RHBA-2020:1773 - Bug Fix Advisory

Topic

An update for selinux-policy is now available for Red Hat Enterprise Linux
8.

Description

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.2 Release Notes linked from the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.2 x86_64
• Red Hat Enterprise Linux Server - AUS 8.6 x86_64
• Red Hat Enterprise Linux Server - AUS 8.4 x86_64
• Red Hat Enterprise Linux Server - AUS 8.2 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.2 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.2 ppc64le
• Red Hat Enterprise Linux Server - TUS 8.8 x86_64
• Red Hat Enterprise Linux Server - TUS 8.6 x86_64
• Red Hat Enterprise Linux Server - TUS 8.4 x86_64
• Red Hat Enterprise Linux Server - TUS 8.2 x86_64
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.2 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.2 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.2 x86_64

Fixes

• BZ - 1663874 - [policycoreutils-python-utils] sandboxing of firefox is blocked by SELinux
• BZ - 1671019 - Selinux AVC for /var/run/faillock/
• BZ - 1686462 - allow httpd_t mailman_cgi_t:process signull
• BZ - 1686833 - restorecon relabels files /var/cache/yum
• BZ - 1687867 - mysql/mariadb fails to start in pacemaker cluster
• BZ - 1698197 - selinux blocks systemd during coredump processing
• BZ - 1726166 - the lvmdbusd service runs as unconfined_service_t
• BZ - 1726246 - the lldpd service runs as unconfined_service_t
• BZ - 1726255 - the rrdcached service runs as unconfined_service_t
• BZ - 1726259 - the stratisd service runs as unconfined_service_t
• BZ - 1727887 - systemd user instance does not start for SELinux restricted accounts
• BZ - 1727902 - SELinux restricted accounts cannot access polkit
• BZ - 1728332 - allow keepalived access to process signal
• BZ - 1730204 - the timedatex service runs as unconfined_service_t
• BZ - 1737419 - AVC denials in abrt-upload-watch
• BZ - 1737550 - Need a label created for RHDS tmpfs directory
• BZ - 1739137 - SELinux denial when using amanda with xfsdump
• BZ - 1739858 - SELinux is preventing /usr/lib64/firefox/firefox from setattr access on the directory cache.
• BZ - 1740185 - Invalid URL in selinux-policy package
• BZ - 1743450 - Keepalived triggers a SELinux AVC when it tries to switch to the user supplied in script_user
• BZ - 1743907 - SELinux prevents sssd/p11_child from searching the /root/.config directory
• BZ - 1744234 - SELinux denial against lscpu on read/write during rhsmcertd_t context
• BZ - 1745076 - RFE: introduce policy rules for new libvirt daemons
• BZ - 1746511 - RFE: Add statsd_port_to to base policy
• BZ - 1746955 - allow keepalived access to process getpgid
• BZ - 1746974 - allow haproxy to read proc_net_t file types
• BZ - 1747768 - SELinux prevents NetworkManager from opening bluetooth socket for DUN connections
• BZ - 1747926 - SELinux denials in client when using galera
• BZ - 1750405 - root (or others) confined to sysadm_u or staff_u cannot run newaliases
• BZ - 1752031 - avc: denied { getattr } for pid=19510 comm="gssproxy" path="/proc/21341" dev="proc"
• BZ - 1752843 - SELinux interferes with various lp* commands executed by sysadm_u user
• BZ - 1752943 - dlm_controld needs permission to read /dev/random
• BZ - 1753662 - AVC when libreswan uses seccomp
• BZ - 1755401 - avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.DBus.Peer
• BZ - 1756006 - dracut/ldconfig cannot run as a service
• BZ - 1758255 - selinux preventing systemd loading iptables module
• BZ - 1758265 - Aide unusable because of SELinux
• BZ - 1758545 - upstream qemu change that mmaps ELF files breaks with selinux rules
• BZ - 1759505 - No SELinux context for /etc/named directory
• BZ - 1759900 - ipa-ods-exporter AVC for /var/kerberos/krb5
• BZ - 1765065 - AVCs seen on "fuser" when "tmpwatch --fuser ..." is used as a system cron job
• BZ - 1766415 - selinux blocks fail2ban nftables access
• BZ - 1771414 - Update Cockpit SELinux policy for cockpit-tls and client certificate authentication
• BZ - 1772619 - SELinux prevents confined users from running fwupdmgr
• BZ - 1772625 - SELinux prevents confined users from running machinectl
• BZ - 1772669 - SELinux prevents confined users from running colormgr
• BZ - 1773463 - SELinux prevents confined users from running resolvectl
• BZ - 1777042 - selinux sssd type fails to run nsupdate during realmd regression run
• BZ - 1778126 - selinux policy prevents systemd from creating StateDirectory and CacheDirectory
• BZ - 1779098 - SELinux prevents timedatex from searching the /etc/selinux/targeted/contexts/files directory
• BZ - 1781696 - SELinux is preventing /usr/lib/systemd/systemd from 'setattr' accesses on the directory /var/lib/fprint.
• BZ - 1806894 - AVC for nm-cloud-setup.service

CVEs

(none)

References

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.2_release_notes/index