Linux chromium通過yum安裝解決不能使用問題
作者：佚名
今天在Fedora People看到有新的Linux chromium安裝包出現(xiàn)，于是打算升級Linux chromium。下載了所有的rpm包(忘記了最初是通過yum安裝的)。安裝時(shí)Linux chromium, chromium-libs都能通過rpm -Uvh正常安裝，可是升級v8時(shí)還是出了問題。想起以前的教訓(xùn)，打算先把v8完全卸載再安裝，可是缺無法卸載，無論是通過rpm -e還是yum remove都不行。
給大家推薦一款很不錯(cuò)的Linux chromium系統(tǒng)很有學(xué)習(xí)價(jià)值，這里我主要講解Linux chromium系統(tǒng)的應(yīng)用，包括介紹Linux chromium知識等方面。自打裝好Fedora 12之后就發(fā)現(xiàn)Linux chromium不能用rpm安裝了，安裝時(shí)總是缺這少那，很是費(fèi)勁，于是按照網(wǎng)上的方法，在/etc/yum.repos.d/下創(chuàng)建一個(gè)chromium.repo，內(nèi)容如下：
- view plaincopy to clipboardprint?
- [chromium]
- name=Chromium Test Packages
- baseurl=http://spot.fedorapeople.org/chromium/F$releasever/
- enabled=0
- gpgcheck=0
- [chromium]
- name=Chromium Test Packages
- baseurl=http://spot.fedorapeople.org/chromium/F$releasever/
- enabled=0
- gpgcheck=0
然后通過yum安裝就可以了。
今天在Fedora People看到有新的Linux chromium安裝包出現(xiàn)，于是打算升級Linux chromium。下載了所有的rpm包(忘記了最初是通過yum安裝的)。安裝時(shí)Linux chromium, chromium-libs都能通過rpm -Uvh正常安裝，可是升級v8時(shí)還是出了問題。想起以前的教訓(xùn)，打算先把v8完全卸載再安裝，可是缺無法卸載，無論是通過rpm -e還是yum remove都不行。
這時(shí)想到了用yum upodate v8-*，結(jié)果卻出現(xiàn)了“Package v8-devel-2.0.3-1.20091209svn3443.fc12.i686.rpm is not signed”的錯(cuò)誤。在網(wǎng)上找到一個(gè)辦法，就是編輯 /etc/yum.conf ，把gpgcheck=1 改為 gpgcheck=0。不過這樣做有潛在的風(fēng)險(xiǎn)，因此在安裝完v8之后就立刻把gpgcheck重新設(shè)為1.
另外一個(gè)奇怪的問題是，打開Linux chromium時(shí)，瀏覽器打不開，而且SELinux總是報(bào)錯(cuò)：
- view plaincopy to clipboardprint?
- Summary:
- SELinux is preventing /usr/lib/chromium-browser/chromium-browser from loading
- /usr/lib/chromium-browser/libmedia.so which requires text relocation.
- Detailed Description:
- The chromium-browse application attempted to load
- /usr/lib/chromium-browser/libmedia.so which requires text relocation. This is a
- potential security problem. Most libraries do not need this permission.
- Libraries are sometimes coded incorrectly and request this permission. The
- SELinux Memory Protection Tests
- (http://people.redhat.com/drepper/selinux-mem.html) web page explains how to
- remove this requirement. You can configure SELinux temporarily to allow
- /usr/lib/chromium-browser/libmedia.so to use relocation as a workaround, until
- the library is fixed. Please file a bug report.
- Allowing Access:
- If you trust /usr/lib/chromium-browser/libmedia.so to run correctly, you can
- change the file context to textrel_shlib_t. "chcon -t textrel_shlib_t
- '/usr/lib/chromium-browser/libmedia.so'" You must also change the default file
- context files on the system in order to preserve them even on a full relabel.
- "semanage fcontext -a -t textrel_shlib_t
- '/usr/lib/chromium-browser/libmedia.so'"
- Fix Command:
- chcon -t textrel_shlib_t '/usr/lib/chromium-browser/libmedia.so'
- Additional Information:
- Source Context unconfined_u:unconfined_r:unconfined_execmem_t:s0-
- s0:c0.c1023
- Target Context system_u:object_r:lib_t:s0
- Target Objects /usr/lib/chromium-browser/libmedia.so [ file ]
- Source chromium-browse
- Source Path /usr/lib/chromium-browser/chromium-browser
- Port <Unknown>
- Host bonn.yang
- Source RPM Packages chromium-4.0.273.0-0.1.20091216svn34775.fc12
- Target RPM Packages chromium-libs-4.0.273.0-0.1.20091216svn34775.fc12
- Policy RPM selinux-policy-3.6.32-56.fc12
- Selinux Enabled True
- Policy Type targeted
- Enforcing Mode Enforcing
- Plugin Name allow_execmod
- Host Name bonn.yang
- Platform Linux bonn.yang 2.6.31.6-166.fc12.i686.PAE #1 SMP
- Wed Dec 9 11:00:30 EST 2009 i686 i686
- Alert Count 11
- First Seen Wed 23 Dec 2009 09:38:16 PM CST
- Last Seen Wed 23 Dec 2009 10:28:36 PM CST
- Local ID b1f55f28-145d-48dd-9d71-6fb7fe6a57c8
- Line Numbers
- Raw Audit Messages
- node=bonn.yang type=AVC msg=audit(1261578516.240:27332): avc: denied { execmod } for pid=2946 comm="chromium-browse" path="/usr/lib/chromium-browser/libmedia.so" dev=sda2 ino=277322 scontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lib_t:s0 tclass=file
- node=bonn.yang type=SYSCALL msg=audit(1261578516.240:27332): arch=40000003 syscall=125 success=no exit=-13 a0=8ff8000 a1=63000 a2=5 a3=bf899bf0 items=0 ppid=1 pid=2946 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="chromium-browse" exe="/usr/lib/chromium-browser/chromium-browser" subj=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 key=(null)
- Summary:
- SELinux is preventing /usr/lib/chromium-browser/chromium-browser from loading
- /usr/lib/chromium-browser/libmedia.so which requires text relocation.
- Detailed Description:
- The chromium-browse application attempted to load
- /usr/lib/chromium-browser/libmedia.so which requires text relocation. This is a
- potential security problem. Most libraries do not need this permission.
- Libraries are sometimes coded incorrectly and request this permission. The
- SELinux Memory Protection Tests
- (http://people.redhat.com/drepper/selinux-mem.html) web page explains how to
- remove this requirement. You can configure SELinux temporarily to allow
- /usr/lib/chromium-browser/libmedia.so to use relocation as a workaround, until
- the library is fixed. Please file a bug report.
- Allowing Access:
- If you trust /usr/lib/chromium-browser/libmedia.so to run correctly, you can
- change the file context to textrel_shlib_t. "chcon -t textrel_shlib_t
- '/usr/lib/chromium-browser/libmedia.so'" You must also change the default file
- context files on the system in order to preserve them even on a full relabel.
- "semanage fcontext -a -t textrel_shlib_t
- '/usr/lib/chromium-browser/libmedia.so'"
- Fix Command:
- chcon -t textrel_shlib_t '/usr/lib/chromium-browser/libmedia.so'
- Additional Information:
- Source Context unconfined_u:unconfined_r:unconfined_execmem_t:s0-
- s0:c0.c1023
- Target Context system_u:object_r:lib_t:s0
- Target Objects /usr/lib/chromium-browser/libmedia.so [ file ]
- Source chromium-browse
- Source Path /usr/lib/chromium-browser/chromium-browser
- Port <Unknown>
- Host bonn.yang
- Source RPM Packages chromium-4.0.273.0-0.1.20091216svn34775.fc12
- Target RPM Packages chromium-libs-4.0.273.0-0.1.20091216svn34775.fc12
- Policy RPM selinux-policy-3.6.32-56.fc12
- Selinux Enabled True
- Policy Type targeted
- Enforcing Mode Enforcing
- Plugin Name allow_execmod
- Host Name bonn.yang
- Platform Linux bonn.yang 2.6.31.6-166.fc12.i686.PAE #1 SMP
- Wed Dec 9 11:00:30 EST 2009 i686 i686
- Alert Count 11
- First Seen Wed 23 Dec 2009 09:38:16 PM CST
- Last Seen Wed 23 Dec 2009 10:28:36 PM CST
- Local ID b1f55f28-145d-48dd-9d71-6fb7fe6a57c8
- Line Numbers
- Raw Audit Messages
- node=bonn.yang type=AVC msg=audit(1261578516.240:27332): avc: denied { execmod } for pid=2946 comm="chromium-browse" path="/usr/lib/chromium-browser/libmedia.so" dev=sda2 ino=277322 scontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lib_t:s0 tclass=file
- node=bonn.yang type=SYSCALL msg=audit(1261578516.240:27332): arch=40000003 syscall=125 success=no exit=-13 a0=8ff8000 a1=63000 a2=5 a3=bf899bf0 items=0 ppid=1 pid=2946 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="chromium-browse" exe="/usr/lib/chromium-browser/chromium-browser" subj=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 key=(null)
試了半天也沒能在SELinux中設(shè)好libmedia.so的permission（有人說只要把libmedia.so的permission設(shè)為permissive就可以）。后來在一個(gè)法語的網(wǎng)頁上(http://tuxmaya.wordpress.com/2009/12/21/nuevos-paquetes-de-chormium-en-fedora/ )發(fā)現(xiàn)了這樣一條命令來取消 SELinux 對 /usr/lib/chromium-browser/下的所有.so文件的permission 的檢查。
- view plaincopy to clipboardprint?
- chcon -t texrel_shlib_t /usr/lib*/chromium-browser/*.so
- chcon -t texrel_shlib_t /usr/lib*/chromium-browser/*.so
另外，該網(wǎng)頁(http://forums.fedoraforum.org/showthread.php?t=237029 )上也提到了這種方法。
設(shè)置之后，Linux chromium就可以正常工作了。這篇博文就是用Linux chromium來寫的。
PS:
寫完博文后在SELinux的錯(cuò)誤信息中發(fā)現(xiàn)了fix的方法：
- view plaincopy to clipboardprint?
- hcon -t textrel_shlib_t '/usr/lib/chromium-browser/libmedia.so'
- hcon -t textrel_shlib_t '/usr/lib/chromium-browser/libmedia.so'
- view plaincopy to clipboardprint?
- semanage fcontext -a -t textrel_shlib_t
- '/usr/lib/chromium-browser/libmedia.so'
- semanage fcontext -a -t textrel_shlib_t
- '/usr/lib/chromium-browser/libmedia.so'
實(shí)在是太粗心了，當(dāng)時(shí)竟然沒有仔細(xì)看…… 謹(jǐn)記這一教訓(xùn)！
【編輯推薦】
責(zé)任編輯：佚名
來源：
CSDN
