RHBA-2025:20533 - Bug Fix Advisory

Topic

An update for selinux-policy is now available for Red Hat Enterprise Linux 9.

Description

For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 9 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le
• Red Hat Enterprise Linux for ARM 64 9 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x
• Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64
• Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64
• Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le
• Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x

Fixes

• RHEL-69526 - Confine the tuned-ppd service
• RHEL-79319 - afterburn.service fails in RHEL-9.6 (RHCOS) with SELinux enabled
• RHEL-82308 - [rhel-9] SELinux prevents chronyc from talking to chronyd-restricted via socket
• RHEL-59145 - AVC generated by "systemd-user-runtime-dir stop 0" service when having directories with various contexts
• RHEL-77995 - [rhel-9] the varnish service triggers SELinux denials
• RHEL-83529 - [rhel-9] SELinux denials appear when NetworkManager executes ping
• RHEL-85379 - [rhel-9] 'journalctl -M tux' fails due to AVC denied
• RHEL-47241 - [rhel-9] tlog lock files can't be created by confined SELinux users
• RHEL-77745 - SELinux policy, preventing PAM stack execution when login executes.
• RHEL-86178 - Selinux: NetworkManager is denied to create temporary keyfile
• RHEL-88045 - SELinux prevents haproxy from mmap-ing /dev/shm/haproxy_startup_logs_* files
• RHEL-93741 - [rhel-9] SELinux denies NetworkManager to kill nft/iptables process
• RHEL-94508 - [c9s] bootupctl adopt get selinux denied logs
• RHEL-87744 - [RHEL-9.7] New SELinux domain required for TDX confidential virtualization "qgs" daemon
• RHEL-95689 - selinux reports avc denied during installation of coreos-installer-bootinfra
• RHEL-100718 - power-profiles-daemon selinux denial
• RHEL-95690 - SELinux prevents systemd_timedated_t to start/stop timemaster_unit_file_t
• RHEL-77101 - In RHEL9 SELinux prevents Postfix tlsproxy from accessing TCP sockets (TLS handshake failure)
• RHEL-110650 - Revert selinux-policy rules to back insights-core policy module [rhel-9]

CVEs

(none)

References

• https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.7_release_notes/index