RHBA-2011:1637 - Bug Fix Advisory

Topic

Updated policycoreutils packages that fix several bugs are now available for Red
Hat Enterprise Linux 6.

Description

The policycoreutils packages contain the core utilities that are required for
the basic operation of a Security-Enhanced Linux (SELinux) system and its
policies.

This update fixes the following bugs:

• Due to the wrong run_init pseudo terminal (pty) handling, it was not possible

to start the sshd daemon properly with the run_init utility. With this update,
the bug has been fixed so that run_init now works, as expected. (BZ#662064)

• If the "-D" option was used with the "semanage module" command, it resulted in

a traceback. With this update, the functionality that allowed removal of every
single policy module from a system has been removed from the semanage utility so
that the bug is now fixed. (BZ#666861)

• Previously, the semanage(8) man page did not describe certain options. This

update corrects the man page so that these options are now described, as
expected. (BZ#677541, BZ#677542)

• Previously, the SELinux graphical tools and the common SELinux tools did not

work on systems with SELinux disabled. This bug has been fixed by allowing the
SELinux graphical tools and the common SELinux tools to run on these systems.
(BZ#689153, BZ#695288, BZ#696809, BZ#735044)

• Previously, running the "sandbox -H /tmp/testuserhome ls ~" command resulted

in a traceback. With this update, the command now works as expected. (BZ#690502)

• Previously, the gnome-python2-gtkhtml2 package was required by the

policycoreutils-gui package. As a result, the Automatic Bug Reporting Tool
(ABRT) utilities generated a traceback. With this update, the
gnome-python2-gtkhtml2 package is no longer required by the policycoreutils-gui
package, thus the bug is fixed. (BZ#702860)

• Previously, the sestatus(8) man page missed the description of the "-b"

option. This update corrects the man page so that this option is now described,
as expected. (BZ#705027)

• Previously, polyinstantiated directories had the wrong multilevel secure (MLS)

range set for a user. As a result, the user was not able to create files in the
/tmp/ directory, or, under certain circumstances, to log in. This update fixes
the bug by correcting the namespace.init script. (BZ#715021)

• Previously, the rsync package was not required by any of the policycoreutils

packages, although the "seunshare" command, which is provided by the
policycoreutils-sandbox package, requires the rsync package to work properly.
With this update, the rsync package is now required by the
policycoreutils-sandbox package, thus the bug is fixed. (BZ#734467)

• Previously, it was possible to change the USER, ROLE, and MLS ranges on an

object with the "restorecon" command even if the "-F" option was not specified.
This update fixes the unintended behavior by disallowing "restorecon" to change
the USER, ROLE or MLS ranges on the object unless the "-F" option is specified.
(BZ#736153)

• If the "restorecon" command was successful, the return code "1" was

erroneously returned. This unintended behavior has been fixed with this update
so that "restorecon" now returns the code "0", as expected. (BZ#739587,
BZ#740669)

• If booting with the "SELinux=disabled" option set in the /etc/selinux/config

file (but without specifying the "selinux=0" option at the kernel prompt),
dracut output the following error:

dracut: /sbin/load_policy: Can't load policy: No such file or directory

With this update, dracut no longer outputs this error. (BZ#750594)

All users of policycoreutils are advised to upgrade to these updated packages,
which fix these bugs.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 658532 - restorecond doesn't work for user home directories on a server
• BZ - 666861 - 'semanage module -D' leads to a traceback
• BZ - 677542 - "semanage module" is not mentioned in semanage man page
• BZ - 679798 - policycoreutils: incorrect package name in the -sandbox subpackage description
• BZ - 689153 - [abrt] policycoreutils-gui-2.0.83-21.fc14: __init__.py:49:seinfo:RuntimeError: No default policy found.
• BZ - 690502 - sandbox -- AttributeError: 'module' object has no attribute 'chcon'
• BZ - 690744 - sandbox.conf.5.gz vs. /etc/sysconfig/sandbox
• BZ - 695288 - [abrt] policycoreutils-gui-2.0.83-19.1.el6: __init__.py:49:seinfo:RuntimeError: No default policy found.
• BZ - 696809 - system-config-selinux could not open interface info
• BZ - 702860 - This is a bug generated by abrt
• BZ - 705027 - sestatus usage message not complete (missing -b option)
• BZ - 717640 - Defects revealed by Coverity scan
• BZ - 728833 - Missing closedir calls
• BZ - 734467 - seunshare needs rsync, but rsync is not required by any policycoreutils* package
• BZ - 735044 - semanage permissive -l tracebacks if SELinux is disabled
• BZ - 736153 - restorecon should not change USER,ROLE,MLS range unless -F is specified
• BZ - 739587 - restorecon should always return 0 on success
• BZ - 740669 - "service iptables save" command fails returning exit value 1

CVEs

(none)

References

(none)