RHBA-2016:2283 - Bug Fix Advisory

Topic

An update for selinux-policy is now available for Red Hat Enterprise Linux 7.

Description

The selinux-policy packages contain the rules that govern how confined processes run on the system.

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

Users of selinux-policy are advised to upgrade to these updated packages.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.3 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.3 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64

Fixes

• BZ - 1097775 - ftp_home_dir set to off allows FTP login to user home directory
• BZ - 1101451 - /etc/selinux/targeted/modules/active/*.pp have less restrictive permissions
• BZ - 1115987 - SELinux is preventing /usr/sbin/tmpwatch from 'setattr' accesses on the directory .
• BZ - 1121171 - missing interface definitions
• BZ - 1162305 - mailx fails when used with mail server other than Sendmail Inc sendmail or postfix
• BZ - 1206339 - SELinux prevents /usr/sbin/slappasswd from 'execmod' accesses on the file /usr/sbin/slapadd.
• BZ - 1206525 - pmie and pmlogger do not run in dedicated domains
• BZ - 1210263 - Need SELinux policy updates for InfiniBand: RDMA migration fails with SELinux
• BZ - 1212324 - sanlk-resetd runs as unconfined_service_t
• BZ - 1213409 - selinux-policy: Update for abrt changes
• BZ - 1236579 - systemd-resolved is not confined
• BZ - 1236580 - systemd-machined is not confined
• BZ - 1238066 - libStorageMgmt: SELinux is preventing MegaRAID plugin
• BZ - 1246780 - Need exception for wp_backup directory
• BZ - 1254188 - SELinux is preventing abrt-hook-ccpp from using the 'sigchld' accesses on a process.
• BZ - 1256374 - Compiling Ceph with lttng requires additional selinux policy changes
• BZ - 1257057 - AVC denial: scontext=system_u:unconfined_r:passwd_t:s0 tcontext=system_u:object_r:user_tmp_t:s0 tclass=dir
• BZ - 1258029 - /dev/mpt2ctl does not have a specific SELinux label
• BZ - 1260306 - Improper SELinux contexts for nagios cgi executables
• BZ - 1260536 - AVC is triggered when accessing ganglia web UI
• BZ - 1260835 - cimserver is blocked by SELinux
• BZ - 1261857 - /usr/share/nginx/html should be httpd_sys_content_t
• BZ - 1263339 - SELinux prevents CIM provider from reading /var/lib/sss/mc/initgroups file
• BZ - 1263770 - rsyncd getting AVC denials despite rsync_export_all_ro
• BZ - 1264390 - storaged path has changed --> runs as unconfined_service_t
• BZ - 1265102 - SELinux prevents cupsd from creating /etc/printcap
• BZ - 1267367 - fence_virtd cannot connect remotely due to selinux
• BZ - 1270344 - selinux denies pmdaapache access to port 80 for apache diagnostics
• BZ - 1271159 - cannot load some policy modules which contain SELinux admin interfaces
• BZ - 1271209 - add file context for /usr/libexec/mock/mock
• BZ - 1273451 - Need a new selinux policy type for 389-admin
• BZ - 1275246 - SELinux prevents redis-sentinel from writing to /etc/redis-sentinel.conf
• BZ - 1276381 - Squid fails to start with under SELinux MLS
• BZ - 1278028 - lvmlockd runs as unconfined_service_t
• BZ - 1278495 - Got 17 "avc denied" messages on starting up openvswitch service
• BZ - 1278777 - invalid filename is used in file context pattern for pegasus configuration file
• BZ - 1279429 - cockpit-ws should be able to write to /run/cockpit-ws
• BZ - 1280280 - restorecon sets an incorrect label on /var/run/tgtd.ipc_abstract_namespace.0.lock file
• BZ - 1282543 - Confined users cannot run postgresql-setup
• BZ - 1283134 - SELinux interferes with a logrotate job which uses su
• BZ - 1283955 - cockpit-ws should be able to write to /run/cockpit-ws
• BZ - 1284908 - SELinux prevents snort from communicating with sssd
• BZ - 1284972 - Extend SELinux boolean tmpreaper_use_samba to cover cifs_t as well
• BZ - 1286020 - dspam tries to read /etc/passwd
• BZ - 1286234 - SELinux is preventing pmlogger from 'create' accesses on the lnk_file pmlogger.primary.socket.
• BZ - 1286851 - ip netns exec needs more permissions
• BZ - 1288255 - staff_t and sysadm_t should be able to read Journald.
• BZ - 1289274 - SELinux prevents dmidecode from reading /dev/urandom
• BZ - 1290400 - Cannot login after booting to emergency / rescue mode in MLS
• BZ - 1292318 - SELinux is preventing /usr/sbin/ip from mounton access on the directory /.
• BZ - 1293140 - SELinux policy changes to make NSD4 work
• BZ - 1293784 - (RHEL7) CTDB: SELinux: AVC's triggered while executing smbcontrol via 49.winbind script
• BZ - 1293788 - (RHEL7) CTDB: SELinux: ctdb disablescript fails to execute because of SELinux avc's
• BZ - 1295680 - [SELinux] Occasionally observing AVC's denied while running geo-rep automation
• BZ - 1296640 - Open vSwitch 2.5 needs new SElinux policy after introducing --user argument
• BZ - 1296851 - Correct SELinux context for stunnel logging
• BZ - 1296867 - SELinux man pages are placed in -devel subpackage instead of -doc subpackage.
• BZ - 1297323 - /usr/share/conman/exec/ipmitool.exp needs a new selinux type
• BZ - 1297325 - Correct selinux context for stunnel logging
• BZ - 1297480 - Confined users cannot run oddjob mkhomedirfor script
• BZ - 1298151 - SELinux prevents systemd-networkd from writing to /dev/kmsg
• BZ - 1301186 - Mediawiki 1.26.X require additional rules.
• BZ - 1301516 - mimedefang processes run as unconfined_service_t because their wrapper has bin_t
• BZ - 1301637 - SELinux is preventing /usr/libexec/qemu-kvm from read access on the file /var/db/nscd/group.
• BZ - 1301854 - dhcpd selinux policy doesn't handle on-commit scripts
• BZ - 1303514 - AVC denials on atomic host while running RHGS container
• BZ - 1303644 - setrlimit is allowed for all domains
• BZ - 1303651 - update to selinux-policy-mls package to include recent database related refpolicy changes
• BZ - 1303709 - coolkey modules wants to access files in /var/cache/coolkey/ and p11_child is currently not allowed to access those files
• BZ - 1304664 - Prosody SELinux policy (bind port 5281)
• BZ - 1304721 - firewall-cmd broken with setenforce 1
• BZ - 1304723 - Allow {ip|ip6|eb}tables-restore to use read and getattr on files in (/var)/run/firewalld
• BZ - 1305325 - AVC seen with during ipa-server upgrade test execution
• BZ - 1305469 - SElinux is preventing cron Spamassassin update (sa-update.cron) through proxy
• BZ - 1306197 - SELinux is preventing systemd from 'getattr' accesses on the file /etc/ssh/ssh_host_rsa_key.
• BZ - 1306403 - Test case failure: /CoreOS/util-linux/Regression/bz712158-uid-gid-overflow-in-ipcs
• BZ - 1306995 - SELinux prevents Mongodb from writing to syslog
• BZ - 1309361 - [Hyper-V][RHEL7.3]Grant hyperv-daemons access to /dev/vmbus/hv_* devices
• BZ - 1309404 - rpm-ostreed needs install_exec_t
• BZ - 1309417 - AVC denied messages related to kmsg_device_t since latest updates
• BZ - 1309883 - selinux preventing pcp dmcache metrics collection (access to dmsetup denial)
• BZ - 1311606 - RFE: Add strict domain for confining virtlogd daemon
• BZ - 1312809 - [SELinux]: Found avc of type=USER_AVC for class dbus during glusterfs-ganesha validation -RHEL7
• BZ - 1312949 - Remove old permissive SELinux domains in selinux-policy distgit repository
• BZ - 1315332 - Sanlock fails to acquire lock for ceph device due to SELinux denials
• BZ - 1315700 - Libreswan XAUTH server mode uses pam
• BZ - 1315779 - Current Rawhide Workstation live image does not reach GDM due to mislabelled /run/systemd/inhibit and /run/user/1000
• BZ - 1316678 - avc: denied { dac_override } comm="fail2ban-client"
• BZ - 1316724 - SELinux prevents kdm from accessing /sbin/poweroff
• BZ - 1316917 - Using docker interfaces in rhel distro policy breaks selinux-policy rpm build
• BZ - 1316918 - SELinux does not allow Prosody to listen on port 5000 for mod_proxy65
• BZ - 1318224 - SELinux is preventing /usr/sbin/unbound from name_bind access on the udp_socket port 61000.
• BZ - 1319442 - Allow hugetlbfs for apache
• BZ - 1319493 - zabbix agent cannot test local network services
• BZ - 1320973 - Current Rawhide Workstation live image does not reach GDM due to mislabelled /run/systemd/inhibit and /run/user/1000
• BZ - 1321049 - Prosody SELinux policy (saslauthd)
• BZ - 1321614 - cronie does not load system crontabs under mls policy
• BZ - 1321785 - [SELinux] user_avc seen in audit logs while nfs-ganesha configuration -RHEL7
• BZ - 1321787 - SELinux prevents prosody from name_bind to TCP port 5582
• BZ - 1322725 - SELinux policy (daemons) changes required for package: sbd
• BZ - 1323673 - SELinux policy doesn't allow mysql to open more than 1024 files
• BZ - 1323947 - [SELinux]: AVC's denying permissions related to statd, observed in nfs-ganesha environment -RHEL7
• BZ - 1324144 - Allow oddjobd to execute IPA replica connection check
• BZ - 1326818 - SELinux prevents collectd from setgid operation
• BZ - 1328246 - Missing SELinux rule for management socket file
• BZ - 1329475 - Selinux denials while starting rhsmcertd service
• BZ - 1329560 - Merge policy-RHEL-7.1-flask.patch with policy-rhel-7.3-base.patch files in selinux-policy distgit
• BZ - 1330479 - zabbix can not listen on the postgresql port 5432/tcp
• BZ - 1331542 - SELinux prevents logwatch from running postqueue
• BZ - 1331561 - [SELinux]: Cases in pynfs test suite fails because of selinux errors.
• BZ - 1333198 - RFE: Please include this policy in dirsrv.te
• BZ - 1333435 - [PPC][rhevm-3.6.6-0.1] Host cannot see other block disks created from the other hosts as SPM(seems lvm related)
• BZ - 1333726 - SELinux prevents xinetd-spawned process from su
• BZ - 1333952 - Wrong SELinux label on /etc/group after installation
• BZ - 1334783 - Label couple of tcp/udp ports to allow custom policies to bind/connect to these ports
• BZ - 1335024 - Open vSwitch 2.4 needs new SElinux policy
• BZ - 1336662 - Spec file scripts show unnecessary error messages
• BZ - 1336722 - allow NetworkManager to talk to dnsmasq via D-Bus
• BZ - 1336760 - [SELinux]: refresh-config fails with denial AVC related to /usr/bin/dbus-daemon
• BZ - 1337319 - rhsmcertd problem connecting to port 9090 due to selinux
• BZ - 1340542 - Need backported fix for install_exec_t (or rpm_exec_t) for rpm-ostreed
• BZ - 1340572 - Policy for "ip netns add" should cover dirs, not just files
• BZ - 1341257 - docker requires an updated selinux-policy-targeted for interfaces it uses to be mainstream
• BZ - 1342235 - SELinux is preventing /usr/sbin/ebtables-restore from getattr access on the file /run/firewalld/temp.gOUgl_.
• BZ - 1343776 - "ip netns del" cannot unmount /run/netns/*
• BZ - 1343929 - [SELinux]: kerberos mount fails with selinux denials in audit logs.
• BZ - 1344056 - SELinux prevents collectd from connecting to PostgreSQL UNIX socket
• BZ - 1344500 - rhsmcertd fails to see /etc/docker/certs.d/ when selinux is Enforcing
• BZ - 1344505 - avc: denied { create } for pid=757 comm="NetworkManager" name="resolv.conf.WY7ZIY
• BZ - 1344828 - sysadm_t cannot run newaliases (postfix)
• BZ - 1346316 - SELinux is preventing /usr/bin/python2.7 from 'write' accesses on the directory /etc/sysconfig/network-scripts.
• BZ - 1346464 - Tuned in RHEL-7.3 should use polkit
• BZ - 1346900 - some cluster related directories are mislabeled because of a missing type_transition rule
• BZ - 1347514 - Enhance corosync policy to include two new daemons
• BZ - 1348471 - Additional ports required in selinux-policy for redis
• BZ - 1349058 - avc: denied {open | read | write) comm="ipmievd" path="/dev/ipmi0" dev="devtmpfs" generated after staring ipmievd service
• BZ - 1349356 - [Hyper-v][RHEL7.3] Selinux AVC: avc: denied { getattr } for pid=2627 comm="restorecon" name="/" in audit log.
• BZ - 1349791 - nsd runs openssl which triggers a SELinux denial
• BZ - 1349812 - avc denial when starting LXC Container
• BZ - 1350535 - sssd needs access to /etc/sssd/conf.d
• BZ - 1350957 - ipa named-pkcs11 failed to enumerate object store
• BZ - 1351382 - /etc/sysconfig/libvirtd should not be labeled bin_t
• BZ - 1352681 - Add snapperd_contexts file
• BZ - 1352710 - SELinux is preventing creation of vpnaas in openstack
• BZ - 1355783 - virt_sandbox_use_nfs not created when docker-selinux 1.10.3-44.el7 installed causing OpenShift install failure
• BZ - 1355809 - Mislabeled file /dev/ndctl0 system_u:object_r:device_t:SystemLow
• BZ - 1356082 - adcli fails to update /etc/krb5.keytab for keytab renewal
• BZ - 1357857 - guest_t can run sudo
• BZ - 1361000 - file contexts from custom SELinux policy modules are discarded when upgrading policy
• BZ - 1361636 - Selinux prevents IPA from running oddjob required for AD trusts functionality
• BZ - 1362273 - SELinux prevents ModemManager from sending a D-bus message to systemd-logind and vice versa
• BZ - 1362688 - p11_child denied access to ipc_lock
• BZ - 1363662 - avc: denied message during IPA replica install
• BZ - 1365171 - MD RAID5 grow stuck
• BZ - 1365214 - SELinux is preventing gdbus from 'write' accesses on the fifo_file /run/systemd/inhibit/1.ref.
• BZ - 1365653 - Failure to configure team with ifcfg
• BZ - 1366649 - IdM DNSSEC component is broken because too restrictive SELinux policy
• BZ - 1366731 - SELinux prevents spice-vdagent to get property from systemd-logind
• BZ - 1366915 - AVC seen during IdM automatic cert renewal
• BZ - 1367834 - New cloud-init version requires dhclient to call cloud-init
• BZ - 1368418 - SELinux is preventing com.redhat.idm. from connectto access on the unix_stream_socket /run/slapd-<>.socket
• BZ - 1369159 - label /var/lib/kubelet svirt_sandbox_file_t
• BZ - 1369693 - [qemu-guest-agent] cmd: guest-set-user-password: child process has failed to set user password
• BZ - 1369938 - Puppet 4 AIO Packages aren't supported by the targeted selinux policy
• BZ - 1372677 - SELinux is preventing makepkg from 'send' accesses on the message Unknown.
• BZ - 1372705 - couple of interface definitions needed in selinux-policy
• BZ - 1375462 - VM can't be started if its name contains special word, denied by selinux policy
• BZ - 1377259 - SELinux blocks collectd socket

CVEs

(none)

References

(none)