RHBA-2015:1552 - Bug Fix Advisory

Topic

Updated selinux-policy packages that fix several bugs are now available for Red
Hat Enterprise Linux 7.

Description

The selinux-policy packages contain the rules that govern how confined processes
run on the system.

This update fixes the following bugs:

• Previously, initializing a geo-replication session between a master cluster

and a slave cluster failed when SELinux was in enforcing mode. This update
modifies how the ssh-keygen service handles the
/var/lib/glusterd/geo-replication/secret.pem file, and the geo-replication
session is now initialized successfully. (BZ#1232755)

• On Gluster nodes monitored by the Nagios application, the syslogd utility was

not able to run Nagios plug-ins. This update introduces a new Boolean called
logging_syslogd_run_nagios_plugins, which enables syslogd to run such plug-ins
properly. (BZ#1238963)

• With this update, SELinux policy rules for the glusterd service have been

fixed to allow the Gluster layer product to work with SELinux properly.
(BZ#1238964)

• Previously, SELinux was unintentionally preventing the Bash shell from

executing various hook scripts in the /var/lib/glusterd/hooks/ directory.
SELinux policy rules have been adjusted to allow for correct handling of various
Gluster-related services, such as smb, nmb, or ctdb. As a result, the affected
hook scripts can now be executed properly. (BZ#1238965)

• When running the Nagios application with the PNP4Nagios module, PNP4Nagios

failed to load. With this update, the nagios_run_pnp4nagios Boolean has been
introduced to allow Nagios to execute files in the
/var/log/nagios/spool/checkresults directory, and PNP4Nagios now loads as
expected. (BZ#1238966)

• Prior to this update, the crond service was not able to read files placed on

the NFS, CIFS, and FUSE file systems. This update introduces the
cron_system_cronjob_use_shares Boolean, which enables crond to use these file
systems. As a result, the described problem no longer occurs. (BZ#1238978)

• Previously, migrating a Gluster volume on an NFS-Ganesha cluster failed when

SELinux was in enforcing mode. The responsible SELinux policy has been
corrected, and the described migration now proceeds successfully. (BZ#1248658)

• Prior to this update, SELinux unintentionally prevented Gluster from

connecting to remote procedure call (RPC) services on NFS clients. This update
modifies the relevant SELinux policies, and Gluster now connects to RPC services
as expected. (BZ#1248656)

• After multiple CTDB cluster nodes were rebooted one after another while I/O

from a Windows client was set, the status of the cluster was incorrectly
displayed as UNHEALTHY and the status of the nodes as BANNED or DISCONNECTED.
With this update, the related SELinux policy no longer prevents signal
transmission between the CTDB cluster and certain Samba processes. As a result,
the status of the cluster and the nodes displays properly in the above
situation. (BZ#1248655)

• Attempting to set up Gluster storage on an NFS-Ganesha cluster previously

failed due to an Access Vector Cache (AVC) denial error. The responsible SELinux
policy has been adjusted to allow handling of volumes mounted by NFS-Ganesha,
and the described failure no longer occurs. (BZ#1248653, BZ#1241400)

Users of selinux-policy are advised to upgrade to these updated packages, which
fix these bugs.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.2 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.1 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.2 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.1 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.2 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.1 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.3 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.2 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.1 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.2 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.1 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.3 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.2 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1232755 - [SELinux]: [geo-rep]: SELinux policy updates required in RHEL-7.1 for geo-rep
• BZ - 1238965 - [SELinux] [RHGS] Update the labelling for all the executable hooks under /var/lib/glusterd/hooks/ on RHEL-7.1
• BZ - 1238966 - [SELinux] [RHSC] PNP4Nagios AVC denial - RHEL-7.1.z
• BZ - 1238978 - [SELinux] crond complains Unauthorized SELinux context=... when reading files labeled cifs_t, nfs_t, fusefs_t - RHEL-7.1.z
• BZ - 1248653 - [SELinux] nfs-ganesha: AVC denied for nfs-ganesha.service , ganesha cluster setup fails in Rhel7
• BZ - 1248655 - [SELinux]: CTDB node goes to DISCONNECTED/BANNED state when multiple nodes are rebooted (RHEL-7)
• BZ - 1248657 - [SELinux] [nfs-ganesha]: seeing avc denied error message for showmount, while doing a volume start - (RHEL-7)
• BZ - 1248658 - [SELinux] [nfs-ganesha]: Volume export fails when SELinux is in Enforcing mode - RHEL-7

CVEs

(none)

References

(none)