[SOLVED] SELinux sandbox problem with GUI app

_alex_ · 07-12-2019, 05:55 AM

Hello,

Newly registered to this forum although been using it for troubleshooting for quite some time.

I have an issue with the sandbox app from SELinux, when launching a command line app such as vim using command 'sandbox vim filename' vim launches in the command line, but when trying to launch a gui based app nothing launches.
I'm trying to launch firefox using command :
sandbox -X -H sandbox/ -T sandbox/tmp/ -t sandbox_web_t firefox

I'm on the latest version of CentOS 7.

Thanks in advance for your help.

Cheers,
Alex

dc.901 · 07-12-2019, 06:03 AM

You should look at /var/log/audit/audit.log
And, if you do not have it installed; I recommend installing package "setroubleshoot-server", then use "sealert" command.

_alex_ · 07-12-2019, 08:04 AM

I installed the package you mentioned but when running it, it says there are no alerts

in the audit log file I found the following:

type=ANOM_ABEND msg=audit(1562935893.182:430): auid=1000 uid=1000 gid=1000 ses=1 subj=unconfined_u:unconfined_r:sandbox_xserver_t:s0:c213,c232 pid=9879 comm="Xephyr" reason="memory violation" sig=6

found nothing much googling it :-/

dc.901 · 07-12-2019, 08:32 AM

Quote:

Originally Posted by _alex_

I installed the package you mentioned but when running it, it says there are no alerts

Is your /var/log/audit/audit.log file empty? If not, how did you run sealert?
You should have:

Code:

sealert -a /var/log/audit/audit.log | less

_alex_ · 07-12-2019, 02:04 PM

thanks dec901, you showed me the path to the solution

I do have entries in the audit log files, I was wrongly using sealert

running the command you provided, I followed the instructions proposed in the log to resolve the problem (create a policy module for Xephyr (nested X window in which firefox will be displayed) and activate it) :

Quote:

# ausearch -c 'Xephyr' --raw | audit2allow -M my-Xephyr
# semodule -i my-Xephyr.pp

I was able to launch firefox although you do feel functionalities are affected by the sandboxing

thanks again!