1 p.m.
I've got a Fedora 20 XFCE desktop. I installed google-chrome.
It fails to display some text on many web sites if selinux is
set to enforcing, but shows the text with selinux set to permissive.
For example, with selinux set to enforcing, my web site:
http://www.DaleDellutri.com
only shows the icon image in the upper left corner, an empty box,
and the bluish outer color, but does not show any of the text on
the page. If I do
# setenforce 0
and re-start google-chrome, then the page is displayed properly.
Firefox shows the page properly no matter how selinux is set.
With selinux enforcing, when I start google-chrome from
the command line, it does not provide any error messages, and I
don't see any error messages from selinux.
Where are the selinux logs? I've used
# journalctl | grep -i selinux
but there are no errors or warnings.
What could cause this problem?
Do you have any suggestions for debugging?
--
Dale Dellutri
2:53 p.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 02/27/2014 02:38 PM, Ed K. wrote:
On Thu, 27 Feb 2014, Dale Dellutri wrote:
>> On 02/27/14 05:50, Dale Dellutri wrote:
>>> I did this and set selinux back to enforcing. google-chrome is now
>>> working as it should.
>>
>> Good to see it is OK now. FWIW, I have a fully updated F20 system.
>> I'm using KDE and google chrome and I am not seeing any problems when I
>> visit your website.
>
> Yes, it's fixed now. The original problem occurred because I added a
> directory of private fonts to /usr/share/fonts/, but I did not adjust
> the selinux context for that directory. The ausearch suggested by Daniel
> Walsh discovered the problem.
>
> I really must learn more about the care and feeding of selinux if I'm
> going to use it.
>
Dale, I've been having the same problem. But with $HOME/.fonts
What chcon command did you use to permit chrome to read the fonts
directory?
ed
Should be allowed, restorecon -R -v ~/
Should fix any labels.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlMPpd0ACgkQrlYvE4MpobOIGgCeLalpj8AmzDHNVeAzWqbmV3ZX
lP0AmgIuaUZRFHGyo2Ji7c4Ozv212QOE
=Ych2
-----END PGP SIGNATURE-----
1:50 p.m.
On Thu, Feb 27, 2014 at 1:38 PM, Ed K. <ed(a)atl.org> wrote:
On Thu, 27 Feb 2014, Dale Dellutri wrote:
>> On 02/27/14 05:50, Dale Dellutri wrote:
>>>
>>> I did this and set selinux back to enforcing. google-chrome
>>> is now working as it should.
>>
>>
>> Good to see it is OK now. FWIW, I have a fully updated F20 system. I'm
>> using KDE and google chrome and I am not seeing any problems when I visit
>> your website.
>
>
> Yes, it's fixed now. The original problem occurred because I added a
> directory
> of private fonts to /usr/share/fonts/, but I did not adjust the
> selinux context for
> that directory. The ausearch suggested by Daniel Walsh discovered the
> problem.
>
> I really must learn more about the care and feeding of selinux if I'm
> going to
> use it.
>
Dale, I've been having the same problem. But with $HOME/.fonts
What chcon command did you use to permit chrome to read the fonts directory?
I didn't use chcon. Instead I followed the suggestions of Daniel Walsh
(look upthread):
=====
Are you seeing any AVCs?
ausearch -m avc -ts recent
You can turn off SELinux confinement of chrome sandbox, with
setsebool -P unconfined_chrome_sandbox_transition=0
=====
It's that second command, setsebool, that did it.
Curiously, I realized that I did not have this problem on an earlier
desktop setup even though I did add that directory of fonts in /usr/share/fonts.
It didn't cause a problem in that case because I had the selinux-policy
bug (see: https://fedoraproject.org/wiki/Common_F20_bugs#rpm-scriptlets-fail)
and I applied the workaround which re-adjusted the selinux policies of the
entire system (including the new directory in /usr/share/fonts). But I
don't know what selinux command was run. It was embedded in the update.
Like I said, I really need to learn the care and feeding of selinux if
I'm going to use it.
My advice to you is to google something like "relabel selinux policy".
If you do find the right command to apply to $HOME/.fonts, please
post here.
ed
--
users mailing list
users(a)lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org
--
Dale Dellutri
1:38 p.m.
On Thu, 27 Feb 2014, Dale Dellutri wrote:
> On 02/27/14 05:50, Dale Dellutri wrote:
>> I did this and set selinux back to enforcing. google-chrome
>> is now working as it should.
>
> Good to see it is OK now. FWIW, I have a fully updated F20 system. I'm using
KDE and google chrome and I am not seeing any problems when I visit your website.
Yes, it's fixed now. The original problem occurred because I added a directory
of private fonts to /usr/share/fonts/, but I did not adjust the
selinux context for
that directory. The ausearch suggested by Daniel Walsh discovered the problem.
I really must learn more about the care and feeding of selinux if I'm going to
use it.
Dale, I've been having the same problem. But with $HOME/.fonts
What chcon command did you use to permit chrome to read the fonts
directory?
ed
11:07 a.m.
On Thu, Feb 27, 2014 at 11:01 AM, poma <pomidorabelisima(a)gmail.com> wrote:
On 27.02.2014 17:42, Klaus-Peter Schrage wrote:
> Am 27.02.2014 16:41, schrieb Dale Dellutri:
>> On Wed, Feb 26, 2014 at 4:34 PM, Ed Greshko <ed.greshko(a)greshko.com>
wrote:
>>>
>>> -----BEGIN PGP SIGNED MESSAGE-----
>>> Hash: SHA1
>>>
>>> On 02/27/14 05:50, Dale Dellutri wrote:
>>>> I did this and set selinux back to enforcing. google-chrome
>>>> is now working as it should.
>>>
>>> Good to see it is OK now. FWIW, I have a fully updated F20 system. I'm
using KDE and google chrome and I am not seeing any problems when I visit your website.
>>
>> Yes, it's fixed now.
>
> Be honest! You just wanted to advertise your nice web site ;-)
No, I wanted to give an example of a very simple site which failed to load
properly.
Dale is busted! :)
Just she is neither the first nor the last one to use the list for that.
He, not she.
Ha.
poma
--
Dale Dellutri
11:01 a.m.
On 27.02.2014 17:42, Klaus-Peter Schrage wrote:
Am 27.02.2014 16:41, schrieb Dale Dellutri:
> On Wed, Feb 26, 2014 at 4:34 PM, Ed Greshko <ed.greshko(a)greshko.com> wrote:
>>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> On 02/27/14 05:50, Dale Dellutri wrote:
>>> I did this and set selinux back to enforcing. google-chrome
>>> is now working as it should.
>>
>> Good to see it is OK now. FWIW, I have a fully updated F20 system. I'm
using KDE and google chrome and I am not seeing any problems when I visit your website.
>
> Yes, it's fixed now.
Be honest! You just wanted to advertise your nice web site ;-)
Dale is busted! :)
Just she is neither the first nor the last one to use the list for that.
Ha.
poma
10:42 a.m.
Am 27.02.2014 16:41, schrieb Dale Dellutri:
On Wed, Feb 26, 2014 at 4:34 PM, Ed Greshko
<ed.greshko(a)greshko.com> wrote:
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 02/27/14 05:50, Dale Dellutri wrote:
>> I did this and set selinux back to enforcing. google-chrome
>> is now working as it should.
>
> Good to see it is OK now. FWIW, I have a fully updated F20 system. I'm using
KDE and google chrome and I am not seeing any problems when I visit your website.
Yes, it's fixed now.
Be honest! You just wanted to advertise your nice web site ;-)
Cheers
Klaus
www.schragehome.de/
9:41 a.m.
On Wed, Feb 26, 2014 at 4:34 PM, Ed Greshko <ed.greshko(a)greshko.com> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 02/27/14 05:50, Dale Dellutri wrote:
> I did this and set selinux back to enforcing. google-chrome
> is now working as it should.
Good to see it is OK now. FWIW, I have a fully updated F20 system. I'm using KDE
and google chrome and I am not seeing any problems when I visit your website.
Yes, it's fixed now. The original problem occurred because I added a directory
of private fonts to /usr/share/fonts/, but I did not adjust the
selinux context for
that directory. The ausearch suggested by Daniel Walsh discovered the problem.
I really must learn more about the care and feeding of selinux if I'm going to
use it.
--
Dale Dellutri
3:18 p.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 02/26/2014 02:00 PM, Dale Dellutri wrote:
I've got a Fedora 20 XFCE desktop. I installed google-chrome. It
fails to
display some text on many web sites if selinux is set to enforcing, but
shows the text with selinux set to permissive.
For example, with selinux set to enforcing, my web site:
http://www.DaleDellutri.com only shows the icon image in the upper left
corner, an empty box, and the bluish outer color, but does not show any of
the text on the page. If I do # setenforce 0 and re-start google-chrome,
then the page is displayed properly.
Firefox shows the page properly no matter how selinux is set.
With selinux enforcing, when I start google-chrome from the command line,
it does not provide any error messages, and I don't see any error messages
from selinux.
Where are the selinux logs? I've used # journalctl | grep -i selinux but
there are no errors or warnings.
What could cause this problem?
Do you have any suggestions for debugging?
-- Dale Dellutri
Are you seeing any AVCs?
ausearch -m avc -ts recent
You can turn off SELinux confinement of chrome sandbox, with
setsebool -P unconfined_chrome_sandbox_transition=0
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlMOWjcACgkQrlYvE4MpobNTaQCdElyQpDTq4A2Ylz4NixKXV8OS
gZAAn2PA9exYIGt/v4cvNsLq9za5cQUE
=QI7q
-----END PGP SIGNATURE-----
4:34 p.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 02/27/14 05:50, Dale Dellutri wrote:
I did this and set selinux back to enforcing. google-chrome
is now working as it should.
Good to see it is OK now. FWIW, I have a fully updated F20 system. I'm using KDE and
google chrome and I am not seeing any problems when I visit your website.
- --
Getting tired of non-Fedora discussions and self-serving posts
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAlMOa+UACgkQ4JnKjVbCBvqu0gCfSeuKfurrQDwfwM7fe3FUhbTj
xbQAn3a+NgAr6uVHAChoQchAwSwBFLm1
=LNIX
-----END PGP SIGNATURE-----
3:50 p.m.
On Wed, Feb 26, 2014 at 3:18 PM, Daniel J Walsh <dwalsh(a)redhat.com> wrote:
--
Dale Dellutri
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 02/26/2014 02:00 PM, Dale Dellutri wrote:
> I've got a Fedora 20 XFCE desktop. I installed google-chrome. It fails to
> display some text on many web sites if selinux is set to enforcing, but
> shows the text with selinux set to permissive.
>
> For example, with selinux set to enforcing, my web site:
> http://www.DaleDellutri.com only shows the icon image in the upper left
> corner, an empty box, and the bluish outer color, but does not show any of
> the text on the page. If I do # setenforce 0 and re-start google-chrome,
> then the page is displayed properly.
>
> Firefox shows the page properly no matter how selinux is set.
>
> With selinux enforcing, when I start google-chrome from the command line,
> it does not provide any error messages, and I don't see any error messages
> from selinux.
>
> Where are the selinux logs? I've used # journalctl | grep -i selinux but
> there are no errors or warnings.
>
> What could cause this problem?
>
> Do you have any suggestions for debugging?
>
> -- Dale Dellutri
>
>
Are you seeing any AVCs?
ausearch -m avc -ts recent
Yes, though I did:
ausearch -m avc -ts today
since these failures had happened more than ten minutes ago.
You can turn off SELinux confinement of chrome sandbox, with
setsebool -P unconfined_chrome_sandbox_transition=0
I did this and set selinux back to enforcing. google-chrome
is now working as it should.
Thanks for this info. Where could I read more about the
"chrome sandbox"?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlMOWjcACgkQrlYvE4MpobNTaQCdElyQpDTq4A2Ylz4NixKXV8OS
gZAAn2PA9exYIGt/v4cvNsLq9za5cQUE
=QI7q
-----END PGP SIGNATURE-----
--
users mailing list
users(a)lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org
3721
days inactive
3722
days old
10 comments
6 participants
participants (6)
-
Dale Dellutri -
Daniel J Walsh -
Ed Greshko -
Ed K. -
Klaus-Peter Schrage -
poma