5

I keep getting the following error ever since upgrading to Chrome google-chrome-stable-42.0.2311.90-1.x86_64.

SELinux is preventing /opt/google/chrome/chrome-sandbox from write access on the file .

I have not installed any custom plugins or modified my Chrome settings. Various search on Google turns up bug reports being closed as not a bug, and instructions on how to bypass SELinux by applying custom policy.

The SELinux troubleshooter suggested the following:

SELinux is preventing /opt/google/chrome/chrome-sandbox from write access on the file .

*****  Plugin chrome (98.5 confidence) suggests   ****************************

If you want to use the plugin package
Then you must turn off SELinux controls on the Chrome plugins.
Do
# setsebool -P unconfined_chrome_sandbox_transition 0

*****  Plugin catchall (2.46 confidence) suggests   **************************

If you believe that chrome-sandbox should be allowed write access on the  file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep chrome-sandbox /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp


Additional Information:
Source Context                unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c
                              0.c1023
Target Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Target Objects                 [ file ]
Source                        chrome-sandbox
Source Path                   /opt/google/chrome/chrome-sandbox
Port                          <Unknown>
Host                          fqdn
Source RPM Packages           google-chrome-stable-42.0.2311.90-1.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-197.fc20.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     fqdn
Platform                      Linux fqdn 3.19.4-100.fc20.x86_64 #1 SMP
                              Mon Apr 13 21:46:59 UTC 2015 x86_64 x86_64
Alert Count                   68
First Seen                    2015-04-25 18:15:53
Last Seen                     2015-04-30 20:51:59
Local ID                      ab14f

Raw Audit Messages
type=AVC msg=audit(123.456:300): avc:  denied  { write } for  pid=3642 comm="chrome-sandbox" name="oom_adj" dev="proc" ino=52951 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=file permissive=0


type=SYSCALL msg=audit(123.456:300): arch=x86_64 syscall=openat success=no exit=EACCES a0=3 a1=402138 a2=1 a3=0 items=0 ppid=3480 pid=3642 auid=1000 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm=chrome-sandbox exe=/opt/google/chrome/chrome-sandbox subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 key=(null)

Hash: chrome-sandbox,chrome_sandbox_t,unconfined_t,file,write

I do not quite agree with the recommendation to turn off SELinux controls on Chrome Plugins. I also do not know what write access on file . means. Is it current folder of chrome-sandbox? I tried searching for the inode 52591, but could not find the file.

Can anyone explain what is the problem and how this issue can be resolved?

0

It is a regression (previously fixed bug that's come up again) in Chromium / Chrome. The Google developers seem to be in no hurry to fix it, or even acknowledge that it's their bug (sigh).

Current bug ID: https://code.google.com/p/chromium/issues/detail?id=477329

Original closed bug: https://code.google.com/p/chromium/issues/detail?id=41853

  • The bugs describe error with "'write' accesses on the file oom_score_adj.". I don't see clearly how it relates to OP's issue. – sebasth Oct 29 at 18:10
-1
$ grep chrome /var/log/audit/audit.log | audit2allow -M mypol
$ semodule -i mypol.pp
  • 2
    Welcome to U&L SE. Don't just enter command, also tell how this command will work to solve the issue. – Tejas Sep 7 '15 at 4:54
  • The question is not about how to add allow rule, the original error message even already suggests setsebool -P unconfined_chrome_sandbox_transition 0 to enable allow rules. – sebasth Oct 29 at 18:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.