RHBA-2024:3143 - Bug Fix Advisory

Topic

An update for selinux-policy is now available for Red Hat Enterprise Linux 8.

Description

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

• RHEL-1099 - User's temporary files are not labeled correctly
• RHEL-1678 - Regression due to /usr/bin/msmtp security context mismatch
• RHEL-2415 - SELinux blocks numad from ipc_owner
• RHEL-3539 - SELinux File context are not showing correct information as expected - authselect backup files with etc_t but dir expects var_lib_t
• RHEL-14186 - exim generates an AVC on "create" when sending mails
• RHEL-14376 - default label for /var/run/auditd.state file is not correct
• RHEL-16185 - missing interface definitions [rhel-8]
• RHEL-16567 - Confined user's sudo fails to authenticate with RSA PAM due to AVC
• RHEL-16715 - SELinux prevents the systemd-localed from creating the /etc/X11/xorg.conf.d directory [rhel-8]
• RHEL-1679 - Users mapped to sysadm_u cannot execute `sudo dnf` command
• RHEL-10087 - selinux prevents syslogd_t from execution the systemd_systemctl_exec_t
• RHEL-15398 - Confined sysadm cannot execute "sudo tcpdump" command [rhel-8]
• RHEL-1954 - AVC created when named-chroot is enabled and "virsh domfsinfo" command is used
• RHEL-9947 - Users mapped to sysadm_u cannot execute `sudo traceroute` command
• RHEL-19426 - [8.10] avc denied when starting opa-fm service
• RHEL-21374 - AVC appears when mdadm checks the /dev/stratis location [rhel-8]
• RHEL-22276 - AVC "sys_admin" on conntrackd when using Kernel space filtering
• RHEL-1388 - Confined user cannot list/edit a crontab through sudo'ing
• RHEL-22748 - SELinux prevents the caddy service from reading the /proc/sys/net/core/somaxconn file
• RHEL-25002 - Cannot execute "tlog-rec" as a confined user [rhel-8]
• RHEL-11249 - libdnf used by Insights client labels temporary files with insights_client_tmp_t leading to denials by systemd and gnupg
• RHEL-2606 - selinux denial on wtmp log file - when user runs sudo su as a confined user
• RHEL-27507 - SELinux prevents the wdmd from reading the /sys/class/watchdog/watchdog0/identity symlink [rhel-8]
• RHEL-1628 - "unconfined_login" boolean doesn't seem to have any effect on users
• RHEL-22843 - SELinux blocks Keepalived scripts from calling systemctl

CVEs

(none)

References

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index