Bug 634556 – missing "map" permissions for mozilla

• Status: RESOLVED FIXED
• Product: Gentoo Linux

[Description Amadeusz Sławiński 2017-10-17 16:57:25 UTC]

seems like firefox tries to map files in ~/.fonts if present

[  156.790453] audit: type=1400 audit(1508258300.732:1650): avc:  denied  { map } for  pid=3549 comm=57656220436F6E74656E74 path="/home/amade/.fonts/fonts.dir" dev="dm-0" ino=13376471 scontext=staff_u:staff_r:mozilla_t tcontext=staff_u:object_r:user_fonts_t tclass=file permissive=0
[  156.790512] audit: type=1400 audit(1508258300.732:1651): avc:  denied  { map } for  pid=3549 comm=57656220436F6E74656E74 path="/home/amade/.fonts/unifont-9.0.06.ttf" dev="dm-0" ino=13376470 scontext=staff_u:staff_r:mozilla_t tcontext=staff_u:object_r:user_fonts_t tclass=file permissive=0
[  159.993298] audit: type=1400 audit(1508258303.935:1657): avc:  denied  { map } for  pid=3609 comm=57656220436F6E74656E74 path="/home/amade/.fonts/fonts.dir" dev="dm-0" ino=13376471 scontext=staff_u:staff_r:mozilla_t tcontext=staff_u:object_r:user_fonts_t tclass=file permissive=0
[  175.939426] audit: type=1400 audit(1508258319.881:1665): avc:  denied  { map } for  pid=3650 comm=57656220436F6E74656E74 path="/home/amade/.fonts/fonts.dir" dev="dm-0" ino=13376471 scontext=staff_u:staff_r:mozilla_t tcontext=staff_u:object_r:user_fonts_t tclass=file permissive=0
[  175.939486] audit: type=1400 audit(1508258319.881:1666): avc:  denied  { map } for  pid=3650 comm=57656220436F6E74656E74 path="/home/amade/.fonts/unifont-9.0.06.ttf" dev="dm-0" ino=13376470 scontext=staff_u:staff_r:mozilla_t tcontext=staff_u:object_r:user_fonts_t tclass=file permissive=0

[Comment 1 Amadeusz Sławiński 2017-10-17 21:04:35 UTC]

Suggested fix:

https://github.com/amade/hardened-refpolicy/commit/106824d9a708ac8b4c3b9c4db3b4252cdb3294ce

[Comment 2 Amadeusz Sławiński 2017-10-18 10:32:11 UTC]

Created attachment 499060 [details, diff]
if applications used fonts that may be mapped

and attach patch for history