Issued:
2020-11-30
Updated:
2020-11-30

RHBA-2020:5242 - Bug Fix Advisory

Synopsis

fapolicyd bug fix update

Type/Severity

Bug Fix Advisory

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for fapolicyd is now available for Red Hat Enterprise Linux 8.

Description

The fapolicyd software framework introduces a form of application whitelisting and blacklisting based on a user-defined policy. The application whitelisting feature provides one of the most efficient ways to prevent running untrusted and possibly malicious applications on the system.

Bug Fix:

  • When an update replaces the binary of a running application, the kernel modifies the application binary path in memory by appending the " (deleted)" suffix. Previously, the fapolicyd file access policy daemon treated such applications as untrusted, and prevented them from opening and executing any other files. As a consequence, the system was sometimes unable to boot after applying updates.

With this update, fapolicyd ignores the suffix in the binary path so the binary can match the trust database. As a result, fapolicyd enforces the rules correctly and the update process can finish.

(BZ#1897090)

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
  • Red Hat Enterprise Linux Server - AUS 8.4 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4 ppc64le
  • Red Hat Enterprise Linux Server - TUS 8.4 x86_64
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4 aarch64
  • Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.4 ppc64le
  • Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.4 x86_64

Fixes

  • BZ - 1897090 - fapolicyd breaks system upgrade, leaving system in dead state - complete fix [rhel-8.3.0.z]

CVEs

(none)

References

(none)

Red Hat Enterprise Linux for x86_64 8

SRPM
fapolicyd-1.0-3.el8_3.3.src.rpm SHA-256: 55bd91045d220febd6d51fa35acd59f7a445d829ba24d279711cf03c18d9ff1b
x86_64
fapolicyd-1.0-3.el8_3.3.x86_64.rpm SHA-256: 608a0b429d82a8afe9f47aebdb5dc2f62e3258801d5d7a15148a326ec3482a2d
fapolicyd-debuginfo-1.0-3.el8_3.3.x86_64.rpm SHA-256: da792f53950c657bb63db3ad4c5540b8bc4891a7503d1d8c36b87fdbc82e4f85
fapolicyd-debugsource-1.0-3.el8_3.3.x86_64.rpm SHA-256: 17ad6314ec2986809fe20f35775238a2119b868f59270f568ddbc8498c9fc996
fapolicyd-selinux-1.0-3.el8_3.3.noarch.rpm SHA-256: 69ca74eabf5323196da08ee61f5d9d53cbfd72031bdb714dfb39dac090a5cff3

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4

SRPM
fapolicyd-1.0-3.el8_3.3.src.rpm SHA-256: 55bd91045d220febd6d51fa35acd59f7a445d829ba24d279711cf03c18d9ff1b
x86_64
fapolicyd-1.0-3.el8_3.3.x86_64.rpm SHA-256: 608a0b429d82a8afe9f47aebdb5dc2f62e3258801d5d7a15148a326ec3482a2d
fapolicyd-debuginfo-1.0-3.el8_3.3.x86_64.rpm SHA-256: da792f53950c657bb63db3ad4c5540b8bc4891a7503d1d8c36b87fdbc82e4f85
fapolicyd-debugsource-1.0-3.el8_3.3.x86_64.rpm SHA-256: 17ad6314ec2986809fe20f35775238a2119b868f59270f568ddbc8498c9fc996
fapolicyd-selinux-1.0-3.el8_3.3.noarch.rpm SHA-256: 69ca74eabf5323196da08ee61f5d9d53cbfd72031bdb714dfb39dac090a5cff3

Red Hat Enterprise Linux Server - AUS 8.4

SRPM
fapolicyd-1.0-3.el8_3.3.src.rpm SHA-256: 55bd91045d220febd6d51fa35acd59f7a445d829ba24d279711cf03c18d9ff1b
x86_64
fapolicyd-1.0-3.el8_3.3.x86_64.rpm SHA-256: 608a0b429d82a8afe9f47aebdb5dc2f62e3258801d5d7a15148a326ec3482a2d
fapolicyd-debuginfo-1.0-3.el8_3.3.x86_64.rpm SHA-256: da792f53950c657bb63db3ad4c5540b8bc4891a7503d1d8c36b87fdbc82e4f85
fapolicyd-debugsource-1.0-3.el8_3.3.x86_64.rpm SHA-256: 17ad6314ec2986809fe20f35775238a2119b868f59270f568ddbc8498c9fc996
fapolicyd-selinux-1.0-3.el8_3.3.noarch.rpm SHA-256: 69ca74eabf5323196da08ee61f5d9d53cbfd72031bdb714dfb39dac090a5cff3

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
fapolicyd-1.0-3.el8_3.3.src.rpm SHA-256: 55bd91045d220febd6d51fa35acd59f7a445d829ba24d279711cf03c18d9ff1b
s390x
fapolicyd-1.0-3.el8_3.3.s390x.rpm SHA-256: 7debf58face8074bb14e9602914b50c9c7e0b8cb83012119821c54c489f110e5
fapolicyd-debuginfo-1.0-3.el8_3.3.s390x.rpm SHA-256: 0ca11a0e86fffb9cfc77e49700af7579359bfae1e1e96ce22c202dc4802ddf40
fapolicyd-debugsource-1.0-3.el8_3.3.s390x.rpm SHA-256: 344732756fdeb7e6cbaeed1ac5a33dd4931cee6bea74921350f1b5f804fef3f6
fapolicyd-selinux-1.0-3.el8_3.3.noarch.rpm SHA-256: 69ca74eabf5323196da08ee61f5d9d53cbfd72031bdb714dfb39dac090a5cff3

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4

SRPM
fapolicyd-1.0-3.el8_3.3.src.rpm SHA-256: 55bd91045d220febd6d51fa35acd59f7a445d829ba24d279711cf03c18d9ff1b
s390x
fapolicyd-1.0-3.el8_3.3.s390x.rpm SHA-256: 7debf58face8074bb14e9602914b50c9c7e0b8cb83012119821c54c489f110e5
fapolicyd-debuginfo-1.0-3.el8_3.3.s390x.rpm SHA-256: 0ca11a0e86fffb9cfc77e49700af7579359bfae1e1e96ce22c202dc4802ddf40
fapolicyd-debugsource-1.0-3.el8_3.3.s390x.rpm SHA-256: 344732756fdeb7e6cbaeed1ac5a33dd4931cee6bea74921350f1b5f804fef3f6
fapolicyd-selinux-1.0-3.el8_3.3.noarch.rpm SHA-256: 69ca74eabf5323196da08ee61f5d9d53cbfd72031bdb714dfb39dac090a5cff3

Red Hat Enterprise Linux for Power, little endian 8

SRPM
fapolicyd-1.0-3.el8_3.3.src.rpm SHA-256: 55bd91045d220febd6d51fa35acd59f7a445d829ba24d279711cf03c18d9ff1b
ppc64le
fapolicyd-1.0-3.el8_3.3.ppc64le.rpm SHA-256: cf144d13a23f99c29b6e22339f14b8a1af7a4f32a54e63342b3b4fe8e7b2f083
fapolicyd-debuginfo-1.0-3.el8_3.3.ppc64le.rpm SHA-256: d26c2ab8b9ae9c0b543de3606c9f93bc39eb92a5d4060e7897c5a5a7597a2581
fapolicyd-debugsource-1.0-3.el8_3.3.ppc64le.rpm SHA-256: f29fbfe0f5a1b156ce4da73663f4a688171a57b386184a5c6eacd8e6802e01d4
fapolicyd-selinux-1.0-3.el8_3.3.noarch.rpm SHA-256: 69ca74eabf5323196da08ee61f5d9d53cbfd72031bdb714dfb39dac090a5cff3

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4

SRPM
fapolicyd-1.0-3.el8_3.3.src.rpm SHA-256: 55bd91045d220febd6d51fa35acd59f7a445d829ba24d279711cf03c18d9ff1b
ppc64le
fapolicyd-1.0-3.el8_3.3.ppc64le.rpm SHA-256: cf144d13a23f99c29b6e22339f14b8a1af7a4f32a54e63342b3b4fe8e7b2f083
fapolicyd-debuginfo-1.0-3.el8_3.3.ppc64le.rpm SHA-256: d26c2ab8b9ae9c0b543de3606c9f93bc39eb92a5d4060e7897c5a5a7597a2581
fapolicyd-debugsource-1.0-3.el8_3.3.ppc64le.rpm SHA-256: f29fbfe0f5a1b156ce4da73663f4a688171a57b386184a5c6eacd8e6802e01d4
fapolicyd-selinux-1.0-3.el8_3.3.noarch.rpm SHA-256: 69ca74eabf5323196da08ee61f5d9d53cbfd72031bdb714dfb39dac090a5cff3

Red Hat Enterprise Linux Server - TUS 8.4

SRPM
fapolicyd-1.0-3.el8_3.3.src.rpm SHA-256: 55bd91045d220febd6d51fa35acd59f7a445d829ba24d279711cf03c18d9ff1b
x86_64
fapolicyd-1.0-3.el8_3.3.x86_64.rpm SHA-256: 608a0b429d82a8afe9f47aebdb5dc2f62e3258801d5d7a15148a326ec3482a2d
fapolicyd-debuginfo-1.0-3.el8_3.3.x86_64.rpm SHA-256: da792f53950c657bb63db3ad4c5540b8bc4891a7503d1d8c36b87fdbc82e4f85
fapolicyd-debugsource-1.0-3.el8_3.3.x86_64.rpm SHA-256: 17ad6314ec2986809fe20f35775238a2119b868f59270f568ddbc8498c9fc996
fapolicyd-selinux-1.0-3.el8_3.3.noarch.rpm SHA-256: 69ca74eabf5323196da08ee61f5d9d53cbfd72031bdb714dfb39dac090a5cff3

Red Hat Enterprise Linux for ARM 64 8

SRPM
fapolicyd-1.0-3.el8_3.3.src.rpm SHA-256: 55bd91045d220febd6d51fa35acd59f7a445d829ba24d279711cf03c18d9ff1b
aarch64
fapolicyd-1.0-3.el8_3.3.aarch64.rpm SHA-256: 7524ae70da5d7df65797171b4d7b0186b59eee698a9c4b5c45970f36930275ef
fapolicyd-debuginfo-1.0-3.el8_3.3.aarch64.rpm SHA-256: 5fe7f279c343b167ce0dd2844f58fbc2781f7072766a7eb69fdb090e73ed62c4
fapolicyd-debugsource-1.0-3.el8_3.3.aarch64.rpm SHA-256: 0b1955b86e57c8635a4ac77a258f7b1da55cd003fc54c21fa79a067f527314aa
fapolicyd-selinux-1.0-3.el8_3.3.noarch.rpm SHA-256: 69ca74eabf5323196da08ee61f5d9d53cbfd72031bdb714dfb39dac090a5cff3

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4

SRPM
fapolicyd-1.0-3.el8_3.3.src.rpm SHA-256: 55bd91045d220febd6d51fa35acd59f7a445d829ba24d279711cf03c18d9ff1b
aarch64
fapolicyd-1.0-3.el8_3.3.aarch64.rpm SHA-256: 7524ae70da5d7df65797171b4d7b0186b59eee698a9c4b5c45970f36930275ef
fapolicyd-debuginfo-1.0-3.el8_3.3.aarch64.rpm SHA-256: 5fe7f279c343b167ce0dd2844f58fbc2781f7072766a7eb69fdb090e73ed62c4
fapolicyd-debugsource-1.0-3.el8_3.3.aarch64.rpm SHA-256: 0b1955b86e57c8635a4ac77a258f7b1da55cd003fc54c21fa79a067f527314aa
fapolicyd-selinux-1.0-3.el8_3.3.noarch.rpm SHA-256: 69ca74eabf5323196da08ee61f5d9d53cbfd72031bdb714dfb39dac090a5cff3

Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.4

SRPM
fapolicyd-1.0-3.el8_3.3.src.rpm SHA-256: 55bd91045d220febd6d51fa35acd59f7a445d829ba24d279711cf03c18d9ff1b
ppc64le
fapolicyd-1.0-3.el8_3.3.ppc64le.rpm SHA-256: cf144d13a23f99c29b6e22339f14b8a1af7a4f32a54e63342b3b4fe8e7b2f083
fapolicyd-debuginfo-1.0-3.el8_3.3.ppc64le.rpm SHA-256: d26c2ab8b9ae9c0b543de3606c9f93bc39eb92a5d4060e7897c5a5a7597a2581
fapolicyd-debugsource-1.0-3.el8_3.3.ppc64le.rpm SHA-256: f29fbfe0f5a1b156ce4da73663f4a688171a57b386184a5c6eacd8e6802e01d4
fapolicyd-selinux-1.0-3.el8_3.3.noarch.rpm SHA-256: 69ca74eabf5323196da08ee61f5d9d53cbfd72031bdb714dfb39dac090a5cff3

Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.4

SRPM
fapolicyd-1.0-3.el8_3.3.src.rpm SHA-256: 55bd91045d220febd6d51fa35acd59f7a445d829ba24d279711cf03c18d9ff1b
x86_64
fapolicyd-1.0-3.el8_3.3.x86_64.rpm SHA-256: 608a0b429d82a8afe9f47aebdb5dc2f62e3258801d5d7a15148a326ec3482a2d
fapolicyd-debuginfo-1.0-3.el8_3.3.x86_64.rpm SHA-256: da792f53950c657bb63db3ad4c5540b8bc4891a7503d1d8c36b87fdbc82e4f85
fapolicyd-debugsource-1.0-3.el8_3.3.x86_64.rpm SHA-256: 17ad6314ec2986809fe20f35775238a2119b868f59270f568ddbc8498c9fc996
fapolicyd-selinux-1.0-3.el8_3.3.noarch.rpm SHA-256: 69ca74eabf5323196da08ee61f5d9d53cbfd72031bdb714dfb39dac090a5cff3

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.