RHBA-2022:3918 - Bug Fix Advisory

Topic

New selinux-policy packages are available for Red Hat Enterprise Linux 9.

Description

For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.0 Release Notes linked from the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.2 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.0 x86_64
• Red Hat Enterprise Linux Server - AUS 9.6 x86_64
• Red Hat Enterprise Linux Server - AUS 9.4 x86_64
• Red Hat Enterprise Linux Server - AUS 9.2 x86_64
• Red Hat Enterprise Linux for IBM z Systems 9 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.2 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.0 s390x
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.2 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.0 ppc64le
• Red Hat Enterprise Linux for ARM 64 9 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.2 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.0 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.0 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0 x86_64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 aarch64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.0 aarch64
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 s390x
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.0 s390x

Fixes

• BZ - 1960010 - Many AVCs after default package set installation
• BZ - 1997182 - Need to allow haproxy_t self:unix_stream_socket connectto
• BZ - 1999152 - selinux-policy needs to allow CAP_SYS_MODULE for firewalld
• BZ - 2000039 - AVC failures seen with : denied { create } comm="systemd"
• BZ - 2000196 - SELinux prevents WWAN ports being accessed (Qualcomm SDX55)
• BZ - 2002143 - SELinux label for file system.token is wrong if it is generated by virtproxyd
• BZ - 2003037 - SELinux is preventing gnome-session-c from connectto access on the unix_stream_socket [rhel-9.0.0]
• BZ - 2004885 - SELinux is preventing /usr/libexec/at-spi-bus-launcher from connect access on the tcp_socket port None
• BZ - 2006039 - IPA SELinux module still exists in the distribution policy
• BZ - 2007960 - SELinux prevents the systemd process from watching the /etc/insights-client/.lastupload file
• BZ - 2011772 - avc: denied { search } for pid=1662 comm="at-spi-bus-laun" name="gnome-initial-setup" dev="tmpfs"
• BZ - 2014423 - Additional rules for keepalived PING_CHECK
• BZ - 2015928 - Need a label created for RHDS tmpfs directory (cont)
• BZ - 2017838 - Running systemctl status of user triggered AVC denials
• BZ - 2017848 - Remove the SELinux lockdown class from selinux-policy
• BZ - 2023456 - SELinux does not allow nftables to forward packets
• BZ - 2027660 - SELinux policy prevents userfaultfds from being transferred using SCM_RIGHTS
• BZ - 2027751 - smbcontrol fails in SELinux Enforcing mode
• BZ - 2027994 - /dev/ng0n1 has device_t
• BZ - 2029392 - /dev/tmc_etr* have device_t
• BZ - 2029866 - SELinux prevents inotify on /etc/dnsmasq.d and tree under it
• BZ - 2033504 - AVC check fail for running perf
• BZ - 2034463 - [RHEL9] SELinux is preventing /usr/sbin/fcoemon from module_request access on the system labeled kernel_t
• BZ - 2035702 - SELinux is preventing /usr/libexec/qemu-kvm from map access on the chr_file /dev/vhost-vdpa-0
• BZ - 2036582 - SELinux prevents ModemManager from creating the qipcrtr socket
• BZ - 2036585 - sshd failing to open "/proc/sys/fs/nr_open"
• BZ - 2038157 - smbcontrol fails in SELinux Enforcing mode
• BZ - 2039449 - SELinux denial appears when printing via lpd (cups-lpd)
• BZ - 2039453 - using pam_limits nonewprivs causes avc: denied { nnp_transition } for comm="(systemd)"
• BZ - 2039757 - denied setgid for sss_cache
• BZ - 2039759 - nvme-fabrics has device_t
• BZ - 2039974 - restorecon would relabel /run/stratisd
• BZ - 2047811 - selinux denial for sanlock during host deployment
• BZ - 2048521 - CentOS 9 Stream: boot hangs with avc: denied when using a LUKS encrypted filesystem
• BZ - 2049372 - HTTP script cannot send mails due to sendmail not being able to read on stdin
• BZ - 2049732 - Add missing policy rules for latest alsactl
• BZ - 2053458 - sysadm_passwd_t requires to execute sss_cache
• BZ - 2054657 - SELinux prevents the chage process from executing the sss_cache program
• BZ - 2055578 - SELinux labels OpenBGPD's /usr/sbin/bgpd process as zebra_t
• BZ - 2055822 - enabled by default: selinuxuser_execstack?
• BZ - 2055823 - [RfE] The insights client should not run as unconfined process
• BZ - 2061277 - corosync logrotate issues
• BZ - 2063612 - SELinux is preventing /usr/libexec/qemu-kvm from create access on the netlink_rdma_socket labeled svirt_t
• BZ - 2064274 - selinux-policy default has changed to disallow executable stacks by default

CVEs

(none)

References

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.0_release_notes/index