RHBA-2015:0477 - Bug Fix Advisory

Topic

Updated policycoreutils packages that fix several bugs are now available for Red
Hat Enterprise Linux 7.

Description

The policycoreutils packages contain the core utilities that are required for
the basic operation of a Security-Enhanced Linux (SELinux) system and its
policies.

This update fixes the following bugs:

• Due to a bug in the policycoreutils code, the selinux-policy package failed

to build on ARM 64-bit architectures. The policycoreutils code has been patched,
and selinux-policy now builds on ARM 64-bit architectures successfully.
(BZ#1061950)

• Previously, the "sepolicy interface" command missed support for the

selinux_genbool interface. Consequently, an attempt to compile selinux_genbool
failed. With this update, the "selinux interface" command has been modified to
support selinux_genbool so that compiling of this interface no longer fails.
(BZ#1075023)

• The /etc/selinux/fixfiles_exclude_dirs file contains a list of directories

that are supposed to be excluded when relabeling the system. However, when a
substitution file for a directory was specified in fixfiles_exclude_dirs, the
"fixfiles restore" command did not work correctly. As a consequence, many files
had incorrect SELinux context assigned. This update provides a patch to fix this
bug, and "fixfiles restore" now applies correct labels on files. (BZ#1082676)

• Previously, when the user attempted to use the restorecon utility to restore

the SELinux context on a file that did not exist, the restorecond daemon logged
an unnecessary message. With this update, restorecond does not report the
aforementioned scenario as an error, and the unnecessary messages are no longer
logged. (BZ#1082956)

• The sepolicy.search() function printed the same output as the command that was

executed immediately before instead of a list of the dontaudit files. As a
consequence, an error message was returned. The underlying source code has been
modified, and sepolicy.search() now works correctly. (BZ#1092356)

• Due to a missing variable, the "sepolicy manpage" command generated files with

names that included only a suffix, for example ".html". Also, the /tmp/RHEL7/
directory was not created as expected. This update provides a patch to fix this
bug, and "sepolicy manpage" now works as intended. (BZ#1103292)

Users of policycoreutils are advised to upgrade to these updated packages, which
fix these bugs.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64

Fixes

• BZ - 1075023 - sepolicy interface test fails on selinux_genbool
• BZ - 1082676 - Using /etc/selinux/fixfiles_exclude_dirs messes up the context on filesystem
• BZ - 1082956 - restorecond logs unnecessary messages when created file exists very shortly
• BZ - 1084390 - Leftover in semanage common manpage about examples
• BZ - 1085246 - Incorrect lowercased -s option in usage message and man pages of several semanage commands
• BZ - 1092356 - sepolicy.search() results are sometimes wrong
• BZ - 1103292 - sepolicy manpage does not create RHEL7 directory

CVEs

(none)

References

(none)