RHBA-2010:0208 - Bug Fix Advisory

Topic

Updated policycoreutils packages that fix several bugs are now available.

Description

The policycoreutils packages contain the core utilities that are
required for the basic operation of a Security-Enhanced Linux (SELinux)
system and its policies. These utilities include load_policy to load
policies, setfiles to label file systems, newrole to switch roles, and
run_init to run /etc/init.d/ scripts in their proper context.

These updated packages fix the following bugs:

• executing the semanage command with the translation option caused

denials and undesired mode changes to the setrans.conf file. This update
removes the translation functionality from the semanage command.
(BZ#460970)

• the semanage command allowed an invalid network port number to be

passed to it. This update adds proper verification of the port number
option to semanage. Any invalid port number is now rejected. (BZ#505521)

• the use of the #!/usr/bin/env python option at the top of python

scripts is being phased out, in favour of the #!/usr/bin/python option.
There was one instance of the former option in a policycoreutils python
script. This fix replaces this line with the latter option in this file.
(BZ#521298)

• the semanage command did not support the node option being passed to

it and resulted in an error when it was used. This fix adds the node
option to the semanage command. This option allows you to list, add and
modify nodes in SELinux policy. (BZ#527487)

Users of policycoreutils are advised to upgrade to these updated
packages, which resolve these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 460970 - "semanage translation -a" causes denials; setrans.conf mode changed
• BZ - 505521 - semanage port add/delete problems
• BZ - 521298 - Fix instances of #!/usr/bin/env python in policycoreutils-gui
• BZ - 527487 - semanage command does not support -node option

CVEs

(none)

References

(none)