Red Hat ENTERPRISE LINUX 5.5 - S 2010, Manual

Page: 249 / 470

RHBA-2010:0182: bug fix update
239
• A leaked file descriptor in
cupsd
caused an SELinux error or denial. SELinux policy has
been modified to allow this activity and not to cause a denial when this activity takes place.
(
BZ#483395
1907
)
• The
/root/.ssh
directory contained incorrect SELinux permissions if it was deleted and re-
created. This permission error caused the
ssh-keygen
command to fail when creating keys in this
directory from an init script, as it was not labelled correctly. SELinux policy has been modified to
enable the correct permissions on the
/root/.ssh
directory if it is removed and re-added. Having
the correct permission on this directory results in
ssh-keygen
now being able to successfully
generate keys as expected. (
BZ#492519
1908
)
• Hosts with SELinux in enforcing mode were not able to create a cluster with Red Hat Cluster Suite
(RHCS) when running
service cman start
because
aisexec
could not allocate shared
memory. Support has been added in SELinux policy for Cluster Suite, which resolves these issues.
(
BZ#503141
1909
)
• An SELinux denial was triggered when the
coolkey
command integrated with
samba
to join
an Active Directory service. SELinux policy has been modified to allow for proper coolkey cache
management in the samba policy module. (
BZ#507797
1910
)
• SELinux policy has been modified to allow proper operation of the
rsync
command when it is used
via the SSH protocol. (
BZ#510748
1911
)
• A problematic library file for the Oracle
sqlplus
command caused an SELinux denial. Policy has
been modified to label this file correctly to allow for its unexpected behavior. The sqlplus command
functions normally after applying this update. (
BZ#512375
1912
)
• Users operating in the
sysadm
SELinux role can now use the
setkey
utility from the
ipsec-
tools
package. (
BZ#513447
1913
)
• A transition rule has been added to SELinux policy that allows
vbetool
the permissions it needs to
operate normally. (
BZ#515491
1914
)
• When
setkey
was executed from a network startup script, an SELinux denial was triggered. An
interface has been added to enable integration with temporary files when using setkey within the
MLS SELinux policy. (
BZ#515687
1915
)
• The protection offered over the
rsync
command has changed. rsync is now protected only when
started from inetd or xinetd. Other usages of rsync are considered client-side operations and are not
protected any further than that of utilities such as
cp
or
scp
. (
BZ#516780
1916
)
• The
sudo
command was not properly launching an intermediary shell to authenticate users with
correct sudo role privileges. This fix allows transitions to operate normally and allows users to
execute commands as root via sudo, when configured to do so. (
BZ#519017
1917
)
• Launching an
ipsec
connection by using the
service network restart
command did not
succeed. The ipsec connection did not start as it was started from the init_t domain. Policy for
setkey
has been modified so that it can now read temporary data from init scripts, and ipsec
connections now start normally from the init_t domain. (
BZ#519363
1918
)
• Scripts for
mod_fcgid
, a CGI plugin for the Apache HTTP server caused SELinux permission
errors when used. Policy has been modified to both allow mod_fcgid scripts the required
permissions, and to allow CGI applications to use their own mail modules to send mail, instead of
calling
sendmail
. (
BZ#519369
1919
)