RHBA-2024:2402 - Bug Fix Advisory

Topic

An update for selinux-policy is now available for Red Hat Enterprise Linux 9.

Description

For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4 x86_64
• Red Hat Enterprise Linux Server - AUS 9.4 x86_64
• Red Hat Enterprise Linux for IBM z Systems 9 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4 s390x
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4 ppc64le
• Red Hat Enterprise Linux for ARM 64 9 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x

Fixes

• RHEL-1547 - encountering selinux denial on ppc64le during attempted write by lscpu during rhsmcertd process
• RHEL-3633 - Default selinux policy doesn't allow to add printer using gnome-control-center
• RHEL-14029 - AVC "setattr" on keepalived script gets generated when keepalived starts
• RHEL-14110 - exim generates an AVC on "create" when sending mails
• RHEL-14413 - selinux: kexec-tools require new rules to enable the access to tmpfs
• RHEL-14014 - ipa-client-install displays 'Cannot get SELinux boolean 'sssd_use_usb': CalledProcessError(Command ['/usr/sbin/getsebool', 'sssd_use_usb']'
• RHEL-14289 - autorelabel with selinux-policy-mls in enforcing leads to endless loop - permission denied because of wrong context
• RHEL-14374 - default label for /var/run/auditd.state file is not correct
• RHEL-15085 - SELinux prevents the ntpd service (ntpsec) from name_connect to 4460/tcp (NTS)
• RHEL-15220 - incorrect SELinux context for files backed up by authselect
• RHEL-1548 - Remove Glusterd SELinux module from Distribution policy
• RHEL-15175 - SELinux prevents the opensmtpd service from starting
• RHEL-15326 - the dhcpcd service triggers { bpf } denials
• RHEL-1553 - MLS: kmod-static-nodes.service fails at boot due to a AVC popping up
• RHEL-1555 - SELinux prevents certain confined users from starting the restorecond_user service
• RHEL-16708 - Confined user's sudo fails to authenticate with RSA PAM due to AVC
• RHEL-16716 - SELinux prevents the systemd-localed from creating the /etc/X11/xorg.conf.d directory [rhel-9]
• RHEL-11174 - selinux prevents syslogd_t from execution the systemd_systemctl_exec_t
• RHEL-16676 - SELinux prevents the gpsd process from accessing /dev/gnss0
• RHEL-16850 - Unable to connect to PostgreSQL using sockets
• RHEL-18219 - selinux policy adjustments for chronyd-restricted service
• RHEL-19199 - Make bootc be install_exec_t
• RHEL-5032 - policycoreutils-restorecond sets incorrect SELinux context for D-Bus daemons
• RHEL-14077 - Users mapped to sysadm_u cannot execute `sudo traceroute` command
• RHEL-15432 - Confined sysadm cannot execute "sudo tcpdump" command [rhel-9]
• RHEL-17820 - [9.4] avc denied when starting opa-fm service
• RHEL-19276 - AVC appears when mdadm checks the /dev/stratis location [rhel-9]
• RHEL-19282 - SELinux policy prevents sendmail_t from performing Cyrus IMAP mail delivery
• RHEL-21452 - Confine the sap module
• RHEL-14735 - SELinux blocks smbd-notifyd from watch permission on user_home_dir_t
• RHEL-22277 - AVC "sys_admin + bpf" on conntrackd when using Kernel space filtering
• RHEL-1551 - "unconfined_login" boolean doesn't seem to have any effect on users
• RHEL-24841 - Logout throwing selinux warning
• RHEL-24946 - Cannot execute "tlog-rec" as a confined user [rhel-9]
• RHEL-11250 - libdnf used by Insights client labels temporary files with insights_client_tmp_t leading to denials by systemd and gnupg
• RHEL-26073 - SELinux prevents the tumblerd processes from watching /run/mount/utab.lock
• RHEL-26660 - SELinux prevents chronyd from writing into /var/run/timemaster/chrony.SOCK0 [rhel-9]
• RHEL-26663 - SELinux prevents the wdmd from reading the /sys/class/watchdog/watchdog0/identity symlink [rhel-9]

CVEs

(none)

References

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index