RHBA-2015:1140 - Bug Fix Advisory

Topic

An updated selinux-policy package that fixes several bugs is now available for
Red Hat Enterprise Linux 7.

Description

The selinux-policy package contains the rules that govern how confined processes
run on the system.

This update fixes the following bugs:

• When running Nagios with the PNP4Nagios module, PNP4Nagios failed to

load. With this update, the nagios_run_sudo boolean has been updated to allow
Nagios to execute files with the nagios_log_t SELinux label, and PNP4Nagios now
loads as expected. (BZ#1230292)

• When some Nagios plug-ins executed remotely via Nagios Remote Plug-in Executor

(NRPE) needed to be run using sudo, these plug-ins terminated unexpectedly if
SELinux was in enforcing mode. A new nagios_run_sudo boolean has been added to
fix this bug, and Nagios plug-ins are now called successfully. (BZ#1230299)

• While running Red Hat Gluster Storage distributed hash table (DHT) automation

on Red Hat Enterprise Linux 7, SELinux Access Vector Cache (AVC) error messages
were previously returned. The underlying source code has been fixed, and AVC
messages are no longer displayed. (BZ#1231649)

• Due to missing SELinux policy rules, when running the "gluster snapshot create

[snapName]" command, snapshot create operation failed on Red Hat Enterprise
Linux 7 when SELinux was in enforcing mode. With this update, snapshot is
supported for thinly provisioned Logical Volumes (LVs), and snapshot creation
with SELinux in enforcing mode now succeeds. (BZ#1231930)

• With SELinux in enforcing mode, when a gluster volume was started,

gluster hook scripts were not executed by the glusterd daemon because of wrong
SELinux security labels for these hooks. As a consequence, the samba start hook
script failed to execute and did not create a share in the smb.conf file. The
SELinux security context has been updated for these hooks to be of a bin_t
SELinux type, and the samba share is now created in smb.conf after a gluster
volume starts. (BZ#1231942)

Users of selinux-policy are advised to upgrade to this updated package, which
fixes these bugs.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.2 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.1 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.2 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.1 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.2 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.1 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.3 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.2 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.1 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.2 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.1 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.3 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.2 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1230292 - [SELinux] [RHSC] PNP4Nagios AVC denial
• BZ - 1230299 - [SELinux] [Nagios] SELinux blocks Nagios/NRPE plugins which use sudo
• BZ - 1231649 - [SELinux] [BVT]: Fix SELinux AVC errors produced while running RHGS DHT automation on RHEL 7
• BZ - 1231930 - [SELinux] [Snapshot] - Gluster/Snapshot creation fails when selinux is in Enforcing mode on RHEL-7.1
• BZ - 1231942 - [SELinux] RHEL7:SMB:Update SELinux policies for samba in RHEL7.1

CVEs

(none)

References

(none)