RHBA-2019:3547 - Bug Fix Advisory

Topic

An update for selinux-policy is now available for Red Hat Enterprise Linux 8.

Description

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.2 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.1 x86_64
• Red Hat Enterprise Linux Server - AUS 8.6 x86_64
• Red Hat Enterprise Linux Server - AUS 8.4 x86_64
• Red Hat Enterprise Linux Server - AUS 8.2 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.2 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.1 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.2 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.1 ppc64le
• Red Hat Enterprise Linux Server - TUS 8.8 x86_64
• Red Hat Enterprise Linux Server - TUS 8.6 x86_64
• Red Hat Enterprise Linux Server - TUS 8.4 x86_64
• Red Hat Enterprise Linux Server - TUS 8.2 x86_64
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.2 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.1 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.2 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.1 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.2 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.1 x86_64

Fixes

• BZ - 1630874 - Create boolean for rsyslog_t to connect to elasticsearch port 9200
• BZ - 1651991 - cgdcbxd policy module is missing
• BZ - 1656738 - selinux block vsock protocol transfer data from guest to host
• BZ - 1657281 - USER_AVC denial between dbus-daemon and rhsmcertd_t
• BZ - 1658624 - SELinux conflicts /usr/sbin/dumpe2fs /usr/sbin/e2mmpstatus
• BZ - 1664983 - SELinux prevents kadmind from searching in /var/lib/softhsm directory
• BZ - 1667016 - [VMware][RHEL 8]vmtools is not able to execute the sudo command rapidly
• BZ - 1668667 - ptp4l cannot respond to pmc
• BZ - 1668840 - NetworkManager Wireless Hotspot requires further dnsmasq permissions
• BZ - 1669095 - avc denied { send_msg } for exe="/usr/bin/dbus-daemon"
• BZ - 1671129 - sbd daemon is not allowed to write/append to the /proc/sysrq-trigger
• BZ - 1673107 - Rebase selinux-policy package against Fedora 30
• BZ - 1674470 - AVC denials noticed during automount-tests
• BZ - 1685689 - SELinux denials appear when confined users run journalctl
• BZ - 1687721 - qemu-ga command guest-get-fsinfo isn't allowed read access
• BZ - 1688671 - SELinux is preventing init_t to read session_dbusd_tmp_t directories
• BZ - 1689955 - avc: denied { module_request } for pid=8985 comm="brltty" kmod="fs-usbfs" scontext=system_u:system_r:brltty_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=0
• BZ - 1691351 - Cannot execute "sudo su" when user is confined to staff_u or sysadm_u
• BZ - 1692676 - Building a custom module prints a "syntax error near unexpected token" message
• BZ - 1693137 - AVC denied map for php-cgi when php-pecl-apcu is installed
• BZ - 1693679 - Selinux boolean/policy to allow rotate logs on fusefs_t filesystem
• BZ - 1696144 - SELinux preventing systemd from creating mountpoint
• BZ - 1701158 - SELinux prevents rotatelogs (httpd_rotatelogs_t) from executing and mmap()-ing the gzip command
• BZ - 1702580 - SELinux denies iscsid { read } for modules.dep.bin and modules.softdep
• BZ - 1703241 - SELinux prevents sysadm_u from D-bus talking to rtkit-daemon
• BZ - 1703444 - description of guest_u user says no networking, but reality is different
• BZ - 1705044 - SELinux is preventing iscsid from 'map' accesses
• BZ - 1711005 - tshark should be labeled wireshark_exec_t
• BZ - 1711183 - debuginfo-install is not labeled debuginfo_exec_t
• BZ - 1712058 - Policy effects on Pacemaker clusters changed in RHEL 8
• BZ - 1715052 - avc: denied { read } for comm="dogtag-ipa-rene" name="tokens"
• BZ - 1715134 - sbd is unable to set rt-priority if CPUAccounting is enabled
• BZ - 1716971 - RHSM daemon denials when configuring Satellite 6 repositories
• BZ - 1716973 - Denials for qpidd when configured for Satellite 6.6 on RHEL8
• BZ - 1718814 - Confined users not working with Cockpit sessions
• BZ - 1719083 - VM with "nvdimm" memory will not start successfully when Selinux is enabled
• BZ - 1720070 - avc: denied { write } for comm="dhclient" name="NetworkManager" dev="tmpfs"
• BZ - 1720639 - SELinux is preventing /usr/libexec/platform-python3.6 from open access on the file /var/log/hawkey.log.
• BZ - 1722622 - ERROR 'Identifier condor_domain used as both an attribute and a type' at token 'condor_domain'
• BZ - 1722836 - ERROR 'syntax error' at token 'speech-dispatcher_admin'
• BZ - 1723498 - selinux-policy for sbd needs to be updated because of changes in pacemaker
• BZ - 1726659 - SELinux prevents auditd from sending a signal to audisp-remote process
• BZ - 1727342 - No default label for item in /var/spool/cron
• BZ - 1729571 - incorrectly labeled /usr/libexec/utempter/utempter
• BZ - 1730144 - AVC seen executing /usr/libexec/certmonger/ipa-submit
• BZ - 1730500 - Unconfined domains should be allowed to setattr on lnk_files in /proc
• BZ - 1732381 - SELinux: mariadb-server-galera
• BZ - 1732500 - SELinux denies qemu-kvm { search } of /proc when using TCG instead of KVM
• BZ - 1732956 - dlm_controld needs to execute lvm command
• BZ - 1733185 - incomplete policy for libvirt daemons
• BZ - 1734403 - avc: denied { read } for comm="abrt-action-ins"
• BZ - 1738608 - AVC denials with dlm-controld
• BZ - 1739382 - [RHEL-8] avc denied detected while running ibacm test
• BZ - 1740146 - selinux prevents auditd to use KRB5 peer authentication for remote logging
• BZ - 1743930 - avc: denied for comm="reload_microcod" and comm="find"

CVEs

(none)

References

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/