From Debian package 0.2.20091117-3 * label Google Chrome as unconfined_execmem_exec_t Index: policy/modules/system/unconfined.fc =================================================================== --- policy/modules/system/unconfined.fc.orig +++ policy/modules/system/unconfined.fc @@ -1,7 +1,5 @@ # Add programs here which should not be confined by SELinux -# e.g.: -# /usr/local/bin/appsrv -- gen_context(system_u:object_r:unconfined_exec_t,s0) -# For the time being until someone writes a sane policy, we need initrc to transition to unconfined_t +/opt/google/chrome/chrome -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) /usr/bin/valgrind -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) /usr/bin/vncserver -- gen_context(system_u:object_r:unconfined_exec_t,s0)