RHBA-2015:0985 - Bug Fix Advisory

Topic

Updated selinux-policy package that fixes several bugs and adds one enhancement
is now available for Red Hat Enterprise Linux 7.

Description

The selinux-policy package contains the rules that govern how confined processes
run on the system.

This update fixes the following bugs:

• When using the SELinux Multi-Level Security (MLS) policy, an attempt to use

SSH to log in to the system with a non-default security level failed. With this
update, the SELinux context for the OpenSSH server has been modified to allow
the user log in to the system successfully in the described situation.
(BZ#1204778)

• When starting the IPsec service, the automatically called "ip" command

modifies the inherited file descriptor, which was previously prohibited by
SELinux and thus generated an error message. With this update, a "dontaudit"
access vector (AV) rule has been introduced that ensures that the error message
is no longer displayed. (BZ#1205580)

• Prior to this update, when using SELinux in enforcing mode, certain commands

in the mongo shell failed due to an incomplete MongoDB policy. This update
adjusts the MongoDB policy to address this problem, and the impacted commands
now work in the mongo shell as expected. (BZ#1212970)

• Prior to this update, the mongos binary and the mongos SysV init scripts did

not have the SELinux context defined. This update fixes the bug by adding the
respective SELinux context. (BZ#1214194)

• The /etc/my.cnf.d/ directory previously had only the default etc_t SELinux

context defined, which was not sufficient. A more specific context for the
/etc/my.cnf.d/*cnf configuration files has been added to the mysql SELinux
policy, thus fixing this bug. (BZ#1214235)

• When a MariaDB plug-in was added to the server.cnf or my.cnf files and the

user was created to authenticate using Pluggable Authentication Module (PAM) in
the mysqld service, the plug-in could not be loaded. To fix this bug, SELinux
policy rules have been updated, and the plug-in is now loaded successfully.
(BZ#1214236)

• A number of daemons contained in Red Hat Software Collections, including

daemons for the MariaDB, MongoDB, and MySQL databases, were previously executed
with incorrect SELinux contexts. This update corrects the related SELinux
policy, and the affected daemons now run with the appropriate contexts.
(BZ#1217187)

In addition, this update adds the following enhancement:

• The support for the /usr/libexec/mongodb-scl-helper script for Red Hat

Software Collections has been added to the selinux-policy package. This script
ensures that the proper SELinux domain is used for daemons in the MongoDB
database contained in the Red Hat Software Collections. (BZ#1214755)

Users of selinux-policy are advised to upgrade to this updated package, which
fixes these bugs and adds this enhancement.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.2 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.1 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.2 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.1 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.2 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.1 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.3 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.2 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.1 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.2 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.1 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.3 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.2 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1212970 - Missing policy for mongodb
• BZ - 1214194 - No context defined for mongos binary and initscript
• BZ - 1214235 - Undefined context for /etc/my.cnf.d/*cnf configuration files in mysql/mariadb
• BZ - 1214236 - MariaDB auth_pam.so plugin or other auth plugins cannot be used
• BZ - 1214755 - RHSCL mongodb-scl-helper

CVEs

(none)

References

(none)