RHBA-2018:0763 - Bug Fix Advisory

Topic

An update for selinux-policy is now available for Red Hat Enterprise Linux 7.

Description

The selinux-policy packages contain the rules that govern how confined processes run on the system.

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.

Users of selinux-policy are advised to upgrade to these updated packages.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux for ARM 64 7 aarch64
• Red Hat Enterprise Linux for Power 9 7 ppc64le
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for IBM System z (Structure A) 7 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1160183 - Virt-sysprep firstboot service should have it's SELinux policy
• BZ - 1325364 - Confined administrators cannot run /bin/systemd-tmpfiles
• BZ - 1350765 - chrony-helper dnssrv actions blocked by selinux
• BZ - 1373220 - avc denial: comm="iptables.init" name="plymouth"
• BZ - 1376893 - the puppetmaster service does not start because of SELinux
• BZ - 1376991 - unix_chkpwd is missing dac_read_search capability
• BZ - 1377276 - [Hyper-v][RHEL7.3]hypervkvpd cannot communicate with NetworkManager via D-bus
• BZ - 1380688 - Remove unused patches for RHEL-7.1 in distgit.
• BZ - 1380795 - (selinux-policy) AVC messages are generated for sbd component after stopping cluster
• BZ - 1381914 - New cockpit binary needs policy changes
• BZ - 1382955 - spamc should be able to deliver to cyrus imapd via the latter's deliver command
• BZ - 1390208 - avc error on isnsd when initiator tries to connect to it
• BZ - 1393030 - SELinux is preventing /usr/lib/cyrus-imapd/imapd from read access on the file unix.
• BZ - 1397311 - policy/modules/contrib/apache.te:948:WARNING 'unrecognized character' at token ''' on line 20338
• BZ - 1397744 - SELinux is preventing /usr/bin/systemctl from 'write' accesses on the chr_file kmsg.
• BZ - 1398338 - /usr/libexec/rhsmcertd-worker (rhsmcertd_t) sends kill to rhsmcertd_t
• BZ - 1401556 - keepalived needs access to "/var/agentx/master" UNIX socket
• BZ - 1405716 - SELinux is preventing /usr/bin/python2.7 from read access on the file unix.
• BZ - 1406526 - SELinux is preventing /usr/bin/bash from write access on the sock_file /var/lib/sss/pipes/nss
• BZ - 1408276 - After RHEL6 to 7 inplace upgrade, installing selinux-policy-targeted may try to re-declare 'ctdbd_t'
• BZ - 1411400 - RELP port for rsyslog
• BZ - 1412838 - Running passwd changes the security context of /etc/security/opasswd
• BZ - 1415694 - /usr/sbin is sometimes used in RPM macros instead of %{_sbindir}
• BZ - 1421075 - allow rules exist which circumvent the deny_ptrace boolean
• BZ - 1422000 - SELinux is preventing /usr/bin/certwatch from using the dac_override capability
• BZ - 1424621 - Selinux is preventing targetd from running
• BZ - 1426824 - Current selinux policy break nagios
• BZ - 1427415 - Latest Nagios 4.2.4 broken under SELinux
• BZ - 1428568 - AVC denials for ldap-agent from 389-ds-base-snmp
• BZ - 1429327 - SELinux gives denials for keepalived
• BZ - 1429853 - ptp4l cannot respond to unconfined pmc using UDS
• BZ - 1433464 - SELinux prevent passenger_t from connecting to mysqldb_port_t
• BZ - 1438489 - Allow jabber and postgress to talk
• BZ - 1438532 - SELinux prevents tgtd from opening /etc/pki/tls/legacy-settings
• BZ - 1438937 - SELinux prevents iptables_t from reading files in /etc/modprobe.d directory
• BZ - 1439442 - NFS crossmnt AVC denied for comm="rpc.mountd" name="/" dev="configfs" ino=7990 scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:configfs_t:s0 tclass=dir
• BZ - 1440515 - selinux will prevent named-chroot from properly reloading
• BZ - 1441081 - ipmievd service wants to load certain kernel modules but SELinux complains
• BZ - 1446777 - SELinux prevents subscription manager from sending a D-bus message to puppet agent
• BZ - 1448959 - STIG for RHEL 7 Server Running GUIs triggers AVC for sshd
• BZ - 1450789 - SELinux is preventing anacrontab to execute su
• BZ - 1451358 - scap reports device files with device_t context as violating a rule
• BZ - 1459941 - Binding and connecting to a DCCP socket raises SELinux denials
• BZ - 1460477 - Downloading Adobe Flash Access Library (libadobecp-301806-0.so) fails due to SELinux
• BZ - 1462292 - AVC denial: scontext=system_u:system_r:pegasus_openlmi_services_t:s0 tcontext=system_u:object_r:cert_t:s0 tclass=dir
• BZ - 1462925 - SELinux is preventing gnome-shell from 'getattr' accesses on the chr_file /dev/loop-control.
• BZ - 1464484 - RFE: backport SELinux/InfiniBand policy
• BZ - 1465824 - RPM macros for Independent Product Policy need improvements
• BZ - 1468254 - Typo "privledge" in xguest_selinux manpage
• BZ - 1470150 - SELinux is preventing chronyd from sendto access on the unix_dgram_socket
• BZ - 1470701 - Switching from Targeted to MLS shows "denied" AVCs after reboot
• BZ - 1470735 - [regression] tomcat fails to start via tomcat-jsvc service startup due to selinux denials
• BZ - 1472722 - SELinux is preventing /usr/sbin/lldpad from sendto access on the unix_dgram_socket
• BZ - 1477542 - Regression: AVC denied related to keepalived 1.3.x, /proc and sysctl_net_t
• BZ - 1477887 - SELinux policy for Tomcat should not allow access to rpm database by default
• BZ - 1478371 - AVC denials noticed during ipa-server upgrade process.
• BZ - 1479350 - AVC denials seen while running ipa-nis-integration suite.
• BZ - 1479383 - stunnel >=5.41 needs additional rules.
• BZ - 1479759 - pcs resource create ocf:heartbeat:slapd causes avc: denied { block_suspend }
• BZ - 1480518 - Define nnp_nosuid_transition policy capability
• BZ - 1480741 - selinux policy lacks svnserve_log_t, which breaks svnserve logging
• BZ - 1480791 - /usr/libexec/sesh -> /usr/libexec/sudo/sesh needs policy update
• BZ - 1481388 - IPA certificate auto renewal failed at unable to connect to LDAP server with authentication failure
• BZ - 1482381 - selinux-policy: avc: denied { open } for pid=13178 comm="umount" path="/run/mount/utab" [kernel-alt]
• BZ - 1482682 - Open vSwitch selinux policy needs updating
• BZ - 1483451 - [Ganesha] Unable to take statedump of ganesha process while selinux is in Enforcing mode
• BZ - 1484075 - [RFE] Add S3 PR support to qemu (similar to mpathpersist)
• BZ - 1484572 - SELinux denies name_connect to mssql_port_t for tomcat_t
• BZ - 1485909 - avc denial when changing smp_affinity_list
• BZ - 1486638 - keepalived 1.3.5 requires setpgid permission
• BZ - 1487288 - The qemu-kvm process got an AVC on starting a guest in OVS-dpdk environment
• BZ - 1488322 - /dev/mtd0 device should have a more specific label than device_t
• BZ - 1489118 - Allow /usr/libexec/ip(6)tables.init to call restorecon
• BZ - 1490956 - PostgreSQL fails to start under SELinux MLS
• BZ - 1490961 - [AVC denied] /usr/libexec/rhsmcertd-worker (rhsmcertd_t) sends signull to snmpd_t
• BZ - 1491039 - SELinux denies name_bind to jboss_management_port_t for tomcat_t
• BZ - 1491235 - SELinux doesn't allow CTDB to set system resource limits
• BZ - 1491747 - SELinux denies name_connect to mysql_port_t for tomcat_t
• BZ - 1491994 - httpd is prevented from reading user directories
• BZ - 1492088 - selinux blocks starting of ocf:heartbeat:tomcat resource
• BZ - 1492730 - tomcat_t is missing setsched permission
• BZ - 1493285 - selinux port context ldap_port_t
• BZ - 1494172 - RHEL-7.5 should NOT contain any permissive domains
• BZ - 1494382 - [GANESHA] While running posix compliance,cthon tests on ganesha mount selinux AVC's are observed
• BZ - 1496260 - Regression: SELinux policy forbids rngd to access /dev/ttyUSB0 (USB-based HW RNG)
• BZ - 1501336 - systemctl start ovs-vswitchd produces dac_override and dac_read_search AVC denials
• BZ - 1504074 - cannot start zabbix server because of setrlimit syscall blocked by selinux
• BZ - 1504594 - SELinux is preventing /usr/libexec/gnome-settings-daemon from 'connectto' accesses on the unix_stream_socket /run/cups/cups.sock.
• BZ - 1504826 - SELinux is preventing nrpe_t from accessing nfs_t
• BZ - 1505121 - selinux preventing conman from accessing local serial devices
• BZ - 1505779 - sendmail was denied to search /proc/sys/net
• BZ - 1505845 - osm_dump_qmap_to_file: cannot create file '/var/log/opensm-subnet.lst
• BZ - 1507019 - Ship file_contexts.homedirs in SELinux store
• BZ - 1507048 - open-vm-tools logfiles lacks correct labels
• BZ - 1507682 - SELinux is preventing php-fpm from 'execute' accesses on the file 2F616E6F6E5F6875676570616765202864656C6574656429
• BZ - 1508360 - selinux inhibits pacemaker's logging policy
• BZ - 1508486 - AVC denial about chronyc, chronyd_t, and chronyc_exec_t
• BZ - 1509277 - SELinux prevents several domains from doing dac_read_search
• BZ - 1510883 - slapd can not create and read links with slapd_tmp_t
• BZ - 1514235 - Selinux is preventing agetty from access to ttyUSB0
• BZ - 1517247 - SELinux is preventing /usr/sbin/NetworkManager from 'connectto' accesses on the unix_stream_socket /run/openvswitch/db.sock.
• BZ - 1517744 - [RHEL-7.5] BUG: SELinux policy does not allow the opensm_t domain to control IB networks
• BZ - 1517895 - [RHEL-7.5] BUG: SELinux policy does not allow the NetworkManager_t domain to control IPoIB networks
• BZ - 1520897 - /dev/drm_dp_aux* devices should have a more specific label than device_t
• BZ - 1522745 - sysadm users cannot execute 'puppet agent' command
• BZ - 1523811 - allow syslogd_t container_log_t:dir create;
• BZ - 1530525 - chronyc can't write keys to /etc/chrony.keys
• BZ - 1530601 - SELinux filecontext for /var/lock/ppp is not set upon package installation
• BZ - 1533183 - SELinux is preventing qemu-kvm from access access on the infiniband_pkey Unknown
• BZ - 1534924 - selinux denies audisp-remote to write to its queue file
• BZ - 1535133 - selinux denies ipsec service to read configuration in mls policy
• BZ - 1535196 - Got mtu AVC when adding MLX5 dpdk to OVS
• BZ - 1536011 - ns-slapd: tlsmc_cert_create_hash_symlink: ERROR: OS error: Permission denied
• BZ - 1538544 - Update selinux-policy for virt domains for container team
• BZ - 1539416 - ipsec service with seccomp support and selinux denials
• BZ - 1540702 - Starting an OVS guest encountered "failed to bind socket to /tmp/vhost0: Permission denied"

CVEs

(none)

References

• https://access.redhat.com/documentation/en-US/red_hat_enterprise_linux/7/html/7.5_release_notes/index.html