RHBA-2010:0183 - Bug Fix Advisory

Topic

An updated libsepol package that resolves a policy issue is now available.

Description

libsepol provides an API for the manipulation of SELinux binary policies.
It is used by checkpolicy (the policy compiler) and similar tools, and
programs such as load_policy, which must perform specific transformations
on binary policies (for example, customizing policy boolean settings).

This updated libsepol package addresses the following issue:

• newer SELinux kernels have access checks that the shipping SELinux policy

package does not understand. The kernel currently denies these access
checks by default. This updated libsepol package allows the checkpolicy and
selinux-policy packages to build policy that tells the kernel to "Allow"
unknown access. (BZ#531228)

All SELinux users should install this updated package which resolves this
issue.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 531228 - Real Time Kernel supports SELinux options not available in policy

CVEs

(none)

References

(none)