RHBA-2015:1360 - Bug Fix Advisory

Topic

Updated policycoreutils packages that fix several bugs are now available for Red
Hat Enterprise Linux 6.

Description

The policycoreutils packages contain the core utilities that are required for
the basic operation of a Security-Enhanced Linux (SELinux) system and its
policies.

This update fixes the following bugs:

• Previously, the sepolgen utility was a part of the policycore-gui package,

even though it does not require any GUI. With this update, sepolgen is a part of
the policycore-python package. (BZ#995778)

• The "audit2allow -br" command did not work properly when the "LANG"

environment variable was set to a different language than "US/English". The
underlying source code has been modified, and "audit2allow -br" now works as
expected. (BZ#1111999)

• When running the fixfiles utility in "verify" or "check" mode, fixfiles

changed certain SELinux contexts even if it was not supposed to. With this
update, fixfiles has been modified to only print incorrect SELinux contexts
instead of changing them when running in aforementioned modes. (BZ#1113083)

• The semanage utility previously listed only changes made to the currently used

SELinux policy. For example, when the targeted policy was loaded and changes
were made to the Multi-Level Security (MLS) policy, the "semanage -S mls -o"
command did not list all the changes, even when the changes were applied
correctly. This bug has been fixed, and semanage now lists all changes as
expected. (BZ#1122850)

• A new "noreload" option was implemented for semanage commands in Red Hat

Enterprise Linux 6.6. However, due to a missing reload initialization in the
semanageRecords() function, users could not enable Booleans directly using the
seobject python module that comes from the policycoreutils-python utility. This
bug has been fixed, and users can now set Booleans correctly using the seobject
python module. (BZ#1148062)

Users of policycoreutils are advised to upgrade to these updated packages, which
fix these bugs.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 965397 - chcat cannot assign level/category in full format for user
• BZ - 995778 - sepolgen should be split from policycoreutils-gui
• BZ - 1122850 - semanage -o doesn't work in combination with -S mls
• BZ - 1148062 - attribute error on booleanRecords.modify: no attribute 'load'

CVEs

(none)

References

(none)