RHBA-2021:1639 - Bug Fix Advisory

Topic

An update for selinux-policy is now available for Red Hat Enterprise Linux
8.

Description

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.4 Release Notes linked from the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
• Red Hat Enterprise Linux Server - AUS 8.6 x86_64
• Red Hat Enterprise Linux Server - AUS 8.4 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4 ppc64le
• Red Hat Enterprise Linux Server - TUS 8.6 x86_64
• Red Hat Enterprise Linux Server - TUS 8.4 x86_64
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4 x86_64

Fixes

• BZ - 1694681 - Slow listing of files owned by 'nobody' on nfs share with SELinux and 'filter_users'
• BZ - 1781806 - SELinux prevents NetworkManager from getting status of winbind service
• BZ - 1782539 - dnsmasq tftp is not able to read files with SELinux public_content_t context
• BZ - 1794531 - missing definition for both TCP and UDP port 61000
• BZ - 1804626 - incorrect fcontext pattern for /run/pcsd-ruby.socket
• BZ - 1815603 - the vhostmd service triggers SELinux denial during reboot
• BZ - 1823672 - rsyslog "omfile" cannot append to custom file locations
• BZ - 1831630 - SELinux prevents the sysadm_u user from running rfkill (or gsd-rfkill)
• BZ - 1842867 - rpm spec to be fixed to pass the rpm verify validation for selinux-policy-targeted
• BZ - 1842897 - Denied NetworkManager write to /var/tmp/dracut.*/systemd-cat while generating initrd image
• BZ - 1848355 - default label for the /run/strongswan directory is not correct
• BZ - 1853389 - fetchmail cannot remove stale /var/spool/mail/.fetchmail.pid file
• BZ - 1854471 - when staff_u user logs in, user pulseaudio service triggers { nnp_transition } denial
• BZ - 1861771 - Cannot use the graphical user interface when pam_tty_audit.so is enabled
• BZ - 1873211 - fsetid capability required by certmonger
• BZ - 1873658 - rebased firefox produce SElinux AVC / denied sys_ptrace for rtkit-daemon
• BZ - 1874527 - /var/tmp/krb5_0.rcache2 is created with a wrong selinux context when krb5-API is used
• BZ - 1877044 - kprop create var/tmp/krb5_0.rcache2 with a wrong selinux context
• BZ - 1880474 - Missing policy rule prevents using Labeled IPsec
• BZ - 1881884 - SELinux policy denies dovecot's bind to TCP submission ports 465/587
• BZ - 1883906 - selinux prevents timedatex (timedatectl) commands running from cron on RHEL8.x
• BZ - 1883980 - selinux denials found in openvswitch-2.12.0-1.1.el8.x86_64
• BZ - 1884179 - SELinux prevents sss_cache from calling the utime syscall
• BZ - 1889542 - SELinux is preventing swanctl from 'search' accesses on the directory strongswan.
• BZ - 1889673 - [RHEL 8] Geo-replication in rsync mode is fails to sync data to the secondary sharded gluster volume
• BZ - 1895130 - keepalived can't start due to selinux, due node_bind error
• BZ - 1895322 - rhsmcertd_t needs to execute kpatch (kpatch_exec_t)
• BZ - 1898694 - Add setgid capability into policy for tcsd
• BZ - 1900650 - SELinux prevents the fuser process from reading the /etc/httpd/run symlink
• BZ - 1901958 - Add perf_event class to selinux-policy
• BZ - 1902227 - Device /dev/isst_interface is labeled with device_t which breaks STIG compliance
• BZ - 1907485 - /dev/vhost-vdpa-$N needs vhost_device_t selinux label
• BZ - 1907517 - Linux user mapped into SELinux user_u can use sudo/su to evaluate permissions to root
• BZ - 1916046 - openvswitch requires perf_event open SELinux permission when install openvswitch package
• BZ - 1923985 - [RHEL-8] avc: denied { node_bind } for pid=50272 comm="rhsmcertd-worke"

CVEs

(none)

References

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/index