RHBA-2015:0458 - Bug Fix Advisory

Topic

Updated selinux-policy packages that fix multiple bugs and add various enhancements are now available.

Description

The selinux-policy packages contain the rules that govern how confined processes run on the system.

The selinux-policy packages have been upgraded to upstream version 3.13.1, which provides a number of bug fixes and enhancements over the previous version. (BZ#1128284)

This update also fixes the following bugs:

• Due to missing SELinux policy rules, SELinux in enforcing mode prevented the collectd daemon from using the unixsock plug-in. The appropriate SELinux rules have been added, and collectd can now use unixsock as expected. (BZ#1115030)
• SELinux policy rules were missing for the OpenStack Keystone service when running within the Apache mod_wsgi module. With this update, a new SELinux context, keystone_t, has been added to the SELinux policy to address this bug. (BZ#1138424)
• Due to insufficient SELinux policy rules, SELinux in enforcing mode prevented the MongoDB database from writing and renaming its own log files. The SELinux policy has been updated, and MongoDB can now manage its own log files as expected. (BZ#1149254)
• SELinux did not allow the CouchDB database to read NFS state data. As a consequence, several Access Vector Cache (AVC) denials were returned. With this update, the relevant SELinux policy has been modified to allow CouchDB to read NFS state data. (BZ#1158427)
• Files in the /var/cache/ibus/ directory were incorrectly labeled with the var_t SELinux type. This update has modified the appropriate SELinux policy rules, and the files are now correctly labeled with the system_dbusd_var_lib_t SELinux type. (BZ#1167476)
• The OpenLDAP server uses the pwdChecker module that requires access to the cracklib library when users change their passwords. However, SELinux prevented pwdChecker to access cracklib due to incorrect SELinux policy rules. The SELinux policy has been modified to allow pwdChecker to access cracklib. (BZ#1175188)
• Previously, SELinux running in enforcing mode did not allow processes labeled with the sblim_sfcbd_t SELinux type to set the setuid bit. The SELinux policy has been changed to allow sblim_sfcbd_t to set setuid as expected. (BZ#1175916)
• Due to incorrect SELinux policy rules, one device on systems with the System z architecture was labeled with the improper device_t SELinux type. The relevant SELinux rules have been fixed, and the device is now labeled with the correct random_device_t SELinux label as expected. (BZ#1176151)
• Due to a missing SELinux policy rule, an attempt to install the Red Hat Enterprise Linux OpenStack Platform failed and an AVC denial message was returned. The missing SELinux policy rule has been added with this update, and the installation of the Red Hat Enterprise Linux OpenStack Platform no longer fails. (BZ#1181818)
• With the "user=sssd" variable set in the sssd.conf file, an attempt to authenticate against a Active Directory (AD) failed, and several AVCs denial messages were returned. The appropriate SELinux policy rules have been fixed, and the AVCs denial messages are no longer returned in the described situation. (BZ#1184436)

Users of selinux-policy are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64

Fixes

• BZ - 1059727 - spamassassin service triggers AVCs when pyzor package is installed
• BZ - 1071981 - introduce a SELinux boolean to enable/disable guest file access from qemu-ga
• BZ - 1075870 - cimserver is blocked by selinux
• BZ - 1084429 - conman AVC denials on rhel 7
• BZ - 1084977 - Policy for openlmi-providers, journald provider
• BZ - 1088038 - Cannot connect to VPN with unbound enabled
• BZ - 1093733 - SELinux is stopping libstoragemgmt smis and targetd plugin to use TCP connection.
• BZ - 1100977 - Add policy for min-cloud-agent (matching min-metadata-service)
• BZ - 1102843 - SELinux prevents squid runing in SMP mode
• BZ - 1105212 - FreeIPA's httpd cannot read CRL generated by PKI
• BZ - 1105579 - Keystone cannot send notifications
• BZ - 1106330 - selinux prevents swift-container from connecting to TCP port 6002
• BZ - 1109166 - selinux doesn't allow sending of snmp trap messages by radiusd
• BZ - 1113138 - Not all of radiusd ports are in selinux policy
• BZ - 1113309 - SELinux prevents glance from uploading images, causing it to hang
• BZ - 1113725 - MLS: pam_oddjob_mkhomedir does not work
• BZ - 1113922 - AVC denial when running docker build
• BZ - 1114821 - fail2ban selinux denial
• BZ - 1117013 - Both /var/log/cloud-init.log and /var/log/cloud-init-output.log should have same file context
• BZ - 1118515 - numad and libvirt problem
• BZ - 1119015 - HAProxy TPROXY configuration is forbidden by SELinux rules
• BZ - 1120152 - SELinux is preventing /usr/sbin/ModemManager from using the 'dac_override' capabilities.
• BZ - 1120331 - SELinux is preventing /usr/sbin/smbd from read access on the directory .
• BZ - 1122467 - SELinux prevents conmand from creating its own PID file
• BZ - 1125165 - EPEL7 package varnish is prohibited from starting
• BZ - 1127357 - Docker image is not able to patch file on host system
• BZ - 1128284 - Request for rebase of selinux-policy package
• BZ - 1130086 - Daemon qpidd denial to read /etc/passwd
• BZ - 1131188 - HAProxy fails to read /dev/urandom
• BZ - 1133248 - fail2ban needs to be able to read the journal
• BZ - 1133894 - Mount of "/" within a new mount namespace as sysadm_r with SELinux policy MLS returns EACCES
• BZ - 1134114 - Bacula denials
• BZ - 1134122 - Bacula storage daemon on disk location
• BZ - 1138424 - Need selinux policy for OpenStack Keystone running in Apache with mod_wsgi
• BZ - 1138731 - firewall-cmd gets stuck when run as superVDSM subsubprocess
• BZ - 1139615 - pam_systemd causes AVC for ThinLinc
• BZ - 1142454 - sanlock not allowed to send SIGTERM or SIGKILL signals
• BZ - 1142825 - Wrong type of infiniband device files
• BZ - 1142976 - Please allow abrtd to read /dev/mem
• BZ - 1144165 - SELinux: rhsmcertd-worke unable to write to /var/lib/rpm
• BZ - 1145097 - ipa-server-install produces AVCs
• BZ - 1145886 - SELinux: keepalived killall denials
• BZ - 1146423 - selinux doesn't allow write for radiusd to /var/log/radius
• BZ - 1146529 - selinux prevents hosted engine to be deployed on EL7 with iscsi support
• BZ - 1147104 - SELinux: neutron-ns-meta denied connectto on unix_stream_socket
• BZ - 1147699 - libStorageMgmt: SELinux is preventing /usr/bin/lsmd from getattr access on the file <foo>
• BZ - 1147787 - zebra won't start when sssd is used due to selinux policy
• BZ - 1148591 - avcs generated when libreswan is run to connect to red hat VPN via NM-libreswan
• BZ - 1148594 - Updating rhel7 VM causes various prelink and alsactl avcs
• BZ - 1148766 - [rhel7] graphite-web needs type "httpd_sys_rw_content_t" for files in "/var/lib/graphite-web(/.*)?"
• BZ - 1149130 - SELinux is preventing /usr/sbin/alsactl from 'read' accesses on the lnk_file .
• BZ - 1149236 - SELinux prevents sensord from calling statfs() on /sys
• BZ - 1149253 - [ga][rhel7][ppc64] org.freedesktop.DBus.Error.AccessDenied: An SELinux policy prevents this sender from sending this message to this recipient
• BZ - 1149254 - SELinux prevents mongod from writing and renaming log files
• BZ - 1150274 - SELinux prevents portreserve from writing to /var/lib/sss/pipes/nss socket
• BZ - 1150700 - SELinux is preventing /usr/bin/python2.7 from 'create' accesses on the netlink_audit_socket .
• BZ - 1151030 - after a crash, SELinux is preventing sosreport to mkdir
• BZ - 1151555 - corosync running in wrong context
• BZ - 1152538 - sanlock is not allowed to read from sysfs
• BZ - 1152773 - SELinux message on dovecot login
• BZ - 1153350 - haproxy runs as unconfined_service_t even if it is confined
• BZ - 1153352 - tomcat runs as unconfined_service_t even if it is confined
• BZ - 1153353 - ctdbd runs as unconfined_service_t even if it is confined
• BZ - 1153561 - kadmind and kpropd from krb5-server package are running under unconfined_service_t
• BZ - 1154196 - dhcrelay triggers { setpcap } AVC
• BZ - 1154742 - xinetd cannot start /usr/sbin/sserver
• BZ - 1154759 - AVCs appears when joining to Win AD via winbind
• BZ - 1155617 - nslcd generates AVCs when started
• BZ - 1158427 - start of the couchdb service triggers AVCs
• BZ - 1160174 - SELinux is preventing /usr/sbin/brctl from 'read' accesses on the file .
• BZ - 1160339 - selinux denies execute,read and getattr for ntlm_auth
• BZ - 1160727 - Set correct file label for start-puppet-ca wrapper script
• BZ - 1161217 - missing selinux policy to allow syscall connectto for svirt_t
• BZ - 1161379 - [Hyper-V][REHL 7.1] IP injection fail due to SELinux denied with gen2 guest
• BZ - 1162125 - glusterd can't create /var/run/glusterd.socket when SELinux is in enforcing mode
• BZ - 1162308 - AVCs generated by Vipul's Razor
• BZ - 1162707 - qemu-guest-agent in guest is denied by selinux-policy when do s3/s4
• BZ - 1165058 - System-Update/avc shows avc error messages while doing TPS testing.
• BZ - 1165734 - Disabling the 'unconfined' module broke setroubleshootd
• BZ - 1166281 - SELinux prevents /usr/sbin/rndc from reading /dev/urandom and /dev/random
• BZ - 1166537 - virt-who runs as unconfined_service_t
• BZ - 1167476 - Files in /var/cache/ibus have wrong SELinux context
• BZ - 1167477 - File /usr/sbin/iw has wrong SELinux context
• BZ - 1168218 - AVC denials: scontext=system_u:system_r:docker_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=service
• BZ - 1172291 - Unable to login using smartcard with kerberos user through virtual terminal when selinux in enforcing mode
• BZ - 1174249 - AVC denied for OpenVPN for block_suspend for tclass=capability2
• BZ - 1175188 - selinux blocks slapd access to cracklib
• BZ - 1179564 - When selinux is 'Enforcing', guest with a readonly attribute sg disk can not be started.
• BZ - 1179841 - sulogin denied reading urandom in rescue mode
• BZ - 1180713 - libvirt is unable to access default storage pool in MLS
• BZ - 1181111 - [RHEL7.0][Gluster] Selinux prevents a creation of glusterfs domains
• BZ - 1181818 - AVC when packstack installs glance
• BZ - 1182647 - Permission denied: '/ostree/deploy/rhel-atomic-host/deploy/a087cbd6a18f8876da6075896994dae0256a09c5f0dc22852675ab47fd122c3c.0.origin on Rhel atomic
• BZ - 1183689 - SELinux drops an AVC during NetwokManager VPN connection
• BZ - 1184260 - netutils_t policy prevents tcpdump from calling chown/setattr
• BZ - 1184436 - avc denied fowner capability for sssd
• BZ - 1184978 - selinux prevents libreswan to stop correctly sometimes

CVEs

(none)

References

• http://www.redhat.com/security/updates/classification/#normal