RHBA-2020:4528 - Bug Fix Advisory

Topic

An update for selinux-policy is now available for Red Hat Enterprise Linux
8.

Description

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.3 Release Notes linked from the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.4 x86_64
• Red Hat Enterprise Linux Server - AUS 8.6 x86_64
• Red Hat Enterprise Linux Server - AUS 8.4 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4 ppc64le
• Red Hat Enterprise Linux Server - TUS 8.8 x86_64
• Red Hat Enterprise Linux Server - TUS 8.6 x86_64
• Red Hat Enterprise Linux Server - TUS 8.4 x86_64
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4 x86_64

Fixes

• BZ - 1735748 - ocf:heartbeat:CTDB is blocked by selinux
• BZ - 1747960 - selinux policy prevent guest-fstrim command executing
• BZ - 1750821 - sudo nrpe nagios check still AVCs after bz1653309 fix release
• BZ - 1753626 - Unable to mount glusterfs at boot when specifying security context
• BZ - 1754719 - [RHEL-8] avc: denied { write } for pid=3026 comm="ibacm" name="shm" dev="devtmpfs"
• BZ - 1759214 - ptp4l not allowed to use L2 transport
• BZ - 1769423 - AVC denial seen executing ipa trust-add
• BZ - 1772852 - AVCs seen when nscd service is enabled
• BZ - 1776873 - Incorrect context applied to /etc/sysconfig/iptables.save
• BZ - 1777506 - NetworkManager's nm-dispatcher runs with wrong SELinux context
• BZ - 1779070 - the boinc-client service triggers SELinux denials
• BZ - 1786670 - [RHEL-8] avc: denied { create } for pid=24135 comm="sm"
• BZ - 1788616 - "machinectl shell" fails to execute systemctl command and is slow executing other commands
• BZ - 1791957 - [RFE] add new filename transition rule for pam_timestamp so that it can work correctly
• BZ - 1795923 - logrotate cannot operate on CIFS file systems
• BZ - 1801214 - SELinux prevents pdns_server from mmap()-ing the /usr/share/p11-kit/modules/p11-kit-trust.module file
• BZ - 1802062 - Add a SELinux boolean to allow SSSD to access kernel keyrings labeled system_u:system_r:kernel_t:s0
• BZ - 1803407 - SELinux policy for FreeRADIUS
• BZ - 1813572 - gssproxy doesn't work with freeradius
• BZ - 1814644 - SELinux is preventing /usr/libexec/platform-python3.6 from map access on the file /etc/passwd.
• BZ - 1814689 - Enable SELinux on CephFS
• BZ - 1815281 - Usage of network namespaces in keepalived results in AVC denials
• BZ - 1815621 - SELinux policy prevents /usr/lib64/nagios/plugins/check_file_age from working via NRPE
• BZ - 1816663 - [RHEL-8.2]- Selinux policy need to be updated for RHGS
• BZ - 1818981 - SELinux prevents systemd from performing condition check on file shared via samba
• BZ - 1819121 - SELinux is preventing systemd from using the 'setsched' accesses on a process.
• BZ - 1819243 - CTDB is unhealthy with SELinux set to Enforcing in RHEL-8
• BZ - 1820798 - systemd-makefs does not have the correct selinux context type
• BZ - 1821191 - External SELinux policy cannot be built when building RHEL IdM
• BZ - 1824662 - [RHEL-8.2]- Selinux policy need to be updated for RHGS to fix permission issues
• BZ - 1826748 - sssd p11_child avc name_connect denied for unreserved_port_t
• BZ - 1826788 - Audit daemon does not halt the system when the audit partition is full
• BZ - 1828809 - SELinux prevents the sysadm_u processes from D-bus talk to accounts-daemon
• BZ - 1831109 - [RHEL-8] Geo-replication in rsync mode is failing to start and bricks are going in to faulty state
• BZ - 1831769 - krb5 should be able to access /var/kerberos/krb5/user/<uid>/client.keytab from ssh
• BZ - 1832231 - SELinux is preventing /usr/lib/systemd/systemd from setattr access on the directory fwupd.
• BZ - 1832756 - virtlockd needs to run in different context than virtlogd
• BZ - 1834773 - SELinux prevents tcpdump from creating a RDMA socket (test failing with new tcpdump and libpcap)
• BZ - 1835909 - [8.3 regression] avc: denied { read write } for comm="qemu-kvm" path="/dev/mapper/control
• BZ - 1836795 - SELinux prevents ns-slapd from reading directories on cgroup file-system
• BZ - 1836820 - avc: denied { read } for pid=1 comm="systemd" name="slapd-test"
• BZ - 1840265 - systemd unit PrivateDevices option does not work
• BZ - 1841488 - sshd cannot write into reply cache (/var/tmp/krb5_0.rcache2) due to security context
• BZ - 1842414 - [Hyper-V][RHEL8.3] Selinux avc denied log {module_request} for comm="hypervkvpd" appears after disable "Data Exchange"
• BZ - 1846598 - avc: denied { read } for pid=35573 comm="ns-slapd" name="/" dev="cgroup" ino=1
• BZ - 1847331 - /sys/kernel/tracing: current context conflicts with default context
• BZ - 1848953 - ssh auth failing with avc denial for krb5_0.rcache2
• BZ - 1851448 - GDM crashes after cuda install
• BZ - 1851816 - [RHEL8]: avc: denied { getattr } for pid=58539 comm="smbd" path="/mnt/cifs/dev"
• BZ - 1852378 - Daemons cannot send DBus messages to systemd-resolved
• BZ - 1853432 - ipa trust-add fails with 'Fetching domains from trusted forest failed'
• BZ - 1853685 - certmonger cannot restart services on certificate reissuance
• BZ - 1855770 - auditd cannot write into reply cache (/var/tmp/krb5_0.rcache2) due to security context
• BZ - 1857675 - AVC denial for comm="java" name="hsperfdata_pkiuser"
• BZ - 1863043 - kadmind doesn't have an access to /var/tmp/krb5_0.rcache2 when selinux label is set to krb5_host_rcache_t
• BZ - 1867115 - qemu-pr-helper.service: Failed to execute command: Permission denied
• BZ - 1870300 - SELinux prevents saslauthd from creating a kerberos reply cache file
• BZ - 1870596 - fowner capability required by certmonger

CVEs

(none)

References

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/index