SELinux stops Google Chrome from executing

Question

I can no longer start Google Chrome on Fedora 14 (using GNOME).

strace

strace google-chrome
...
readlink("/proc/self/exe", "/opt/google/chrome/chrome"..., 4096) = 25
socketpair(PF_FILE, SOCK_SEQPACKET, 0, [11, 12]) = 0
stat64("/opt/google/chrome/chrome-sandbox", {st_mode=S_IFREG|S_ISUID|0755, st_size=14008, ...}) = 0
access("/opt/google/chrome/chrome-sandbox", X_OK) = 0
socket(PF_FILE, SOCK_DGRAM, 0)          = 13
clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb452fae8) = 21093
recvmsg(11, 0xbfc79ac8, 0)              = ? ERESTARTSYS (To be restarted)
--- {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=21093, si_status=0, si_utime=0, si_stime=0} (Child exited) ---
sigreturn()                             = ? (mask now [])
recvmsg(11, /opt/google/chrome/chrome: error while loading shared libraries: cannot restore segment prot after reloc: Permission denied

logs

fgrep -i chrome /var/log/messages
Sep 17 20:37:08 a kernel: [ 2084.648737] type=1400 audit(1316284628.960:21895): avc:  denied  { execmod } for  pid=20664 comm="chrome" path="/opt/google/chrome/chrome" dev=dm-1 ino=3147775 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=system_u:object_r:execmem_exec_t:s0 tclass=file
Sep 17 20:46:25 a kernel: [ 2641.204736] type=1400 audit(1316285185.516:21896): avc:  denied  { execmod } for  pid=21057 comm="chrome" path="/opt/google/chrome/chrome" dev=dm-1 ino=3147775 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=system_u:object_r:execmem_exec_t:s0 tclass=file
Sep 17 20:46:33 a kernel: [ 2649.438209] type=1400 audit(1316285193.749:21897): avc:  denied  { execmod } for  pid=21069 comm="chrome" path="/opt/google/chrome/chrome" dev=dm-1 ino=3147775 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=system_u:object_r:execmem_exec_t:s0 tclass=file
Sep 17 20:46:39 a kernel: [ 2655.533882] type=1400 audit(1316285199.845:21898): avc:  denied  { execmod } for  pid=21094 comm="chrome" path="/opt/google/chrome/chrome" dev=dm-1 ino=3147775 scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=system_u:object_r:execmem_exec_t:s0 tclass=file

info about system

# lsb_release -a
LSB Version:    :core-4.0-ia32:core-4.0-noarch
Distributor ID: Fedora
Description:    Fedora release 14 (Laughlin)
Release:    14
Codename:   Laughlin
# uname -a
Linux a 2.6.35.14-96.fc14.i686.PAE #1 SMP Thu Sep 1 12:31:46 UTC 2011 i686 i686 i386 GNU/Linux

package info

rpm -qa | fgrep google-chrome-stable
google-chrome-stable-14.0.835.163-101024.i386

I suspect that the issue is being caused by SELinux. How can I make it so that SELinux allows Google Chrome to start without issue?

Solution 1

# solution /use it with root/:
semanage fcontext -a  -s system_u  -t usr_t /opt/google/chrome/chrome-sandbox
restorecon -v /opt/google/chrome/chrome-sandbox

http://code.google.com/p/chromium/issues/detail?id=87704

Solution 2

An autorelabel could help. You'll need to do the following:

As a user:

$ restorecon -R -v -F ~

And as root:

# touch /.autorelabel

then reboot

Comments

[LanceBaynes]

good idea, but it still gives:

[LanceBaynes]

pastebin.com/raw.php?i=yf3V13aR