RHBA-2020:5241 - Bug Fix Advisory

Topic

An update for fapolicyd is now available for Red Hat Enterprise Linux 8.1 Extended Update Support.

Description

The fapolicyd software framework introduces a form of application whitelisting
and blacklisting based on a user-defined policy. The application whitelisting
feature provides one of the most efficient ways to prevent running untrusted and possibly malicious applications on the system.

Bug Fix:

• When an update replaces the binary of a running application, the kernel modifies the application binary path in memory by appending the " (deleted)" suffix. Previously, the fapolicyd file access policy daemon treated such applications as untrusted, and prevented them from opening and executing any other files. As a consequence, the system was sometimes unable to boot after applying updates.

With this update, fapolicyd ignores the suffix in the binary path so the binary can match the trust database. As a result, fapolicyd enforces the rules correctly and the update process can finish.

(BZ#1897092)

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.1 x86_64
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.1 s390x
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.1 ppc64le
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.1 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.1 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.1 x86_64

Fixes

• BZ - 1897092 - fapolicyd breaks system upgrade, leaving system in dead state - complete fix [rhel-8.1.0.z]

CVEs

(none)

References

(none)