Loading...

XML

Word

Printable

Acceptance Criteria:

Hide

Even if the '/bin/*' line is present in the /etc/selinux/restorecond.conf file, the restorecond service does not mislabel files in the /usr/bin/ directory during its start.

Show
Even if the '/bin/*' line is present in the /etc/selinux/restorecond.conf file, the restorecond service does not mislabel files in the /usr/bin/ directory during its start.
Preliminary Testing:
Pass
Errata Link:
https://errata.devel.redhat.com/advisory/121166
Test Coverage:

Automated

Release Note Type:
Bug Fix
Release Note Text:

Hide
.`/bin = /usr/bin` file context equivalency rule added to SELinux policy

Previously, the SELinux policy did not contain the `/bin = /usr/bin` file context equivalency rule. As a consequence, the `restorecond` daemon did not work correctly. This update adds the missing rule to the policy, and as a consequence, `restorecond` works correctly in SELinux enforcing mode.

IMPORTANT:: This change overrides any local policy modules which use file context specification for a pattern in `/bin`.

Show
.`/bin = /usr/bin` file context equivalency rule added to SELinux policy Previously, the SELinux policy did not contain the `/bin = /usr/bin` file context equivalency rule. As a consequence, the `restorecond` daemon did not work correctly. This update adds the missing rule to the policy, and as a consequence, `restorecond` works correctly in SELinux enforcing mode. IMPORTANT:: This change overrides any local policy modules which use file context specification for a pattern in `/bin`.
Release Note Status:
Done

Install policycoreutils-restorecond package
Change its config file in /etc/selinux/restorecond.conf and add "/usr/*" line there
Restart the restorecond service

/usr/bin/dbus* files retain correct SELinux context

SELinux context for /usr/bin/dbus* is changed to "system_u:object_r:bin_t:s0" which is not correct

is cloned by

RHEL-17892 policycoreutils-restorecond sets incorrect SELinux context for D-Bus daemons

links to

RHBA-2023:121166 selinux-policy bug fix and enhancement update

mentioned on

Commit - Add /bin = /usr/bin file context equivalency