(system_u:object_r:mozilla_exec_t,s0)
Signature · 1 line
1.7.3.4
PATCH 6/15 Add firefox file contexts for binary installations
Quoted 16 lines · Sven Vermeulen
Binary installations of firefox provide binaries in
/opt/firefoxby default.Also, binary can be in
/usr/bin(but most often this is a script that calls the binary in/opt/firefox). In both cases, this needs to be marked asmozilla_exec_ttoo.Signed-off-by Sven Vermeulen <[email protected]>--- policy/modules/apps/mozilla.fc | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-)policy/modules/apps/mozilla.fc +0
-0
policy/modules/apps/mozilla.fc HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) · line 10
Quoted 4 lines
policy/modules/apps/mozilla.fc +1
-0@@ -7,6 +7,7 @@ HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) # # /bin # +/usr/bin/firefox(-bin)? -- gen_context(system_u:object_r:mozilla_exec_t,s0)
I think the -bin would hardly get anywhere outside of the firefox directory (independently of where that is) unless one works very hard towards that.
Quoted 6 lines
policy/modules/apps/mozilla.fc +0
-0/usr/bin/netscape -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/bin/mozilla -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/bin/mozilla-snapshot -- gen_context(system_u:object_r:mozilla_exec_t,s0)@@ -27,3 +28,12 @@ HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) /usr/lib(64)?/[^/]*firefox[^/]*/firefox-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/lib/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0)
policy/modules/apps/mozilla.fc HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) · line 39
Quoted 10 lines
policy/modules/apps/mozilla.fc +9
-0/usr/lib64/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0) + +# +# /opt +# +/opt/firefox/libxul\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/opt/firefox/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0) +/opt/firefox/run-mozilla\.sh -- gen_context(system_u:object_r:mozilla_exec_t,s0) +/opt/firefox/firefox-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0) +/opt/firefox/plugin-container -- gen_context(system_u:object_r:mozilla_exec_t,s0)
The idea sounds desirable to me ! But apart from the second and the fourth elements, I had anything else labelled generically bin_t and lib_t and I wasn't experiencing problems...
Text relocations aren't that good (libxul.so) as far as I know. Is it not possible to get rid of them ? I think I could avoid that on a test system.
Regards,
Guido
PATCH 6/15 Add firefox file contexts for binary installations
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Quoted 38 lines · Guido Trentalancia
Quoted 16 lines · Sven Vermeulen
Binary installations of firefox provide binaries in
/opt/firefoxby default.Also, binary can be in
/usr/bin(but most often this is a script that calls the binary in/opt/firefox). In both cases, this needs to be marked asmozilla_exec_ttoo.Signed-off-by Sven Vermeulen <[email protected]>--- policy/modules/apps/mozilla.fc | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-)policy/modules/apps/mozilla.fc +0
-0policy/modules/apps/mozilla.fc HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) · line 10
Quoted 4 lines
policy/modules/apps/mozilla.fc +1
-0@@ -7,6 +7,7 @@ HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) # # /bin # +/usr/bin/firefox(-bin)? -- gen_context(system_u:object_r:mozilla_exec_t,s0)I think the -bin would hardly get anywhere outside of the firefox directory (independently of where that is) unless one works very hard towards that.
Quoted 12 lines
policy/modules/apps/mozilla.fc +5
-0/usr/bin/netscape -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/bin/mozilla -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/bin/mozilla-snapshot -- gen_context(system_u:object_r:mozilla_exec_t,s0)@@ -27,3 +28,12 @@ HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) /usr/lib(64)?/[^/]*firefox[^/]*/firefox-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/lib/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/lib64/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0) + +# +# /opt +# +/opt/firefox/libxul\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
Quoted 8 lines
policy/modules/apps/mozilla.fc HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) · line 39
Quoted 4 lines
policy/modules/apps/mozilla.fc +4
-0+/opt/firefox/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0) +/opt/firefox/run-mozilla\.sh -- gen_context(system_u:object_r:mozilla_exec_t,s0) +/opt/firefox/firefox-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0) +/opt/firefox/plugin-container -- gen_context(system_u:object_r:mozilla_exec_t,s0)The idea sounds desirable to me ! But apart from the second and the fourth elements, I had anything else labelled generically
bin_tandlib_tand I wasn't experiencing problems...
The textrel_shlib_t does not belong in mozillas file context file. I think its libraries.
Besides that i am unable to confirm the libxul needs text relocations on my f14 config i believe.
Quoted 4 lines
Text relocations aren't that good (libxul.so) as far as I know. Is it not possible to get rid of them ? I think I could avoid that on a test system.
Quoted 8 lines
Regards,
Guido
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk14i14ACgkQMlxVo39jgT/sXgCgryOkE7zDNz4k6Du3PvfBGG7D V2UAn1xsn+Va5rPuXWMPr65HXYw6kf5S
=2f4O
-----END PGP SIGNATURE-----
PATCH 6/15 Add firefox file contexts for binary installations
Quoted 48 lines · Dominick Grift
Quoted 38 lines · Guido Trentalancia
Quoted 16 lines · Sven Vermeulen
Binary installations of firefox provide binaries in
/opt/firefoxby default.Also, binary can be in
/usr/bin(but most often this is a script that calls the binary in/opt/firefox). In both cases, this needs to be marked asmozilla_exec_ttoo.Signed-off-by Sven Vermeulen <[email protected]>--- policy/modules/apps/mozilla.fc | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-)policy/modules/apps/mozilla.fc +0
-0policy/modules/apps/mozilla.fc HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) · line 10
Quoted 4 lines
policy/modules/apps/mozilla.fc +1
-0@@ -7,6 +7,7 @@ HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) # # /bin # +/usr/bin/firefox(-bin)? -- gen_context(system_u:object_r:mozilla_exec_t,s0)I think the -bin would hardly get anywhere outside of the firefox directory (independently of where that is) unless one works very hard towards that.
Quoted 12 lines
policy/modules/apps/mozilla.fc +5
-0/usr/bin/netscape -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/bin/mozilla -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/bin/mozilla-snapshot -- gen_context(system_u:object_r:mozilla_exec_t,s0)@@ -27,3 +28,12 @@ HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) /usr/lib(64)?/[^/]*firefox[^/]*/firefox-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/lib/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/lib64/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0) + +# +# /opt +# +/opt/firefox/libxul\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)Quoted 8 lines
policy/modules/apps/mozilla.fc HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) · line 39
Quoted 4 lines
policy/modules/apps/mozilla.fc +4
-0+/opt/firefox/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0) +/opt/firefox/run-mozilla\.sh -- gen_context(system_u:object_r:mozilla_exec_t,s0) +/opt/firefox/firefox-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0) +/opt/firefox/plugin-container -- gen_context(system_u:object_r:mozilla_exec_t,s0)The idea sounds desirable to me ! But apart from the second and the fourth elements, I had anything else labelled generically
bin_tandlib_tand I wasn't experiencing problems...
Quoted 2 lines
The
textrel_shlib_tdoes not belong in mozillas file context file. I think its libraries.
Yes, of course.
Quoted 6 lines
Besides that i am unable to confirm the libxul needs text relocations on my f14 config i believe.
Quoted 3 lines
Text relocations aren't that good (libxul.so) as far as I know. Is it not possible to get rid of them ? I think I could avoid that on a test system.
Plain F14 policy has text relocations for libxul.so but does that privately. Text relocations are bad if they can be avoided and usually that is the case. Now we have at least two confirmed cases that this is possible (me and you)...
Regards,
Guido
PATCH 6/15 Add firefox file contexts for binary installations
Quoted 4 lines · Guido Trentalancia
Plain F14 policy has text relocations for libxul.so but does that privately. Text relocations are bad if they can be avoided and usually that is the case. Now we have at least two confirmed cases that this is possible (me and you)...
I believe that the textrel_shlib_t is needed if you use the 32-bit binary distribution as offered by Mozilla (for firefox), not if it is built from source.
I'll build a firefox here and give feedback.
In any case, you're correct in that textrel_shlib_t contexts should be considered in the libraries.fc one instead. But I'll first see if I can confirm if it is always necessary or only in particular situations.
Wkr,
Sven Vermeulen
PATCH 6/15 Add firefox file contexts for binary installations
Quoted 5 lines · Sven Vermeulen
I believe that the
textrel_shlib_tis needed if you use the 32-bit binary distribution as offered by Mozilla (for firefox), not if it is built from source.I'll build a firefox here and give feedback.
Indeed, using a self-built firefox rather than the distributed binaries requires no textrel_shlib_t on the libxul.so file (or any other related one).
Wkr,
Sven Vermeulen
PATCH 6/15 Add firefox file contexts for binary installations
Quoted 10 lines · Sven Vermeulen
Quoted 5 lines · Sven Vermeulen
I believe that the
textrel_shlib_tis needed if you use the 32-bit binary distribution as offered by Mozilla (for firefox), not if it is built from source.I'll build a firefox here and give feedback.
Indeed, using a self-built firefox rather than the distributed binaries requires no
textrel_shlib_ton the libxul.so file (or any other related one).
But the idea that a user gets fed up (for whatever reason) of the version of firefox distributed with the distribution and wants to install the mozilla.org binaries is very good. In that view is very much desirable that a distribution is ready to accomodate that case for what is probably the number 1 graphical application.
So, I would suggest to feedback to mozilla.org and then keep part of that patch.
Regards,
Guido
PATCH 6/15 Add firefox file contexts for binary installations
In reply to Sven VermeulenQuoted 9 lines · Sven Vermeulen
Quoted 4 lines · Guido Trentalancia
Plain F14 policy has text relocations for libxul.so but does that privately. Text relocations are bad if they can be avoided and usually that is the case. Now we have at least two confirmed cases that this is possible (me and you)...
I believe that the
textrel_shlib_tis needed if you use the 32-bit binary distribution as offered by Mozilla (for firefox), not if it is built from source.
Perhaps someone could drop a note to mozilla.org ? When I build it, I don't even need to pass the -fPIC flag and it does not require text relocations...
Quoted 13 lines
I'll build a firefox here and give feedback.
In any case, you're correct in that
textrel_shlib_tcontexts should be considered in the libraries.fc one instead. But I'll first see if I can confirm if it is always necessary or only in particular situations.Wkr,
Sven Vermeulen
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
PATCH 6/15 Add firefox file contexts for binary installations
In reply to Sven VermeulenQuoted 5 lines · Sven Vermeulen
Binary installations of firefox provide binaries in
/opt/firefoxby default.Also, binary can be in
/usr/bin(but most often this is a script that calls the binary in/opt/firefox). In both cases, this needs to be marked asmozilla_exec_ttoo.
I suspect that these are Gentoo-specific. If so, they should be in distro_gentoo blocks.
Quoted 30 lines
Signed-off-by Sven Vermeulen <[email protected]>--- policy/modules/apps/mozilla.fc | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-)policy/modules/apps/mozilla.fc +10
-0@@ -7,6 +7,7 @@ HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) # # /bin # +/usr/bin/firefox(-bin)? -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/bin/netscape -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/bin/mozilla -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/bin/mozilla-snapshot -- gen_context(system_u:object_r:mozilla_exec_t,s0)@@ -27,3 +28,12 @@ HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) /usr/lib(64)?/[^/]*firefox[^/]*/firefox-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/lib/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/lib64/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0) + +# +# /opt +# +/opt/firefox/libxul\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/opt/firefox/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0) +/opt/firefox/run-mozilla\.sh -- gen_context(system_u:object_r:mozilla_exec_t,s0) +/opt/firefox/firefox-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0) +/opt/firefox/plugin-container -- gen_context(system_u:object_r:mozilla_exec_t,s0)
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com