RHBA-2023:6617 - Bug Fix Advisory

Topic

An update for selinux-policy is now available for Red Hat Enterprise Linux 9.

Description

For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4 x86_64
• Red Hat Enterprise Linux Server - AUS 9.6 x86_64
• Red Hat Enterprise Linux Server - AUS 9.4 x86_64
• Red Hat Enterprise Linux for IBM z Systems 9 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4 s390x
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4 ppc64le
• Red Hat Enterprise Linux for ARM 64 9 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x

Fixes

• BZ - 2026795 - SELinux policy (daemons) changes required for package: fido-device-onboard in RHEL 9.0
• BZ - 2039774 - pktcdvd has device_t
• BZ - 2047945 - Additions to the PowerDNS SELinux policy
• BZ - 2099194 - Files in /tmp-inst/ directory (and sub-dirs) are not labeled correctly
• BZ - 2112729 - Confined SELinux user 'staff_u' cannot run probes from scap-workbench if privilege escalation performed by polkit
• BZ - 2128833 - Please add policy for booth daemon
• BZ - 2143153 - Change wording in /etc/selinux/config
• BZ - 2143641 - USER_AVC produced when cups sends a DBus notification upon printer status change
• BZ - 2151378 - Selinux prevents squid from binding snmp ports
• BZ - 2153782 - Confined user sudo'ing with sysadm_r role sees journalctl AVCs
• BZ - 2162663 - Can't register to Insights using a cloud-init script
• BZ - 2165634 - SELinux prevents the tshark process from using the sched_setattr syscall
• BZ - 2165863 - Dovecot SELinux policy incorrect to incomplete for /var/spool/dovecot/
• BZ - 2173604 - SELinux prevents the chronyc process from searching in the /proc/sys/net/ipv6/conf/all/ directory
• BZ - 2173685 - [Regression] Executing bash from a system cronjob ends up executing as rpm_script_t
• BZ - 2174445 - SELinux is preventing /usr/bin/smbspool from write/add_name/create on /var/lib/samba/lock/ and /var/lib/samba/lock/gencache.tdb
• BZ - 2175137 - SELinux prevents the systemd-timesyncd process from watching the /run/systemd/ directory
• BZ - 2175290 - more specific label for /dev/userfaultfd
• BZ - 2179027 - Add a SELinux boolean which allows qemu guest agent to write SSH keys [rhel-9.3.0]
• BZ - 2181402 - qemu-guest-agent couldn't write ssh-key to normal user
• BZ - 2181565 - systemd-pstore fails to start due to avc denial
• BZ - 2184999 - rabbitmq: inet_gethost fails to access /proc/sys/net/ipv6/conf/all/disable_ipv6 when ipv6 is used
• BZ - 2186233 - systemd's SIGPIPE masking is not inherited by services
• BZ - 2186759 - misconfigured selinux policy for keepalived triggers AVC denials when using track_file
• BZ - 2187290 - enhancement request - pacemaker + virt + virsh
• BZ - 2187745 - io_uring requires mmap() of anonymous inodes
• BZ - 2187893 - Incorrect default SELinux labels
• BZ - 2188173 - The files(/usr/lib/systemd/system/proftpd.* & /usr/lib/systemd/system/vsftpd.*) are labeled with 'iptables_unit_file_t' context in the SELinux policy (policy/modules/contrib/ftp.fc).
• BZ - 2190178 - insights-client triggers SELinux denials for teamdctl
• BZ - 2192154 - selinux is blocking wireguard when trying to establish a connection via wg-quick
• BZ - 2203201 - Missing type transition for cloud-init to create /root/.gnupg with correct label
• BZ - 2203359 - SELinux AVC from rhsm-service
• BZ - 2209235 - AVC denials caused by rebased pkcsslotd
• BZ - 2209650 - SELinux prevents the collectd process from reading the /proc/net/dev symlink
• BZ - 2209973 - SELinux prevents nsd-* tools (executed by crond) from writing into /run/nsd/nsd.ctl socket
• BZ - 2211566 - SELinux prevents the rhsmcertd-worker from executing the ip command
• BZ - 2213516 - incorrect labels on /run/systemd/generator.late/efi.* files ?
• BZ - 2213573 - arpwatch is not allowed to use msmtp as /usr/sbin/sendmail
• BZ - 2213605 - SELinux labels RIPE Atlas Probe/Anchor's /usr/sbin/ripe-atlas process as zebra_t
• BZ - 2214298 - selinux prevents widevine from running for users with home on nfs
• BZ - 2215507 - Listing /var with details (ls -l /var) leads to missing permissions printing on some directories
• BZ - 2220643 - selinux policy logs denys read/write when running sa-update from spamassassin
• BZ - 2221251 - Redundant line in mozilla.if causes problems compiling non-standard modules
• BZ - 2223727 - Allow access to /dev/udmabuf (dma_device_t) from libvirt qemu (svirt_t)
• BZ - 2224737 - SELinux is preventing /usr/bin/python3.9 from 'unlink' accesses on the file /insights-redhatWS.local-20230721232748.tar.gz.
• BZ - 2225418 - the /run/dhclient.* files are mislabeled when dhclient is executed by the cloud-init-local service
• BZ - 2225526 - Make insights_client_t an unconfined domain
• BZ - 2228403 - Missing execute_no_trans policy for nut stack
• BZ - 2229722 - SELinux policy blocks FDO servers and FDO client
• BZ - 2230277 - Allow ipsec to read nsfs files
• BZ - 2230365 - [Regression] AVC reported when samba-dcerpcd tries to read Samba shares
• BZ - 2231257 - MLS: logrotate.service fails to start because it cannot map its configuration file in memory
• BZ - 2234765 - SELinux prevents cups-pdf processes from connecting to /run/systemd/userdb/io.systemd.DynamicUser UNIX stream socket (kernel_t)

CVEs

(none)

References

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index