RHBA-2026:97426 - Bug Fix Advisory

Topic

An update for selinux-policy is now available for Red Hat Enterprise Linux 9.

Description

For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for IBM z Systems 9 s390x
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le
• Red Hat Enterprise Linux for ARM 64 9 aarch64

Fixes

• RHEL-147470 - [rhel-9] SELinux prevents rpm from reading the /root/.rpmmacros file
• RHEL-157952 - [RHEL9] - file /usr/share/selinux/devel/include/distributed is not owned by any package
• RHEL-86925 - selinux blocking systemd-run --pipe from serial console
• RHEL-152287 - [rhel-9] "nft list ruleset" generates AVCs when running as a confined domain ("iptables_t")
• RHEL-155605 - [RFE]: Allow sysadm_t to connect to iscsid_t via unix_stream_socket
• RHEL-169534 - Backport commit "Allow logrotate to stop all systemd services" (3daaed0) to CentOS Stream 9
• RHEL-182787 - [rhel-9] SELinux prevents aide from looking into a DOS filesystem
• RHEL-174888 - SELinux denials appear when bootupd runs lsblk
• RHEL-145322 - AVC showing up when dnf-automatic is configured to send a mail on completion [rhel-9]
• RHEL-219156 - [selinux-policy] bootupd selinux violations lsblk
• RHEL-180764 - rhsmcertd-worker is not able to read the SELinux policy, causing DNF code to use non-standard code paths
• RHEL-182260 - SELinux prevents squid from reading /home -> /var/home symlink in image mode (bootc)
• RHEL-192093 - bind utilities can have extra suffixes in executables and unit files
• RHEL-240445 - SELinux issues with /etc/aliases.lmdb
• RHEL-223973 - [RHEL9.9] namespace_init_t denied execute of getent and cut during pam_namespace polyinstantiation of /tmp
• RHEL-236545 - SELinux denies rhsmcertd_t search on file_context_t (rhsm-package-profile-uploader) on every dnf transaction on centos9-stream
• RHEL-243228 - [rhel9] Update rhsmcertd SELinux policies for the benefit of rhsm-package-profile transient persistence detection
• RHEL-106999 - [rhel-9] SELinux prevents Postfix tlsproxy from accessing TCP sockets (TLS handshake failure)

CVEs

(none)

References

• https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.9_release_notes/index