I keep getting the following error ever since upgrading to Chrome google-chrome-stable-42.0.2311.90-1.x86_64
.
SELinux is preventing /opt/google/chrome/chrome-sandbox from write
access on the file .
I have not installed any custom plugins or modified my Chrome settings. Various search on Google turns up bug reports being closed as not a bug, and instructions on how to bypass SELinux by applying custom policy.
The SELinux troubleshooter suggested the following:
SELinux is preventing /opt/google/chrome/chrome-sandbox from write access on the file .
***** Plugin chrome (98.5 confidence) suggests ****************************
If you want to use the plugin package
Then you must turn off SELinux controls on the Chrome plugins.
Do
# setsebool -P unconfined_chrome_sandbox_transition 0
***** Plugin catchall (2.46 confidence) suggests **************************
If you believe that chrome-sandbox should be allowed write access on the file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep chrome-sandbox /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Additional Information:
Source Context unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c
0.c1023
Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
023
Target Objects [ file ]
Source chrome-sandbox
Source Path /opt/google/chrome/chrome-sandbox
Port <Unknown>
Host fqdn
Source RPM Packages google-chrome-stable-42.0.2311.90-1.x86_64
Target RPM Packages
Policy RPM selinux-policy-3.12.1-197.fc20.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name fqdn
Platform Linux fqdn 3.19.4-100.fc20.x86_64 #1 SMP
Mon Apr 13 21:46:59 UTC 2015 x86_64 x86_64
Alert Count 68
First Seen 2015-04-25 18:15:53
Last Seen 2015-04-30 20:51:59
Local ID ab14f
Raw Audit Messages
type=AVC msg=audit(123.456:300): avc: denied { write } for pid=3642 comm="chrome-sandbox" name="oom_adj" dev="proc" ino=52951 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=file permissive=0
type=SYSCALL msg=audit(123.456:300): arch=x86_64 syscall=openat success=no exit=EACCES a0=3 a1=402138 a2=1 a3=0 items=0 ppid=3480 pid=3642 auid=1000 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm=chrome-sandbox exe=/opt/google/chrome/chrome-sandbox subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 key=(null)
Hash: chrome-sandbox,chrome_sandbox_t,unconfined_t,file,write
I do not quite agree with the recommendation to turn off SELinux controls on Chrome Plugins. I also do not know what write access on file .
means. Is it current folder of chrome-sandbox? I tried searching for the inode 52591
, but could not find the file.
Can anyone explain what is the problem and how this issue can be resolved?
Best Answer
It is a regression (previously fixed bug that's come up again) in Chromium / Chrome. The Google developers seem to be in no hurry to fix it, or even acknowledge that it's their bug (sigh).
Current bug ID: https://code.google.com/p/chromium/issues/detail?id=477329
Original closed bug: https://code.google.com/p/chromium/issues/detail?id=41853