selinux-policy packages that fix numerous bugs are now available.
coolkey library used by some Kerberos implementations caused an SELinux denial when credentials were sent to an NFS server, and during the creation of a cache directory. This package modifies SELinux policy so that the coolkey Kerberos library is excluded from being audited when performing this operation. (BZ#294651)
cupsd caused an SELinux error or denial. SELinux policy has been modified to allow this activity and not to cause a denial when this activity takes place. (BZ#483395)
/root/.ssh directory contained incorrect SELinux permissions if it was deleted and re-created. This permission error caused the ssh-keygen command to fail when creating keys in this directory from an init script, as it was not labelled correctly. SELinux policy has been modified to enable the correct permissions on the /root/.ssh directory if it is removed and re-added. Having the correct permission on this directory results in ssh-keygen now being able to successfully generate keys as expected. (BZ#492519)
service cman start because aisexec could not allocate shared memory. Support has been added in SELinux policy for Cluster Suite, which resolves these issues. (BZ#503141)
coolkey command integrated with samba to join an Active Directory service. SELinux policy has been modified to allow for proper coolkey cache management in the samba policy module. (BZ#507797)
rsync command when it is used via the SSH protocol. (BZ#510748)
sqlplus command caused an SELinux denial. Policy has been modified to label this file correctly to allow for its unexpected behavior. The sqlplus command functions normally after applying this update. (BZ#512375)
sysadm SELinux role can now use the setkey utility from the ipsec-tools package. (BZ#513447)
vbetool the permissions it needs to operate normally. (BZ#515491)
setkey was executed from a network startup script, an SELinux denial was triggered. An interface has been added to enable integration with temporary files when using setkey within the MLS SELinux policy. (BZ#515687)
rsync command has changed. rsync is now protected only when started from inetd or xinetd. Other usages of rsync are considered client-side operations and are not protected any further than that of utilities such as cp or scp. (BZ#516780)
sudo command was not properly launching an intermediary shell to authenticate users with correct sudo role privileges. This fix allows transitions to operate normally and allows users to execute commands as root via sudo, when configured to do so. (BZ#519017)
ipsec connection by using the service network restart command did not succeed. The ipsec connection did not start as it was started from the init_t domain. Policy for setkey has been modified so that it can now read temporary data from init scripts, and ipsec connections now start normally from the init_t domain. (BZ#519363)
mod_fcgid, a CGI plugin for the Apache HTTP server caused SELinux permission errors when used. Policy has been modified to both allow mod_fcgid scripts the required permissions, and to allow CGI applications to use their own mail modules to send mail, instead of calling sendmail. (BZ#519369)
#!/usr/bin/env python have been removed from SELinux policy source code, as using this technique to call python in the top of an executable python file is being discontinued by Red Hat developers. (BZ#521284)
cyrus-imapd is now able to register its SNMP sub-agent by connecting to a socket upon startup. (BZ#523548)
SNMP daemon to listen on TCP or UDP ports for AgentX sub-agents. Policy has been modified so that this daemon can now bind TCP/UDP sockets to AgentX ports. (BZ#523773)
NFS (Network File System) shares. Policy has been modified to properly allow for the normal operation of quotas when using NFS shares. (BZ#525420)
udev daemon to the latest version and restarting it, the SELinux context for udev was changed from the default, causing errors. This update ensures that this context remains correct when restarting udev. (BZ#526640)
qemu-kvm. (BZ#530552)
procmail was causing an AVC denial when attempting to read files used by spamassassin. Rules have been added to policy so that these applications can communicate normally via pipes. (BZ#530750)
aisexec were not properly met. The strict policy can now be installed as expected. (BZ#531196)
e4fsck command was not properly labeled, causing execution to fail. Policy permissions have been fixed so that e4fsck is now correctly labeled. (BZ#532565)
pluto to write logs properly. (BZ#537106)
IPsec, fixing the AVC denials that prevented pluto from running properly. After applying this update, pluto runs as expected. Note that this is necessary for FIPS-140 security compliance. (BZ#537133)
vhostmd is a daemon that provides a communication channel between a host and its hosted virtual machines. Implementing a vhostmd daemon caused AVC denial errors when launching it via service vhostmd start. SELinux policy rules have been added to protect the vhostmd daemon. The daemon starts and operates normally after applying the update. (BZ#543941)
racoon using a UNIX domain stream socket. After applying this update, access functions as expected. (BZ#545369)
iptables can now start properly and has proper permissions to read configuration files. (BZ#546604)
smartd daemon the ability to read from and write to generic SCSI devices. (BZ#547387)
bnx2i interface type. (BZ#548599)
/var/vdsm directory was incorrectly labeled by SELinux, showing two different SELinux contexts. After applying this update, the directory is now correctly labeled with a single label. (BZ#549492)
lpadmin command to set an interface script for a printer, SELinux error messages are triggered. A new type, cupsd_interface_t, has been added to policy to allow cupsd to properly utilize a System V style interface script. (BZ#550015)
postgresql regression tests include libraries that need to be dynamically loaded by the postgresql server. Some of these libraries were incorrectly labeled, which caused the regression tests to fail and SELinux errors to appear. This update applies the correct permissions to the libraries, and the postgresql regression tests now operate as expected. (BZ#551063)
prelink is a utility that can reduce the startup times of applications by linking to libraries and storing the linking in the executable. prelink is now allowed under SELinux policy to load and execute functions from shared libraries, with legacy support included for older libraries. (BZ#551664)
qemu-kvm caused SELinux errors when creating or starting a virtual machine when Transport Layer Security (TLS) is enabled in qemu.conf for an environment using a Public Key Infrastructure (PKI). This error occurred because qemu-kvm did not have sufficient permission to read from a random number generator (/dev/random and /dev/urandom) in order to gather its entropy. Permissions have been modified so that qemu-kvm can now read from these random number generators. (BZ#552763)
postfix_postdrop command was unable to use sockets. This resulted in emails not being sent. After applying this update, postfix is able to read and write sendmail unix_stream_sockets and emails can be sent using sendmail as expected. (BZ#553492)
/etc/xen was incorrectly labeled. This caused errors when using automated scripts for staging Xen guest virtual machines. A fix was applied to correctly label the directory, which resolved the problem. Xen guests are now functioning as expected. (BZ#554777)
service network restart command resulted in an AVC denial caused by dhcpc_t being unable to relabel to and from net_conf_t. This update allows this with the result that restarting networking succeeds without SELinux denials. (BZ#559355)
iscsid daemon, which implements the control path of the iSCSI protocol along with management functions, could not create its log file due to an incorrect SELinux context. (BZ#562303)
named name server daemon, when running in a chrooted environment, was incorrect, and with this update is labeled correctly. (BZ#562833)
service iptables save command triggered an AVC denial. This update changes the default context for the /sbin/iptables-save application to iptabels_exec_t so that the firewall configuration can be saved. (BZ#564376)
cgi-bin directory mounted on an NFS share resulted in an AVC denial, whereas serving static pages from a public_html directory worked as expected. CGI scripts can now be run from NFS-mounted directories given the correct permissions. (BZ#566557)