RHBA-2022:1995 - Bug Fix Advisory

Topic

An update for selinux-policy is now available for Red Hat Enterprise Linux 8.

Description

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes linked from the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.6 x86_64
• Red Hat Enterprise Linux Server - AUS 8.6 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le
• Red Hat Enterprise Linux Server - TUS 8.8 x86_64
• Red Hat Enterprise Linux Server - TUS 8.6 x86_64
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64

Fixes

• BZ - 1860443 - AVC denial init_t home_bin_t when systemd ExecStart executable in user's home bin directory
• BZ - 1861968 - container.if duplicate definition errors when building policy module
• BZ - 1872245 - [VMware][RHEL 8] vmtools is not able to install rpms
• BZ - 1879585 - Stratis device paths move from /stratis to /dev/stratis
• BZ - 1905441 - AVC denials recorded for fsetid while running unbound with local socket, though it (unbound-control) still works!
• BZ - 1917879 - Cannot sudo passwordless from staff_u/sysadm_u when using pam_ssh_agent_auth
• BZ - 1919122 - Permission denied+AVC seen when executing "sudo authconfig" as a confined user (staff_u or sysadm_u)
• BZ - 1920521 - Please add selinux rules to allow postfix executables log into file
• BZ - 1920883 - Policy is lacking entrypoint on user_tmp_t for sudoing from confined users
• BZ - 1924038 - SELinux policy for FreeRADIUS blocks DHCP server, DHCP client, VMPS and BDF roles
• BZ - 1943572 - confined sysadm user cannot update a user's password using "sudo passwd ..." command
• BZ - 1949493 - AVC denied for chronyd socket
• BZ - 1949871 - SELinux is preventing /usr/libexec/platform-python3.6 from add_name access on the directory /var/log/hawkey.log
• BZ - 1965251 - Confined sysadm users cannot execute sosreport command
• BZ - 1966945 - AVC "signull" seen for confined users when executing "sudo" command
• BZ - 1985000 - selinux is preventing the execution of lvmlockctl during sanlock device failure testing
• BZ - 1986076 - Add SELinux policy for NetworkManager's nm-sudo service
• BZ - 1988339 - HTTP script cannot send mails due to sendmail not being able to read on stdin
• BZ - 1991029 - SELinux is preventing /usr/sbin/lldpd from {search and create} access on the directory /var/agentx/master.
• BZ - 1991443 - [RHEL 8.4] Backport container-selinux policy to allow spc_t domains to set bpf rules on any domain
• BZ - 2000488 - Confined sysadm users cannot execute "realm list" command
• BZ - 2001599 - map AVC denial for /usr/libexec/certmonger/dogtag-ipa-renew-agent-submit
• BZ - 2004990 - SELinux policy for the DBus daemon prevents the Anaconda installer from calling the subscription manager DBus service [rhel-8.6.0]
• BZ - 2009769 - DBus unable to send_msg to cloud-init when "sudo" or "su" is used in cloud-init "user-data" scripts
• BZ - 2010873 - Additional rules for keepalived PING_CHECK
• BZ - 2013749 - sudo cannot execute systemctl command properly
• BZ - 2015539 - login produces an AVC checking /sys/fs/cgroup when fingerprint is configured
• BZ - 2021835 - .autorelabel does not work anymore in RHEL8.4 if a file required by systemd is unlabelled (/etc/localtime)
• BZ - 2025445 - AVC prevents ping -I from running in UBI 8 container
• BZ - 2026598 - Confined users cannot execute kerberos commands ("kinit", "klist", ...)
• BZ - 2027740 - smbcontrol fails in SELinux Enforcing mode
• BZ - 2028379 - lldpd with option to use tcp is not allowed to create a tcp socket
• BZ - 2029873 - SELinux prevents the rhsm-service process from working with /memfd:libffi
• BZ - 2030156 - SELinux denials { setgid } are triggered by sss_cache
• BZ - 2031065 - Confined users mapped to "sysadm_u" cannot execute "systemd-run" command
• BZ - 2031853 - [RfE] The insights client should not run as unconfined process
• BZ - 2033873 - smbcontrol fails in SELinux Enforcing mode
• BZ - 2038955 - FR cannot create a TCP socket (avc: denied { name_connect } for pid comm="radiusd" dest=1813 )
• BZ - 2039458 - efivarfs_t label on /sys/firmware/efi instead of /sys/firmware/efi/efivars
• BZ - 2040214 - SELinux prevents xdm_t process from talking to timedatex_t process via D-bus
• BZ - 2041447 - SELinux denials with shorewall6-lite service
• BZ - 2043599 - postfix cannot use certs stored in dovecot certs directory
• BZ - 2044048 - "wpa_cli status" timed out after updating the selinux packages
• BZ - 2046481 - Running systemctl status of user triggered AVC denials
• BZ - 2048514 - udev can't create /dev/stratis/poolname/fsname links any more: vc: denied { associate } for comm="systemd-udevd" name="stratis"
• BZ - 2049481 - ocf:heartbeat:CTDB resource start is blocked by selinux
• BZ - 2049730 - Add missing policy rules for latest alsactl
• BZ - 2053457 - sysadm_passwd_t requires to execute sss_cache
• BZ - 2054718 - SELinux prevents the chage process from executing the sss_cache program
• BZ - 2064284 - SELinux is preventing hostapd from 'sendto' accesses on the unix_dgram_socket /tmp/wpa_ctrl_439937-1.

CVEs

(none)

References

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/index