RHBA-2021:4420 - Bug Fix Advisory

Topic

An update for selinux-policy is now available for Red Hat Enterprise Linux
8.

Description

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.5 Release Notes linked from the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
• Red Hat Enterprise Linux Server - AUS 8.6 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le
• Red Hat Enterprise Linux Server - TUS 8.8 x86_64
• Red Hat Enterprise Linux Server - TUS 8.6 x86_64
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64

Fixes

• BZ - 1797899 - virt-admin failed to connect virtlogd daemon
• BZ - 1801249 - some policy interfaces cannot be compiled
• BZ - 1816718 - Remove Glusterd SELinux module from Distribution policy
• BZ - 1823669 - rsyslog "imfile" module cannot read parent directories of the file to process
• BZ - 1843238 - Need a label created for RHDS tmpfs directory (cont)
• BZ - 1846081 - both rhsm and rhsm-facts services run as unconfined_service_t
• BZ - 1855215 - selinux prevents adcli from executing /usr/bin/net command through sssd
• BZ - 1860924 - SELinux prevents dbus-daemon from reading symlinks in /run/systemd/dynamic-uid directory
• BZ - 1878020 - SELinux is preventing /usr/libexec/platform-python3.6 from search access on the /proc/pid of dnf
• BZ - 1887572 - SELinux prevents rhsmcertd-worker from executing the gpgsm file
• BZ - 1887739 - Any "boot.log" file created on the system gets label plymouthd_var_log_t
• BZ - 1894132 - SELinux prevents 2 programs from accessing /run/lock/opencryptoki/LCK..APIlock
• BZ - 1899703 - [selinux-policy]: Support virtiofs filesystem
• BZ - 1913414 - SELinux is preventing systemd-journal-upload from 'name_connect' accesses on the tcp_socket port 19532
• BZ - 1919253 - Invalid context in database for /var/tmp-inst, should be /var/tmp/tmp-inst
• BZ - 1919399 - SELinux is preventing /usr/lib/cups/daemon/cups-lpd from read access on the sock_file cups.sock
• BZ - 1927551 - SELinux block systemd from running scripts in /usr/lib/systemd/system-sleep
• BZ - 1931460 - SELinux prevents hibernation (preventing systemd-sleep from getattr access to swap partition)
• BZ - 1931848 - selinux-policy prevents ipsec/pluto to work over TCP
• BZ - 1937111 - Add cluster_exec_t default context for /usr/lib/pcs/pcs_snmp_agent
• BZ - 1941464 - SELinux is preventing /usr/sbin/virtlockd from create access on the directory lockd
• BZ - 1947841 - Secure_mode boolean allows staff SELinux user switch to unconfined
• BZ - 1951093 - RFE: Grant rpc.gssd access to $HOME/.k5identity in selinux-policy
• BZ - 1955547 - Allow nnp_transition for init_t -> install_t
• BZ - 1956302 - Confined sysadm users cannot read the content of /etc/shadow, even when using getent
• BZ - 1963162 - SELinux is preventing NetworkManager from 'write' accesses on the fifo_file /var/tmp/dracut.818Oxc/systemd-cat.
• BZ - 1965985 - SELinux is preventing kexec from read access on the file /var/lib/kdump/initramfs-*kdump.img
• BZ - 1966842 - SELinux is preventing virtlogd from 'read, append' accesses on the file system.token
• BZ - 1967125 - SELinux is preventing libcap-ng from 'getattr' accesses on the filesystem /proc.
• BZ - 1973325 - Add SELinux support for the checkpoint_restore cap2 class capability
• BZ - 1977676 - SELinux prevents the hostapd from binding to DHCP port
• BZ - 1978562 - [RHEL8.2] avc: denied { add_name } for pid=1416 comm="fcoemon" name="enabled"
• BZ - 1979121 - [RHEL8.5] SELinux is preventing /usr/sbin/lldpad
• BZ - 1979182 - avc: denied { getattr } for comm="systemctl" name="/" on systemctl start cockpit.socket
• BZ - 1994096 - RFE: add patch to set grub boot_success flag on shutdown/reboot
• BZ - 1994718 - Need policy update for rhsmcertd to use new cloud-what implementation
• BZ - 2002666 - SELinux policy for the DBus daemon prevents the Anaconda installer from calling the subscription manager DBus service

CVEs

(none)

References

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/index