RHBA-2011:1559 - Bug Fix Advisory

Topic

Updated libselinux packages that fix three bugs are now available for Red Hat
Enterprise Linux 6.

Description

The libselinux packages contain the core library of an SELinux system. The
libselinux library provides an API for SELinux applications to get and set
process and file security contexts, and to obtain security policy decisions. It
is required for any applications that use the SELinux API, and used by all
applications that are SELinux-aware.

This update fixes the following bugs:

• Prior to this update, Python bindings for the restorecon command required a

user to specify the entire path. Consequent to this, an attempt to use the
selinux.restorecon() function with a relative path failed with the following
error message:

OSError: [Errno 2] No such file or directory

This update corrects the Python bindings to allow the use of the
selinux.restorecon() function with a relative path or just a file name.
(BZ#698583)

• Previously, the is_selinux_enabled() function may have incorrectly returned a

positive value even when the machine was disabled. This happened when the same
process that made the calls to disable SELinux attempted to determine if SELinux
is enabled, because the selinux_mnt variable was not properly freed and still
contained old data. With this update, a patch has been applied to make sure the
selinux_mnt variable is now properly freed, and the is_selinux_enabled()
function works as expected. (BZ#706049)

• When a semanage login record was set up using a group name and the number of

elements in the group was too large, login programs failed to log in the user
with the correct context. This update corrects the libselinux library to return
all users within a group so that the correct SELinux user record is used. As a
result, users with the correct context can now log in as expected in this
scenario. (BZ#748471)

All users of libselinux are advised to upgrade to these updated packages, which
fix these bugs.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259/

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 698583 - restorecon from libselinux-python fails on relative paths

CVEs

(none)

References

(none)