RHBA-2015:0953 - Bug Fix Advisory

Topic

An updated selinux-policy package that fixes several bugs is now available for
Red Hat Enterprise Linux 6.

Description

The selinux-policy package contains the rules that govern how confined processes
run on the system.

This update fixes the following bugs:

• Previously, when the rh-passenger40 and httpd24 Software Collections were used

together in SELinux enforcing mode, running the PassengerWatchd process was not
able to connect to the httpd service. With this update, SELinux policy rules
have been updated to prevent this problem, and PassengerWatchd can now access
the httpd service as expected. (BZ#1211706)

• Prior to this update, the SELinux context for the /var/log/mariadb(/.*) path

was not defined. As a consequence, the mariadb service running in the mysqld_t
SELinux process domain was not able to access its own logging files with the
aforementioned location. This update adds the missing SELinux context and thus
allows mariadb service to access its logging files. (BZ#1212846)

• The /etc/my.cnf.d/ directory previously had only the default etc_t SELinux

context defined, which was not sufficient. The undefined specific context for
the /etc/my.cnf.d/*cnf configuration files has been added to the mysql SELinux
policy, thus fixing this bug. (BZ#1212976)

• When a MariaDB plug-in was was added to the server.cnf or my.cnf files and the

user was created to authenticate using Pluggable Authentication Module (PAM) in
the mysqld service, the plug-in could not be loaded. To fix this bug, SELinux
policy rules have been updated, and the plugin is now loaded successfully.
(BZ#1214023)

• Prior to this update, the mongos binary and the mongos SysV init scripts did

not have the SELinux context defined. This update fixes the bug by adding the
respective SELinux context. (BZ#1212972)

Users of selinux-policy are advised to upgrade to this updated package, which
fixes these bugs.

Solution

Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 6.6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 6.6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.6 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.6 i386
• Red Hat Enterprise Linux Server - AUS 6.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux EUS Compute Node 6.6 x86_64
• Red Hat Enterprise Linux Server - TUS 6.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x

Fixes

• BZ - 1211706 - avc in mod_passenger
• BZ - 1212846 - Undefined context for /var/log/mariadb
• BZ - 1212972 - No context defined for mongos binary and initscript
• BZ - 1212976 - Undefined context for /etc/my.cnf.d/*cnf configuration files in mysql/mariadb
• BZ - 1214023 - MariaDB auth_pam.so plugin or other auth plugins cannot be used

CVEs

(none)

References

(none)