RHBA-2009:1292 - Bug Fix Advisory

Topic

Updated policycoreutils packages that fix several bugs are now available.

Description

policycoreutils contains the policy core utilities that are required for
the basic operation of a Security-Enhanced Linux (SELinux) system. These
utilities include load_policy to load policies, setfiles to label file
systems, newrole to switch roles, and run_init to run "/etc/init.d/"
scripts in the proper context.

These updated packages fix the following bugs:

• when attempting to change contexts, chcat reported invalid argument and

insufficient space errors because of a limit to the number of extended
attributes that could be included as an argument. This update fixes the
issue. (BZ#220813)

• executing the "semanage port -{a|d|m} [-tr] [-p protocol] port" command

failed if SELinux was disabled. This update adds support for selecting a
store with semanage so that application policies can be updated when
SELinux is disabled. (BZ#316011)

• genhomedircon could not process a HOME_DIR with a context <<none>>.

This condition has been added and the problem has been resolved.
(BZ#354361)

• restorecond.conf did not include definitions for ~/web or ~/www

directories. The paths for these directories have been added to
restorecond.conf, resolving this issue. (BZ#458687)

• chcat did not translate category IDs to name strings when a user belonged

to multiple categories. chcat and setrans.conf have been modified so that
category IDs are translated as expected on all architectures and the error
no longer presents. (BZ#459677)

• clicking on the table header in system-config-selinux network port view

should have toggled numerical sorting of values, but did not activate the
sort method. This update fixes the sort order action for the ports page.
(BZ#468170)

• policycoreutils did not support the use of "semodule -DB" when removing

dontaudit messages. Upstream "semodule -DB" support has been added so that
users have a simple mechanism to remove all dontaudit rules while
building policies. (BZ#493115)

Users of policycoreutils are advised to upgrade to these updated packages,
which resolve these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 220813 - chcat throwing error messages while changing context
• BZ - 316011 - semanage port -a -t ldap_port_t -p tcp 4389 fails if SELinux disabled
• BZ - 354361 - genhomedircon not processing HOME_DIR when context <<none>>
• BZ - 458687 - restorecond.conf does not include ~/web or ~/www
• BZ - 459677 - chcat won't translate multi-categories to strings as defined
• BZ - 468170 - system-config-selinux network port view sorting is broken
• BZ - 493115 - Need to be able to turn off dontaudit messages

CVEs

(none)

References

(none)