RHBA-2009:1656 - Bug Fix Advisory

Topic

Updated system-config-securitylevel packages that fix several bugs are now
available.

Description

system-config-securitylevel is a graphical program for configuring firewall
and SELinux settings.

These updated packages address the following bugs:

• when a new port is added to a firewall -- via the Firewall Options >

Other ports > Add dialog box -- its service name is derived from the port
number. Service names containing hyphens (eg iascontrol-oms, 1156/TCP, the
Oracle Application Server control port) were incorrectly assumed to be port
ranges. This caused them to be split, with the individual sections found to
be invalid. Note: this validation failure did not prevent the port from
being added to the firewall, as could be seen with the iptables-save
command. The port was not listed in the "Other ports" list, however. With
this update service names with hyphens are treated correctly, the added
port is validated correctly and it is listed in "Other ports" as expected.
(BZ#503588)

• system-config-securitylevel-tui, the text-based equivalent to

system-config-securitylevel, relies on the setenforce command but did not
have an explicit dependency on libselinux, the package that provides the
setenforce command. With this update, the system-config-securitylevel spec
file has been updated to require libselinux, ensuring
system-config-securitylevel-tui always has the setenforce command available
as needed. (BZ#532947)

• lokkit calls referenced setenforce without explicitly noting its path:

/usr/sbin/setenforce. The default PATH for ordinary users on Red Hat
Enterprise Linux does not include /usr/sbin/, however. If such users had
sudo-based permission to run system-config-securitylevel-tui, attempting to
run this application resulted in a "sh: setenforce: command not found"
error. lokkit now references setenforce's path explicitly and ordinary
users with appropriate permissions can run system-config-securitylevel-tui
as expected. Note: /usr/sbin is in the default PATH of the root user on Red
Hat Enterprise Linux. If system-config-securitylevel-tui was only run by
the root user, this error did not present. (BZ#532948)

All users are advised to upgrade to these updated packages, which resolve
these issues.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 503588 - 'Other Port' validation broken
• BZ - 532947 - system-config-securitylevel-tui depens on libselinux-utils
• BZ - 532948 - system-config-securitylevel-tui assumes /usr/sbin is in PATH

CVEs

(none)

References

(none)