RHBA-2015:1616 - Bug Fix Advisory

Topic

An updated selinux-policy package that fixes several bugs is now available for
Red Hat Enterprise Linux 6.

Description

The selinux-policy package contains the rules that govern how confined processes
run on the system.

This update fixes the following bugs:

• Prior to this update, SELinux unintentionally prevented Gluster from

connecting to remote procedure call (RPC) services on NFS clients. This update
modifies the relevant SELinux policies, and Gluster now connects to RPC services
successfully. (BZ#1248515)

• Due to insufficient SELinux policy rules for the glusterd service, gluster

monitored nodes failed with an Access Vector Cache (AVC) denial error. With this
update, SELinux policy rules for glusterd have been fixed to allow the Gluster
layer product to work with SELinux properly. (BZ#1248517)

• Attempting to set up the Gluster storage on an NFS-Ganesha cluster previously

failed with an Access Vector Cache (AVC) denial error. The responsible SELinux
policy has been adjusted to allow handling of volumes mounted by NFS-Ganesha,
and the described failure no longer occurs. (BZ#1248525, BZ#1248520)

• Previously, due to an Access Vector Cache (AVC) denial error, CTDB failed to

start the smb service and remained in the UNHEALTHY state. This update modifies
the relevant SELinux policies, and CTDB is now able to start smb service as
expected. (BZ#1248526)

• Previously, for the winbind and nmbd processes, improper SELinux rules were

set. Consequently, when SELinux was set to enforcing mode with Windows Active
Directory setup for Samba and Gluster, the domain user failed to access the
Samba share. This update provides the missing SELinux policies, and the share
access now proceeds successfully. (BZ#1249033)

Users of selinux-policy are advised to upgrade to this updated package, which
fixes these bugs.

Solution

Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.7 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 6.7 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 6.7 ppc64
• Red Hat Enterprise Linux for SAP Solutions for x86_64 - Extended Update Support 6.7 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.7 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.7 i386
• Red Hat Enterprise Linux EUS Compute Node 6.7 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 1248515 - [SELinux] SElinux prevents Gluster/NFS from connecting to RPC services on NFS-clients (RHEL-6)
• BZ - 1248520 - [SELinux] [nfs-ganesha]: seeing avc denied error message for showmount, while doing a volume start - Rhel6.7
• BZ - 1248525 - [SELinux] nfs-ganesha: AVC denied for nfs-ganesha.service , ganesha cluster setup fails in Rhel6.7
• BZ - 1248526 - [SELinux] SMB: SELinux policy to be set for /usr/sbin/ctdbd_wrapper - RHEL-6.7
• BZ - 1249033 - [SELinux]: Issues in setting up Windows Active directory with samba and access of share denied using domain users (RHEL-6.7)

CVEs

(none)

References

(none)