RHBA-2015:2300 - Bug Fix Advisory

Topic

Updated selinux-policy packages that fix several bugs are now available for Red Hat Enterprise Linux 7.

Description

The selinux-policy packages contain the rules that govern how confined processes run on the system.

This update fixes the following bugs:

• Previously, without updated libcap-ng and policycoreutils packages, there was a privilege escalation due to the SECURE_NOROOT bit being used with the seunshare utility. With updated libcap-ng and policycoreutils packages, the PR_SET_NO_NEW_PRIVS bit is used instead to ensure that a process and its children can not gain new privileges. To reflect these changes, SELinux policy rules have been updated. As a result, all sandbox processes for the sandbox commands run within the same specific SELinux sandbox context providing the process isolation for sandbox processes altogether with private mounts of the /home/ and /tmp/ directories. (BZ#1261938)
• In Red Hat Enterprise Linux 7, services without their own SELinux policy have the unconfined_service_t SELinux type. However, this type provides only a slight benefit coming with advanced process isolation provided by SELinux. With this update, new SELinux domains for the cgdcbxd and swift-container-reconciler processes have been added. (BZ#1072493, BZ#1189462)
• Previously, SELinux policy for Red Hat Gluster Storage (RHGS) components was missing, and Gluster worked correctly only when SELinux was in permissive mode. With this update, SELinux policy rules for the glusterd (glusterFS Management Service), glusterfsd (NFS sever), smbd, nfsd, rpcd, adn ctdbd processes have been updated providing SELinux support for Gluster. (BZ#1191989, BZ#1212923, BZ#1224879, BZ#1229279, BZ#1230369, BZ#1232692, BZ#1240584, BZ#1241095, BZ#1241400, BZ#1242476, BZ#1244272)

Users of selinux-policy are advised to upgrade to these updated packages, which fix these bugs.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.3 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.2 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.3 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 834306 - dovecot is denied to start on s390x because of sys_resource AVC
• BZ - 1073314 - Reshape was stuck
• BZ - 1088904 - Selinux AVC raises when cmpi-fsvol is used
• BZ - 1123574 - [SELinux] [RHSC] PNP4Nagios AVC denial - RHEL-7.2
• BZ - 1145215 - ocf:heartbeat:pqsql AVC denial messages
• BZ - 1176078 - rhsmd send signull to subscription-manager-gui but that is denied by selinux-policy
• BZ - 1179809 - [Openvswitch] [OpenDaylight] SELinux must be disabled to connect ovs to odl
• BZ - 1181476 - selinux: AVC error during iSCSI boot install
• BZ - 1181613 - ifup under mls / sysadm_r cannot execute systemd-sysctl
• BZ - 1184039 - selinux reports AVC during update from 7.0.0 to 7.0.z
• BZ - 1184073 - NTP cannot be enabled or disabled using gnome-control-center: SELinux policy denies access.
• BZ - 1184791 - avc denials for rpc.gssd
• BZ - 1186780 - selinux prevents audit to halt the system
• BZ - 1189185 - apcupsd >= 3.14.13 avc denial for sysfs_t
• BZ - 1191989 - [HC] selinux denials running glusterd
• BZ - 1192338 - selinux-policy prevents openafs-1.6 fileserver from starting
• BZ - 1192810 - typo errors in filename transition rules
• BZ - 1195175 - file context patterns for inn* programs are incorrect
• BZ - 1196555 - avc in mod_passenger "rm /" { getattr }
• BZ - 1197038 - No context defined for mongos binary and initscript
• BZ - 1199585 - SELinux policy for bacula doesn't allow writing to tape devices
• BZ - 1201054 - [SELinux] [Nagios] SELinux blocks Nagios/NRPE plugins which use sudo - RHEL-7.2
• BZ - 1202042 - MariaDB auth_pam.so plugin or other auth plugins cannot be used
• BZ - 1202749 - RabbitMQ node cannot join cluster
• BZ - 1203991 - Undefined context for /etc/my.cnf.d/*cnf configuration files in mysql/mariadb
• BZ - 1204024 - Missing policy for mongodb
• BZ - 1204069 - Everything linked to libgcrypt needs read access to /dev/urandom
• BZ - 1204307 - SELinux prevents google-chrome from reading the /etc/passwd file
• BZ - 1206125 - when SLP support is enabled in ypserv then ypserv service triggers AVCs
• BZ - 1208117 - SELinux policy for bacula doesn't allow writing backup files to NFS/CIFS share
• BZ - 1208298 - After updating to EL 7.1 roundcube package won't work with selinux enabled
• BZ - 1208458 - SELinux denial on sanlock prevents hosted-engine to deploy on iSCSI on rhel 7.1 and centos 7.1
• BZ - 1209518 - redis-server runs as unconfined_service_t because file context pattern is incorrect
• BZ - 1209942 - RHSCL mongodb-scl-helper
• BZ - 1210237 - /dev/vhci and /dev/memory_bandwidth do not have specific SELinux labels
• BZ - 1211520 - pmcd daemon (from pcp suite) requires access to mariadb's socket
• BZ - 1211697 - [Sanlock][RHEL7.0] Sanlock's attempts to read metadata from vdsm's block storage get denied by selinux
• BZ - 1212498 - AVC denials for NetworkManager
• BZ - 1212923 - [SELinux]: [Snapshot]: SELinux policy updates required in RHEL-7.1 for gluster-snapshot
• BZ - 1213540 - [RHEL7] New cobbler dir definitions needed in /var/lib/tftpboot
• BZ - 1213709 - pcp: root pmda needs access to /var/lib/pcp/tmp/pmcd/root.socket
• BZ - 1213740 - pcp: postfix pmda needs access to /var/log/maillog
• BZ - 1214223 - SELinux changes for Cockpit
• BZ - 1218323 - Qpid policy needs to be rewritten.
• BZ - 1218330 - No SELinux boolean to allow tmpwatch on samba_share_t or nfs_t
• BZ - 1220763 - please add default labels for /var/tmp/kadmin_0 and /var/tmp/kiprop_0
• BZ - 1221121 - Setup of 389ds fails due to selinux denial
• BZ - 1221587 - Prosody SELinux policy
• BZ - 1224761 - SELinux is preventing /usr/sbin/gdm from rmdir access on the directory auth-for-gdm-sVurjk
• BZ - 1224879 - [SELinux] RHEL7:SMB:Update SELinux policies for samba in RHEL7.2
• BZ - 1227623 - Merge the latest Fedora 22 policy to RHEL-7.2 policy
• BZ - 1228321 - keepalived gets AVC when loading module
• BZ - 1229279 - [SELinux] [BVT]: Fix SELinux AVC errors produced while running RHGS DHT automation on RHEL 7
• BZ - 1230300 - SELinux AVC denials while restarting Admin Server from Console
• BZ - 1230369 - [SELinux]: [geo-rep]: SELinux policy updates required in RHEL-7.1 for geo-rep
• BZ - 1231377 - new sanlock config file
• BZ - 1232692 - [SELinux] [RHGS] Update the labelling for all the executable hooks under /var/lib/glusterd/hooks/ on RHEL-7.1
• BZ - 1234276 - When running ocf:heartbeat:pgsql resource in enforcing mode, systemd-logind process is not able to send a D-bus message to a cluster service
• BZ - 1234847 - [SELinux] crond complains Unauthorized SELinux context=... when reading files labeled cifs_t, nfs_t, fusefs_t - RHEL-7.2
• BZ - 1234954 - Update SELinux policy for NetworkManager to allow send_msg for hostnamed
• BZ - 1236616 - SELinux prevents systemd-networkd from communicating with sssd
• BZ - 1238061 - libStorageMgmt: SELinux is preventing /usr/bin/lsmd check user `libstoragemgmt`
• BZ - 1238079 - libStorageMgmt: SELinux is preventing HP SmartArray plugin
• BZ - 1238163 - Add SELinux policy for IPA to allow calling out oddjobd-activated services
• BZ - 1240223 - Prosody SELinux policy with GSS-API
• BZ - 1241095 - [SELinux]: CTDB node goes to DISCONNECTED/BANNED state when multiple nodes are rebooted (RHEL-7)
• BZ - 1241400 - [SELinux] [nfs-ganesha]: seeing avc denied error message for showmount, while doing a volume start - (RHEL-7)
• BZ - 1242476 - [SELinux] [nfs-ganesha]: Volume export fails when SELinux is in Enforcing mode - RHEL-7
• BZ - 1243403 - avc: denied { read } for pid=22817 comm="iptables" name="xtables.lock" dev="tmpfs"
• BZ - 1243431 - selinux denials while trying to register to subscription-manager
• BZ - 1243458 - Policy for command setting root/administrator account password
• BZ - 1243764 - Failed to lock /var/run/chrony-helper
• BZ - 1244272 - [SELinux] nfs-ganesha: AVC denied for nfs-ganesha.service , ganesha cluster setup fails in Rhel7
• BZ - 1247114 - SELinux is preventing /usr/bin/lsmd from using the setuid capability
• BZ - 1247279 - [linearstore] Symlink creation fails when running broker as a service
• BZ - 1247880 - [Hyper-V][RHEL 7.2] selinux preventing VSS live backup if there is home partition
• BZ - 1249945 - Update SELinux policy for rh-nginx18 collection
• BZ - 1250550 - Allow snapperd one-way communication with clients via pipe
• BZ - 1250605 - conman denied access to /dev/*random prevents it from starting
• BZ - 1251996 - SELinux is preventing Google Chrome from using the setcap access on a process
• BZ - 1252341 - pmcd need access to temporary files in /var/lib/pcp/tmp/pmlogger
• BZ - 1252937 - samba can not perform join when running in samba_net_t context
• BZ - 1252968 - AVC denials for ipa trusts
• BZ - 1253706 - ipsilon-client-install fails due to AVC on IDP
• BZ - 1255020 - watchdog.d and python script
• BZ - 1255105 - SELinux policy needs to allow httpd to read symlink config file when running Ipsilon
• BZ - 1256757 - SELinux is preventing IPA access to /var/run/ipa/renewal.lock
• BZ - 1257828 - SELinux prevents abrt to run 'journalctl' from abrt's post-mortem scripts
• BZ - 1259786 - Please update the policy for NetworkManager-libreswan-1.0.6
• BZ - 1262718 - ipa-client-install --request-cert fails to retrieve the host certificate
• BZ - 1262812 - selinux-policy-targeted overwrites policy from docker-selinux preventing docker to work properly
• BZ - 1265266 - SELinux not allowing rpcbind to do a chown on /run
• BZ - 1266928 - iscsid related rule is missing

CVEs

(none)

References

• http://www.redhat.com/security/updates/classification/#normal