Synopsis

fapolicyd bug fix update

Type/Severity

Bug Fix Advisory

Topic

An update for fapolicyd is now available for Red Hat Enterprise Linux 8.

Description

The fapolicyd software framework introduces a form of application whitelisting and blacklisting based on a user-defined policy. The application whitelisting feature provides one of the most efficient ways to prevent running untrusted and possibly malicious applications on the system.

Bug Fix:

• When an update replaces the binary of a running application, the kernel modifies the application binary path in memory by appending the " (deleted)" suffix. Previously, the fapolicyd file access policy daemon treated such applications as untrusted, and prevented them from opening and executing any other files. As a consequence, the system was sometimes unable to boot after applying updates.
  

With this update, fapolicyd ignores the suffix in the binary path so the binary can match the trust database. As a result, fapolicyd enforces the rules correctly and the update process can finish.

(BZ#1897090)

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

• BZ - 1897090 - fapolicyd breaks system upgrade, leaving system in dead state - complete fix [rhel-8.3.0.z]

CVEs

(none)

References

(none)

Red Hat Enterprise Linux for x86_64 8

SRPM
fapolicyd-1.0-3.el8_3.3.src.rpm	SHA-256: 55bd91045d220febd6d51fa35acd59f7a445d829ba24d279711cf03c18d9ff1b
x86_64
fapolicyd-1.0-3.el8_3.3.x86_64.rpm	SHA-256: 608a0b429d82a8afe9f47aebdb5dc2f62e3258801d5d7a15148a326ec3482a2d
fapolicyd-debuginfo-1.0-3.el8_3.3.x86_64.rpm	SHA-256: da792f53950c657bb63db3ad4c5540b8bc4891a7503d1d8c36b87fdbc82e4f85
fapolicyd-debugsource-1.0-3.el8_3.3.x86_64.rpm	SHA-256: 17ad6314ec2986809fe20f35775238a2119b868f59270f568ddbc8498c9fc996
fapolicyd-selinux-1.0-3.el8_3.3.noarch.rpm	SHA-256: 69ca74eabf5323196da08ee61f5d9d53cbfd72031bdb714dfb39dac090a5cff3

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
fapolicyd-1.0-3.el8_3.3.src.rpm	SHA-256: 55bd91045d220febd6d51fa35acd59f7a445d829ba24d279711cf03c18d9ff1b
s390x
fapolicyd-1.0-3.el8_3.3.s390x.rpm	SHA-256: 7debf58face8074bb14e9602914b50c9c7e0b8cb83012119821c54c489f110e5
fapolicyd-debuginfo-1.0-3.el8_3.3.s390x.rpm	SHA-256: 0ca11a0e86fffb9cfc77e49700af7579359bfae1e1e96ce22c202dc4802ddf40
fapolicyd-debugsource-1.0-3.el8_3.3.s390x.rpm	SHA-256: 344732756fdeb7e6cbaeed1ac5a33dd4931cee6bea74921350f1b5f804fef3f6
fapolicyd-selinux-1.0-3.el8_3.3.noarch.rpm	SHA-256: 69ca74eabf5323196da08ee61f5d9d53cbfd72031bdb714dfb39dac090a5cff3

Red Hat Enterprise Linux for Power, little endian 8

SRPM
fapolicyd-1.0-3.el8_3.3.src.rpm	SHA-256: 55bd91045d220febd6d51fa35acd59f7a445d829ba24d279711cf03c18d9ff1b
ppc64le
fapolicyd-1.0-3.el8_3.3.ppc64le.rpm	SHA-256: cf144d13a23f99c29b6e22339f14b8a1af7a4f32a54e63342b3b4fe8e7b2f083
fapolicyd-debuginfo-1.0-3.el8_3.3.ppc64le.rpm	SHA-256: d26c2ab8b9ae9c0b543de3606c9f93bc39eb92a5d4060e7897c5a5a7597a2581
fapolicyd-debugsource-1.0-3.el8_3.3.ppc64le.rpm	SHA-256: f29fbfe0f5a1b156ce4da73663f4a688171a57b386184a5c6eacd8e6802e01d4
fapolicyd-selinux-1.0-3.el8_3.3.noarch.rpm	SHA-256: 69ca74eabf5323196da08ee61f5d9d53cbfd72031bdb714dfb39dac090a5cff3

Red Hat Enterprise Linux for ARM 64 8

SRPM
fapolicyd-1.0-3.el8_3.3.src.rpm	SHA-256: 55bd91045d220febd6d51fa35acd59f7a445d829ba24d279711cf03c18d9ff1b
aarch64
fapolicyd-1.0-3.el8_3.3.aarch64.rpm	SHA-256: 7524ae70da5d7df65797171b4d7b0186b59eee698a9c4b5c45970f36930275ef
fapolicyd-debuginfo-1.0-3.el8_3.3.aarch64.rpm	SHA-256: 5fe7f279c343b167ce0dd2844f58fbc2781f7072766a7eb69fdb090e73ed62c4
fapolicyd-debugsource-1.0-3.el8_3.3.aarch64.rpm	SHA-256: 0b1955b86e57c8635a4ac77a258f7b1da55cd003fc54c21fa79a067f527314aa
fapolicyd-selinux-1.0-3.el8_3.3.noarch.rpm	SHA-256: 69ca74eabf5323196da08ee61f5d9d53cbfd72031bdb714dfb39dac090a5cff3