RHBA-2023:7091 - Bug Fix Advisory

Topic

An update for selinux-policy is now available for Red Hat Enterprise Linux 8.

Description

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes linked from the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

• BZ - 2004843 - SELinux is preventing executing svnserve's hooks
• BZ - 2093355 - AVCs when trying to execute a command through qemu-ga ("guest-exec" command)
• BZ - 2160000 - SNMP OIDs 1.3.6.1.2.1.25.3.6 (hrDiskStorageTable) and 1.3.6.1.2.1.25.3.7 (hrPartitionTable) not working with SELinux enforcing
• BZ - 2165752 - SELinux policy prevents sendmail_t from performing Cyrus IMAP mail delivery
• BZ - 2167731 - sos command running under wrong context
• BZ - 2172541 - pam_cap fails due to missing rule
• BZ - 2173289 - ipa-healthcheck cannot be executed by system cronjobs (system_cronjob_t)
• BZ - 2177254 - systemd's SIGPIPE masking is not inherited by services
• BZ - 2177607 - [RHEL8.6/Insights/SELinux/Bug] AVC Compliance irq with selinux-policy-3.14.3-95.el8_6.6
• BZ - 2177704 - Cannot add smartcard key to SSH agent when user is confined
• BZ - 2183351 - SELinux prevents the insights-client service from executing the ipcs command
• BZ - 2185158 - [RHEL8.7/Insights/SELinux/Bug] Insights-client SELinux AVC denials for python3 and teamdctl
• BZ - 2196524 - hostnamectl and timedatectl are timeouting when running through cluster_t context
• BZ - 2207819 - In selinux-policy-3.14.3-117.el8, AVC denials frequently occur in commands executed via insights-client
• BZ - 2208162 - AVC denials caused by rebased pkcsslotd
• BZ - 2210771 - AVC reported when configuring custom print command in smb.conf
• BZ - 2213606 - SELinux labels RIPE Atlas Probe/Anchor's /usr/sbin/ripe-atlas process as zebra_t
• BZ - 2213965 - Policy for httpd to connect to Redis via TCP socket missing
• BZ - 2214572 - Insight generates AVC for command "systemctl status --all" when system has persistent journal.
• BZ - 2216151 - Listing /var with details (ls -l /var) leads to missing permissions printing on some directories
• BZ - 2218362 - selinux-policy-doc and container-selinux.8 manpage ownership
• BZ - 2225233 - dotnet executed by the insights-client service triggers SELinux denials
• BZ - 2225527 - Make insights_client_t an unconfined domain
• BZ - 2229559 - [RHEL8/Insights/SELinux/Bug] SELinux AVC denials for insights-client var-log-t

CVEs

(none)

References

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.9_release_notes/index