RHBA-2017:1861 - Bug Fix Advisory

Topic

An update for selinux-policy is now available for Red Hat Enterprise Linux 7.

Description

The selinux-policy packages contain the rules that govern how confined processes run on the system.

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

Users of selinux-policy are advised to upgrade to these updated packages.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1134883 - SELinux with Pacemaker and DRBD leads to AVC denieds
• BZ - 1146987 - /bin/su returns segmentation fault for sysadm_r in SELinux policy MLS
• BZ - 1167468 - Files in /etc/mail have wrong context
• BZ - 1277506 - SELinux prevents condor_schedd from executing sendmail
• BZ - 1277718 - SELinux is preventing nrpe plugins from executing
• BZ - 1278010 - D-bus communication between systemd-networkd and unconfined triggers an USER_AVC
• BZ - 1281716 - SELinux prevents rpcbind from shmemnetgrp and getnetgrp operations against nscd
• BZ - 1286474 - ipactl does not work correctly if administrator is an selinux confined user
• BZ - 1290633 - Cannot run setup-ds.pl as confined user.
• BZ - 1303126 - Upgrade of selinux-policy-targeted emits warnings
• BZ - 1312972 - BIND - open_socket / permission denied warnings
• BZ - 1325527 - SELinux policy breaks squid's ssl_crtd
• BZ - 1331309 - [Hyper-V][RHEL7.3]hypervvssd and selinux denials
• BZ - 1336211 - SELinux policy prevents reading PCP process metrics
• BZ - 1337041 - Selinux is preventing the masking of iptables service
• BZ - 1342930 - openonload applications fail inside containers
• BZ - 1349394 - Certmonger needs to be able to restart OpenStack services.
• BZ - 1349798 - Denial AVC's related to dbus daemon is seen in audit.logs
• BZ - 1359789 - avc: denied { read } for pid=25872 comm="iptables" name="xtables.lock
• BZ - 1365947 - systemd-initctl runs as init_t
• BZ - 1365953 - systemd-bootchart runs as init_t
• BZ - 1369376 - SELinux prevents sendmail from searching in /proc/sys/net directory
• BZ - 1373082 - SELinux is preventing /usr/libexec/colord from read access on the file /etc/udev/hwdb.bin.
• BZ - 1373321 - Can't deploy an overcloud because selinux blocks neutron_t to access unlabeled_t files (nsfs)
• BZ - 1379371 - AVCs when restarting pmlogger
• BZ - 1379736 - SELinux is preventing /usr/sbin/postdrop from 'read' accesses on the fifo_file fifo_file.
• BZ - 1379781 - /usr/libexec/rhsmcertd-worker (rhsmcertd_t) sends signull to kernel_t
• BZ - 1380854 - "Indepedent selinux policy" project (internal) documentation
• BZ - 1381588 - sebooleans get reset on image based systems / RHVH status is Non Responsive in RHVM side after upgrade from RHVH 4.0_7.2 to 4.0_7.3
• BZ - 1383784 - selinux: ganesha permissions when running NFS-Ganesha without using glusterfs
• BZ - 1384483 - Snapshot : Seeing AVC denied messages generated when snapshot and clones are created
• BZ - 1384488 - [RHEL7] SELinux prevents starting of RDMA transport type volumes
• BZ - 1386233 - haproxy requires fowner capability when non-root user is used for a socket file
• BZ - 1386916 - remove docker.pp from selinux-policy and replace with container.pp
• BZ - 1391521 - MySQL context for /var/lib/mysql-files
• BZ - 1392010 - selinux-policy-targeted: Error during rhel 7.3 Update
• BZ - 1393332 - unable to start zabbix agent after upgrade to RHEL 7.3
• BZ - 1393505 - systemd generates USER_AVCs after selinux-policy update
• BZ - 1399250 - Puppet cannot run timedatectl after upgrade to RHEL 7.3
• BZ - 1400493 - AVCs seen when ganesha cluster nodes are rebooted
• BZ - 1402316 - cockpit-session cannot change limits
• BZ - 1402451 - CTDB:NFS: CTDB failover doesn't work because of SELinux AVC's
• BZ - 1402561 - Unable to launch instance when /var/lib/nova/instances is mounted on an NFS share
• BZ - 1403254 - Running systemd in container produces AVC denial about writing to max_dgram_qlen
• BZ - 1403718 - failed to install selinux policies from containers-selinux when installing docker 1.12
• BZ - 1404152 - [SELinux] [Eventing]: gluster-eventsapi shows a traceback while adding a webhook
• BZ - 1404213 - postfix generating SELinux AVCs when IPv6 disabled
• BZ - 1405175 - Upgrade fails %post: Re-declaration of type pkcsslotd_t
• BZ - 1405441 - ip6tables service on EL 7.3 fails to start due to invalid context file
• BZ - 1405479 - SELinux blocks OVS to run 'hostname'
• BZ - 1406439 - the /sbin symlink is not labelled in the targeted policy
• BZ - 1408275 - [ppc] [rhevm-3.6] Host cannot see other block disks created from the other hosts as SPM(seems lvm related)
• BZ - 1410053 - specific label needed for /dev/mei0
• BZ - 1413064 - Freeradius after rebase has started to produce avcs
• BZ - 1413509 - Failed to login the remote host on cockpit login page.
• BZ - 1414130 - Re-declaration of docker_t error when upgrade selinux-policy-targeted
• BZ - 1415715 - SELinux is preventing systemctl from write access on the chr_file kmsg.
• BZ - 1415841 - staff_u cannot access virtual machine guest consoles in libvirt
• BZ - 1416780 - Update SELinux policy for SSSD
• BZ - 1417846 - KRB proxy cert files creation fails during FreeIPA installation
• BZ - 1418391 - Firewalld update to 0.4.4 needs selinux-policy update
• BZ - 1420612 - Selinux denies directory server access to create dir in var lock
• BZ - 1421247 - start of colord causes selinux denial, comm="colord" name="hwdb.bin"
• BZ - 1421248 - avc: denied { chown } for pid=28835 comm="chronyd"
• BZ - 1424728 - SELinux prevents cyrus imapd from using gssproxy
• BZ - 1425357 - AVC: nmbd calls epoll_ctl
• BZ - 1425530 - cherry pick nextcloud policy from fedora
• BZ - 1426106 - SELinux is preventing qemu-system-x86 from 'search' accesses on the directory 3278.
• BZ - 1426205 - Silence denials of, or provide a way to allow PCRE JIT mmap for FreeRADIUS
• BZ - 1426554 - nfs-ganesha triggers SELinux denials when running as ganesha_t
• BZ - 1426641 - Permit ptrace for FreeRADIUS
• BZ - 1428112 - 'sysroot' directory under ostree deployment directory has 'default_t' label
• BZ - 1432083 - tomcat_t domain is in unconfined_domain
• BZ - 1432115 - AVCs caused by FreeIPA code change
• BZ - 1432645 - selinux-policy should reflect gdm behavior changes
• BZ - 1432783 - Selinux denying sanlock access to /rhev/data-center/mnt/server:_path/uuid/dom_md/ids mounted using nfs v4.2
• BZ - 1434286 - SELinux is preventing /usr/libexec/geoclue from 'sendto' accesses on the unix_dgram_socket /run/systemd/journal/socket.
• BZ - 1435264 - openssh package openssh-6.6.1p1-33.el7_3 does not resolve chroot permission denied status.
• BZ - 1436383 - AVC denial during pkispawn of CA
• BZ - 1436689 - AVC denials during ipa-server-install
• BZ - 1436988 - ganesha_t is listed as permissive domain even if permissivedomains module is disabled
• BZ - 1438036 - rpc.gssd fails to call into gssproxy
• BZ - 1438708 - firewalld can not write dm-0
• BZ - 1440165 - SELinux policy (daemons) changes required for package: sbd - due to enabling block-device support
• BZ - 1441375 - AVC denial on gnome-shell during smartcard login
• BZ - 1443391 - Failure noticed for selinux policy package updation during ipa-upgrade process.
• BZ - 1444955 - SELinux prevents sssd/selinux_child from using net_admin capability
• BZ - 1445494 - selinux denials for rhsmcertd-worker
• BZ - 1446145 - Selinux prevents freeradius to connect to postgresql
• BZ - 1447436 - HSM related denial with Red Hat Cert System
• BZ - 1447669 - [SELinux] statedump is not able to dump the file in /var/run/gluster because of SELinux permissions.
• BZ - 1448056 - sssd-secrets should not run as unconfined_service_t
• BZ - 1448060 - sssd-kcm should not run as unconfined_service_t
• BZ - 1448090 - [GANESHA] AVC denials for unreserved port observed while changing RQUOTA port in ganesha.conf file
• BZ - 1449064 - [Hyper-V][RHEL7.4]After update to RHEL7.4beta, IP injection causes that SELinux prevents ifdown from executing hostname
• BZ - 1449769 - AVC denials in keepalived on startup
• BZ - 1449977 - SELinux is preventing /usr/libexec/qemu-kvm from 'ioctl' accesses on the blk_file /dev/sdb.
• BZ - 1451318 - Spacewalk does not run on rhel7.4 due to tomcat avc denials
• BZ - 1451735 - rngd produces AVC denial about /sys/devices/virtual/misc/hw_random/rng_available
• BZ - 1451757 - rh-thermostat16: attempt to bind socket is blocked by selinux
• BZ - 1452215 - SELinux policy denies IPA framework to perform anonymous PKINIT on localhost during FAST armoring
• BZ - 1453114 - dnsmasq: failed to create inotify for /etc/resolv.conf: Permission denied
• BZ - 1455631 - sbd daemon can not access /proc/sysrq-trigger
• BZ - 1455994 - selinux AVC denial seen when qemu-kvm process tries to write in to /var/run/gluster
• BZ - 1457106 - ipa-kra-install fails on replica
• BZ - 1458999 - /usr/lib/systemd/systemd-sysctl AVC denied on RHEL-7.4-20170601.0
• BZ - 1461488 - AVC denial on runc with user namespace
• BZ - 1468581 - [GANESHA] Unable to export the volume via ganesha due to selinux denied AVC's
• BZ - 1469027 - [GANESHA] Ganesha setup creation fails due to selinux blocking some services required for setup creation

CVEs

(none)

References

• https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.4_Release_Notes/index.html