ELBA-2017-1727

ELBA-2017-1727 - selinux-policy bug fix update

Type:	BUG
Severity:	NA
Release Date:	2017-07-11

Description

[3.7.19-307.0.1.2]
- Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type.
- Allow ocfs2 to be mounted with file_t type.

[3.7.19-307.2]
- Label /usr/bin/mysqld_safe_helper as mysqld_exec_t instead of bin_t.
Resolves: rhbz#1466327

[3.7.19-307.1]
- Allow smbd_t domain generate debugging files under /var/run/gluster. These files are created through the libgfapi.so library that provides integration of a GlusterFS client in the Samba (vfs_glusterfs) process.
Resolves: rhbz#1462824
- Disable mysqld_safe_t secure mode environment cleansing.
Resolves: rhbz#1464145

[3.7.19-307]
- Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t
Resolves: rhbz#1404152
- Label /usr/bin/puppet* binaries as puppet_exec_t
Resolves: rhbz#1386181

[3.7.19-306]
- Allow hostname_t domain to manage cluster_tmp_t files
Resolves: rhbz#1400234
- Allow ipsec_mgmt_t domain use nsswitch
Resolves:rhbz#1401611
- Allow conman_t domain to list conman_uconfined_script_exec_t dirs.
Resolves:rhbz#1397117

[3.7.19-305]
- Fix typo bug sepgsql_contexts file
Resolves: rhbz#1397703
- Allow sssd_t domain to manage samba files and dirs.
Resolves: rhbz#1395403
- Create conman_unconfined_script_t type for conman script stored in /use/share/conman/exec/
Resolves: rhbz#1397117
- Allow consolekit_t domain to manage consolekit_log_t dirs
Resolves: rhbz#1397802

[3.7.19-304]
- Allow _java_t domain to read systemd state.
Resolves:rhbz#1393938
- Allow kdumpgui to read/write to nvme filesystem.
Resolves:rhbz#1323293

[3.7.19-303]
- Dontaudit freeipmi_bmc_watchdog_t to write to /var/lock/kdump/
Resolves: rhbz#1288565
- Allow guest-set-user-passwd to set users password
Resolves: rhbz#1369699

[3.7.19-302]
- Label /var/lock/kdump as kdump_lock_t.
- Dontaudit freeipmi_bmc_watchdog_t to write to /var/lock/kdump/
Resolves: rhbz#1288565

[3.7.19-301]
- Allow hald_t to read nvme devices.
Resolves: rhbz#1389982
- Allow ftpdctl_t domain to manage own sockets
Resolves: rhbz#1392525

[3.7.19-300]
- Allow sblim_reposd_t domain to read cert_f files
Resolves:rhbz#1392382
- Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs.
Resolves: rhbz#1392406

[3.7.19-299]
- Support for InnoDB Tablespace Encryption.
Resolves: rhbz#1391525

[3.7.19-298]
- Allow isnsd_t to accept tcp connections
Resolves:rhbz#1365501
- Add label for alsa_var_lib_t dirs and files.
Resolves: rhbz#1340150

[3.7.19-297]
- Remove setgid and setuid capabilities from userdom_login_user_template
Resolves: rhbz#1378463
- Allow logrotate to read chronyd keys
Resolves: rhbz#1390657
- Allow fail2ban to domtrans to shorewall.
Resolves: rhbz#1390810

[3.7.19-296]
- Allow hypervvssd_t to read all dirs.
Resolves: rhbz#1335733
- Dontaudit abrt_t writing to cert_t files.
Resolves: rhbz#1334606
- Allow isns_t domain to connect on port 51954 labeled as isns_port_t.
Resolves: rhbz#1365501
- Fixed vsftpd can access nfs even if allow_ftpd_use_nfs is off under specific conditions
Resolves: rhbz#1310077
- Allow asterisk domain to connect on port 5222 labeled as jabber_client_port_t
Resolves:rhbz#1334756
- Label /etc/puppetlabs as puppet_etc_t.
Resolves:rhbz#1386181
- Allow mount to read nvme devices
Resolves: rhbz#1389982
- Allow roundup to use nsswitch.
Resolves: rhbz#1286994
- Backport domain transition from pegasus_t to rpm_t
- Allow pegasus to read all sysctls
- Allow pegasus to read raw memory.
Resolves:rhbz#980439

[3.7.19-295]
- Allow ipc_lock capability for glusterd.
Resolves: #1384487

[3.7.19-294]
- Added boolean: authlogin_yubikey
Resolves:rhbz#1362033
- Add new type: alsa_lock_t, Allow alsa_t domain creating files in /var/lock labeled as alsa_lock_t.
Resolves:rhbz#1340150
- Allow bacula send signull itself.
Resolves: rhbz#1313382
- label /var/lib/pcsd/ as cluster_var_lib_t.
Resolves:rhbz#1326718
- Allow httpd also write to anon_inodefs files
Resolves: rhbz#1377644
- Allow lsmd to read localization. Allow lsmd plugins to exec ldconfig
Resolves: rhbz#1336590
- Allow auditctl_t domain read localization.
Resolves:rhbz#1316444
- Allow cobblerd_t to delete dirs labeled as tftpdir_rw_t. Resolves: rhbz#1318166
- Allow httpd_t domain to list inotify filesystem
Resolves:rhbz#1299552
- Allow dovecot_t send signull to dovecot_deliver_t
Resolves:rhbz#1320037
- Fix couple AVC to start roundup properly
Resolves: rhbz#1286994
- Allow netlabel_peer_t type to flow over netif_t and node_t, and only be hindered by MLS, need back port to RHEL6
Resolves:rhbz#1299306
- Add sys_ptrace capability to pegasus domain
Resolves:rhbz#980439
- Allow sshd to set mcs process categories.
Resolves: rhbz#1322409
- Add setgid capability to winbind domain. Allow getcap for winbind domain.
Resolves: rhbz#1336394
- Allow rebuild mdadm arraiy with SELinux enabled in enforcing mode.
Resolves: rhbz#1343754
- Allow kpropd_t domain to use nsswitch.
Resolves: rhbz#1337895

[3.7.19-293]
- Add setgid capability to winbind domain.
- Allow getcap for winbind domain.
Resolves: rhbz#1336394
- Allow rebuild mdadm arraiy with SELinux enabled in enforcing mode.
Resolves: rhbz#1343754
- Allow kpropd_t domain to use nsswitch.
Resolves: rhbz#1337895
- Allow glusterd to manage socket files labeled as glusterd_brick_t.
Resolves: rhbz#1331585

Updated Packages

Release/Architecture

Filename

MD5sum

Superseded By Advisory

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team