RHBA-2006:0049 - Bug Fix Advisory

Topic

Updated selinux-policy packages are now available that include policy
changes to allow applications to communicate with each other.

Description

Security-enhanced Linux is a patch of the Linux® kernel and a number of
utilities with enhanced security functionality designed to add mandatory
access controls to Linux. This package contains the SELinux example policy
configuration along with the Flask configuration information and the
application configuration files.

The previous SELinux policy prevented several applications from running
properly. This update introduces policy changes that allow the following:

• init scripts can now use unlabeled file systems
• NetworkManagerInfo can now communicate with dbus
• dbus can now send audit messages
• up2date can now execute init scripts

Users of selinux-policy should upgrade to these updated packages, which
resolve these issues.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 167551 - MySQL rpm installation fails when SELinux is enabled
• BZ - 169999 - avc: denied { create } for pid=8460 comm="nscd" scontext=user_u:system_r:nscd_t tcontext=user_u:system_r:nscd_t tclass=netlink_audit_socket
• BZ - 170057 - OpenAFS on RHEL 4 Update 2
• BZ - 170064 - NetworkManagerInfo cannot talk to dbus
• BZ - 170304 - Cannot run Preference "Removable Storage." Receive and error message stating Volume Management not Supported.
• BZ - 170469 - Error "dbus: Can't send to audit system"
• BZ - 171288 - up2date using console helper going from U1->U2 uses deprecated sysadm_r role
• BZ - 171509 - SELinux prevents nscd from resolving names
• BZ - 172830 - HALD no longer auto-mounts usb devices (as of RHEL4-U2)
• BZ - 172960 - genfs.policy doesn't allow AFS to be mounted
• BZ - 179073 - selinux policy prevents syslog from working properly in RHEL4-U3 candidate

CVEs

(none)

References

(none)