RHBA-2023:2483 - Bug Fix Advisory

Topic

An update for selinux-policy is now available for Red Hat Enterprise Linux 9.

Description

For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.2 x86_64
• Red Hat Enterprise Linux Server - AUS 9.4 x86_64
• Red Hat Enterprise Linux Server - AUS 9.2 x86_64
• Red Hat Enterprise Linux for IBM z Systems 9 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.2 s390x
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.2 ppc64le
• Red Hat Enterprise Linux for ARM 64 9 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.2 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 aarch64
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 s390x

Fixes

• BZ - 1917024 - [qemu-guest-agent] guest-ssh-* commands not working in 5.2.0 package
• BZ - 2014606 - Improvements in selinux-policy for SELinux users with the sysadm_r role
• BZ - 2042515 - Regression in dirsrv-snmp test suite during recent rhel9 test runs
• BZ - 2053641 - Create separate SELinux context for NetworkManager-dispatcher
• BZ - 2057501 - Regression in opendnssec daemons test suite during rhel9 test run
• BZ - 2062936 - SELinux prevents the aide process from doing connectto on the /run/systemd/userdb/io.systemd.Machine socket
• BZ - 2082524 - Rebase selinux-policy to the newest one available in Fedora
• BZ - 2112044 - lldpad causing AVC messages starting with selinux-policy--targeted 34.1.32
• BZ - 2121729 - SELinux prevents the samba-bgpd from writing the /var/run/nscd/socket socket
• BZ - 2122061 - SELinux is preventing /usr/bin/ps from sys_ptrace access on the cap_userns labeled insights_client_t.
• BZ - 2122958 - insights-client raises SELinux dbus issue
• BZ - 2123260 - SELinux prevents confined users (staff_u, sysadm_u) from successfully running vlock
• BZ - 2123358 - insights-client fails to execute additional services [rhel-9.2.0]
• BZ - 2124292 - A lot of AVC selinux denials when insights client is executed with obfuscation enabled
• BZ - 2124303 - rhcd cannot connect to stage environment with latest selinux-policy installed
• BZ - 2124549 - insights-client triggers SELinux denials after selinux-policy update
• BZ - 2124695 - SELinux prevents the sbd processes from readlink syscall { sys_ptrace }
• BZ - 2124797 - selinux context is not set for journald LogNamespace directories /run/systemd/journal.<lognamespace>/ by default
• BZ - 2124943 - SELinux prevents the proftpd service from mmap-ing the /run/proftpd/proftpd.delay file
• BZ - 2124991 - insights-client collection, wrong version of running image reported to edge management console
• BZ - 2130204 - SELinux is preventing /usr/bin/python3.9 from execute access on the file /usr/bin/gpg
• BZ - 2132424 - FR cannot create a TCP socket (avc: denied { name_connect } for pid comm="radiusd" dest=1813 )
• BZ - 2132942 - confined users staff_u generate SELinux denials when pulseaudio starts at GUI login
• BZ - 2133221 - SELINUX policy denies net-snmp's bind to TLS/DTLS port 10161
• BZ - 2134515 - Mode default differs for /var/lib/sepolgen/interface_info provided by selinux-policy-devel
• BZ - 2134726 - SELinux is preventing /usr/sbin/ns-slapd from 'search' accesses on the directory /proc/sys/fs/binfmt_misc
• BZ - 2134829 - AVC Denial on iptables / ip6tables on Centos Stream 9
• BZ - 2137085 - Update to selinux-policy-targeted-34.1.44-1.el9.noarch triggers bpf alerts
• BZ - 2139363 - [RFE] add interfaces for watch and watch_sb to allow fapolicyd to easily cover it with its DSP
• BZ - 2145266 - Move back security classes to comply with the Stability kbase
• BZ - 2149452 - wireguard-tools-1.0.20210914-2 won't start with selinux enable after upgrading to 9.1
• BZ - 2149560 - Cannot start cellular connection when SELinux is in Enforcing
• BZ - 2150680 - SELinux samba-dcerpcd (Samba 4.16) access denied
• BZ - 2151841 - SELinux prevents the rsyslogd from dropping capabilities (syscall=prctl)
• BZ - 2152823 - SELinux prevents the journal-offline command from relabeling the systemd journal file
• BZ - 2156068 - SELinux is preventing /usr/sbin/rsyslogd from 'search' accesses on the directory net
• BZ - 2157891 - SELinux prevents the prosody service from creating the /run/prosody/prosody.sock socket
• BZ - 2160391 - SELinux is preventing systemd from using LoadCredentials
• BZ - 2164434 - RFE: dontaudit execmem for ftpd_t
• BZ - 2164845 - SELinux prevents the NM iscsid dispatcher from reading the /proc/cpuinfo file
• BZ - 2166283 - httpd fails to start with opencryptoki SW token
• BZ - 2172268 - libvirt is unable to start passt process when SELinux is enforcing
• BZ - 2176487 - the wg-quick service is still broken in enforcing mode
• BZ - 2178612 - Add a SELinux boolean which allows qemu guest agent to write SSH keys

CVEs

(none)

References

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index