RHBA-2020:1007 - Bug Fix Advisory

Topic

An update for selinux-policy is now available for Red Hat Enterprise Linux
7.

Description

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 7.8 Release Notes linked from the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1651253 - Users mapped to "sysadm_u" cannot execute "semanage"
• BZ - 1653857 - selinux: more nfs-ganesha AVCs w/ selinux-policy-3.13.1-192.el7_5.6
• BZ - 1658319 - Collectd default selinux context for log file makes it impossible for the file to be created and written into
• BZ - 1688887 - Cannot execute "sudo su" when user is confined to staff_u or sysadm_u
• BZ - 1692564 - SELinux is preventing dogtag-submit from getattr access on the filesystem /
• BZ - 1697227 - avc: denied { search, write } for comm="dnsmasq" name="NetworkManager"
• BZ - 1699249 - File /run/xtables.lock gets created with wrong var_run_t context
• BZ - 1699391 - pam_tty_audit fails to execute when user sudoing is confined (staff_u, sysadm_u, ...)
• BZ - 1701338 - /usr/libexec/rhsmcertd-worker (rhsmcertd_t) sends signull to arbitrary processes
• BZ - 1704744 - avc errors reported when using sbd fencing
• BZ - 1705599 - SELinux prevents D-bus communication between systemd-hostnamed and sosreport
• BZ - 1712603 - Centos 7: SELinux is preventing /usr/bin/totem-video-thumbnailer from using the 'nnp_transition, nosuid_transition' accesses on a process.
• BZ - 1714896 - incomplete policy for libvirt daemons
• BZ - 1715136 - sbd is unable to set rt-priority if CPUAccounting is enabled
• BZ - 1715805 - mysql/mariadb fails to start in pacemaker cluster
• BZ - 1719754 - SELinux prevents cups-browsed from creating a symlink in /tmp
• BZ - 1720546 - SELinux prevents sysadm_u from D-bus talking to rtkit-daemon
• BZ - 1727341 - No default label for item in /var/spool/cron
• BZ - 1727379 - sysadm_u users cannot log into graphical sessions
• BZ - 1727458 - SELinux is preventing executing svnserve's hooks
• BZ - 1753623 - Allow ipmievd and sbd access to cluster and watchdog
• BZ - 1765063 - AVCs seen on "fuser" when "tmpwatch --fuser ..." is used as a system cron job

CVEs

(none)

References

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index