RHBA-2022:8283 - Bug Fix Advisory

Topic

An update for selinux-policy is now available for Red Hat Enterprise Linux 9.

Description

For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes linked from the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.2 x86_64
• Red Hat Enterprise Linux Server - AUS 9.4 x86_64
• Red Hat Enterprise Linux Server - AUS 9.2 x86_64
• Red Hat Enterprise Linux for IBM z Systems 9 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.2 s390x
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.2 ppc64le
• Red Hat Enterprise Linux for ARM 64 9 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.2 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 aarch64
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 s390x

Fixes

• BZ - 1976684 - [RHEL-9.0] avc: denied { add_name } for comm="systemd-hostnam" name=".#default-hostnamenhVgzU"
• BZ - 1988164 - openvswitch policy failures
• BZ - 2000881 - SELinux is preventing rpc-worker from connectto access on the unix_stream_socket /run/libvirt/virtlockd-sock
• BZ - 2053639 - Add SELinux policy for NetworkManager's nm-sudo service
• BZ - 2055890 - container.if duplicate definition errors when building policy module
• BZ - 2056565 - rabbitmq requires access to tmpfs_t
• BZ - 2060722 - Allow fence_virtd process to search and open files with krb5_keytab_t context
• BZ - 2061680 - systemd creates mislabeled files on boot
• BZ - 2061725 - prefixdevname creates mislabeled files on boot
• BZ - 2062136 - insights-client-results.service gets selinux denials and permission denied
• BZ - 2062740 - AVC seen for denied { send_msg } for scontext=guest_u:guest_r:guest_t:s0
• BZ - 2062911 - SELinux is preventing /usr/libexec/fprintd from write access on the file persist.
• BZ - 2064688 - SELinux is preventing hostapd from 'sendto' accesses on the unix_dgram_socket /tmp/wpa_ctrl_439937-1.
• BZ - 2067501 - corosync logrotate issues [rhel-9.1.0]
• BZ - 2070569 - SELinux is preventing /usr/libexec/qemu-kvm from create access on the netlink_rdma_socket labeled svirt_t [rhel-9.1.0]
• BZ - 2070982 - SELinux is preventing perf from using the 'bpf' capability
• BZ - 2074414 - avc denied for comm="teamd" scontext=system_u:system_r:NetworkManager_t:s0
• BZ - 2076642 - rhel9.1: SELinux rules for rng-tools
• BZ - 2076681 - Secure_mode boolean allows staff SELinux user switch to unconfined
• BZ - 2079290 - Update selinux-policy for selinux-3.4
• BZ - 2081059 - [RFE] semanage default file contexts in /opt/
• BZ - 2082404 - SELinux policy prevents systemd_sleep_t from actually suspending
• BZ - 2083509 - samba-dcerpcd and samba rpcd programs need selinux-policy permissions
• BZ - 2085392 - SELinux prevents dbus-broker from ioctl and getopt on a unix_stream_socket labeled kernel_t
• BZ - 2088257 - [RHEL-9.1] avc denied seen while provisioning
• BZ - 2089486 - Tor with DNSPort
• BZ - 2090269 - restorecon: Regex version mismatch, expected: 10.40 2022-04-14 actual: 10.37 2021-05-26
• BZ - 2094155 - rhel9 avc denied with rm and dhclient-script
• BZ - 2094485 - SELinux prevents audisp-remote to send message
• BZ - 2094489 - SELinux is preventing ss from nlmsg_read access on the netlink_tcpdiag_socket labeled ctdbd_t
• BZ - 2095884 - dlm_controld needs permission to signal cluster daemons
• BZ - 2096255 - AVC denial: /usr/libexec/samba/rpcd_classic
• BZ - 2096521 - ipa trust-add fails with ipa: ERROR: CIFS server communication error : code "3221225996"
• BZ - 2098130 - SELinux prevents the keepalived process from reading the /sys/devices/system/cpu/ directory
• BZ - 2101910 - rhel9 avc denied with rm and dhclient-script
• BZ - 2102084 - Test is working in Permissive mode only: avc: denied { sendto } for comm="smbcontrol"
• BZ - 2105038 - SELinux prevents the stalld process from using the getsched syscall
• BZ - 2107363 - [RHEL9] insights-client raises SELinux issues
• BZ - 2111069 - SELinux preventing systemd-network-generator from creating files in /run/systemd/network/
• BZ - 2111206 - Support all init_t <=> install_t operations that also work with init_t <=> unconfined_t
• BZ - 2112014 - Unable to start container with -it and runc
• BZ - 2112395 - SELinux prevents samba-bgpd from talking to various sockets
• BZ - 2118631 - [RHEL9] chronyd not allowed to bind to PTP event port
• BZ - 2121125 - insights-client fails to execute additional services

CVEs

(none)

References

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index