RHBA-2017:0627 - Bug Fix Advisory

Topic

An update for selinux-policy is now available for Red Hat Enterprise Linux 6.

Description

The selinux-policy packages contain the rules that govern how confined processes run on the system.

For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.

Users of selinux-policy are advised to upgrade to these updated packages.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 1264977 - BUG: /selinux/checkreqprot should be set to 0 at boot
• BZ - 1286994 - the start of roundup service triggers SELinux denials
• BZ - 1299306 - avc: denied { recvfrom } ...
• BZ - 1299552 - SELinux prevents lighttpd from fstat()-ing inotifyfs
• BZ - 1310077 - vsftpd can access nfs even if allow_ftpd_use_nfs is off under specific conditions
• BZ - 1326718 - [SElinux]: AVC denying read to "/var/lib/pcsd/pcsd.key" observed during gluster nfs-ganesha disable.
• BZ - 1331585 - [SELinux]: Cases in pynfs test suite fails because of selinux errors.
• BZ - 1334606 - AVC found during running python unit tests
• BZ - 1334756 - SELinux is preventing /usr/sbin/asterisk from 'name_connect' accesses on the tcp_socket port 5222
• BZ - 1335733 - [Hyper-V][RHEL6.9]hypervvssd and selinux denials
• BZ - 1336394 - AVC denial when winbind is used
• BZ - 1336590 - libStorageMgmt: SELinux preventing hpsa plugin from running (avc: denial)
• BZ - 1337895 - SELinux prevents kpropd from communicating with sssd
• BZ - 1340150 - AVC denial when assigning USB sound device to QEMU-KVM guest
• BZ - 1365501 - avc error on isnsd when initiator tries to connect to it
• BZ - 1369699 - [qemu-geust-agent] cmd: guest-set-user-password: child process has failed to set user password
• BZ - 1377644 - Missing type enforcement (TE) allow rule.
• BZ - 1378463 - guest_t can run sudo
• BZ - 1384487 - [RHEL6] SELinux prevents FUSE mounting of RDMA transport type volumes
• BZ - 1386181 - Puppet 4 AIO Packages aren't supported by the targeted selinux policy
• BZ - 1389982 - SElinux AVC Failures about nvme
• BZ - 1390657 - SELinux policy breaks rotation of chronyd logs
• BZ - 1390810 - selinux policy bans fail2ban access to shorewall
• BZ - 1391525 - MySQL context for /var/lib/mysql-files
• BZ - 1392525 - SELinux prevents ftpdctl from unlinking its socket
• BZ - 1393938 - RFC: ls -Z /usr/lib/jvm/jre-*-openjdk*/bin/java - java_exec_t vs bin_t - ps java process as xguest
• BZ - 1397117 - /usr/share/conman/exec/ipmitool.exp needs a new selinux type
• BZ - 1397703 - sepgsql_contexts file contains errors
• BZ - 1397802 - SELinux prevents console-kit-daemon from creating /var/log/ConsoleKit directory
• BZ - 1400234 - AVC when hostname as ksh cmd subs in cluster env
• BZ - 1401611 - Selinux prevents ipsec to read /etc/pki/nss-legacy/nss-rhel6.config
• BZ - 1404562 - [SELinux] [Eventing]: gluster-eventsapi shows a traceback while adding a webhook

CVEs

(none)

References

• https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.9_Release_Notes/index.html
• https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.9_Technical_Notes/index.html