3:05 a.m.
Hi,
https://access.redhat.com/errata/RHSA-2021:5082 was published this
morning for RHEL 8.5.z as a security update to fix a number of issues in
Samba.
PLEASE DO NOT UPGRADE RHEL IdM SERVERS YET!
This erratum will need to be installed together with a related erratum
for RHEL IdM which is not out yet (ongoing final tests). There is an ABI
change and also smb.conf configuration change that will not be accepted
by the old RHEL IdM, leading to a failure to recover from the upgrade.
The new RHEL IdM erratum is coming out either today or in couple days.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
2:36 a.m.
New subject: [WARN] Please refrain from installing RhSA-2021:5082 yet
On ma, 13 joulu 2021, Alexander Bokovoy via FreeIPA-users wrote:
Hi,
https://access.redhat.com/errata/RHSA-2021:5082 was published this
morning for RHEL 8.5.z as a security update to fix a number of issues in
Samba.
PLEASE DO NOT UPGRADE RHEL IdM SERVERS YET!
This erratum will need to be installed together with a related erratum
for RHEL IdM which is not out yet (ongoing final tests). There is an ABI
change and also smb.conf configuration change that will not be accepted
by the old RHEL IdM, leading to a failure to recover from the upgrade.
The new RHEL IdM erratum is coming out either today or in couple days.
RHSA-2021:5142 adds RHEL IdM fix that should work together with Samba
changes introduced in RHSA-2021:5082.
https://access.redhat.com/errata/RHSA-2021:5142
Both samba and RHEL IdM packages in RHEL 8.5 can now be upgraded.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
12:07 p.m.
New subject: [WARN] Please refrain from installing RhSA-2021:5082 yet
On ma, 13 joulu 2021, Alexander Bokovoy via FreeIPA-users wrote:
RHSA-2021:5142 adds RHEL IdM fix that should work together with Samba
changes introduced in RHSA-2021:5082.
https://access.redhat.com/errata/RHSA-2021:5142
Both samba and RHEL IdM packages in RHEL 8.5 can now be upgraded.
I'm unable to install the new update:
# dnf install ipa-selinux
Updating Subscription Management repositories.
Last metadata expiration check: 2:11:29 ago on Wed 15 Dec 2021 15:49:46 UTC.
Package ipa-selinux-4.9.6-6.module+el8.5.0+12660+88e16a2c.noarch is already installed.
Error:
Problem: cannot install the best candidate for the job
- nothing provides selinux-policy >= 3.14.3-80.el8_5.1 needed by
ipa-selinux-4.9.6-10.module+el8.5.0+13587+92118e57.noarch
- nothing provides selinux-policy-base >= 3.14.3-80.el8_5.1 needed by
ipa-selinux-4.9.6-10.module+el8.5.0+13587+92118e57.noarch
(try to add '--skip-broken' to skip uninstallable packages or '--nobest'
to use not only best candidate packages)
The latest available selinux-policy & selinux-policy-base is 3.14.3-80.el8. I guess I
just need to wait for updated packages to appear?
Thanks :)
--
Sam Morris <https://robots.org.uk/>
PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9
12:13 p.m.
New subject: [WARN] Please refrain from installing RhSA-2021:5082 yet
On ke, 15 joulu 2021, Sam Morris via FreeIPA-users wrote:
> On ma, 13 joulu 2021, Alexander Bokovoy via FreeIPA-users wrote:
>
> RHSA-2021:5142 adds RHEL IdM fix that should work together with Samba
> changes introduced in RHSA-2021:5082.
>
> https://access.redhat.com/errata/RHSA-2021:5142
>
> Both samba and RHEL IdM packages in RHEL 8.5 can now be upgraded.
I'm unable to install the new update:
# dnf install ipa-selinux
Updating Subscription Management repositories.
Last metadata expiration check: 2:11:29 ago on Wed 15 Dec 2021 15:49:46 UTC.
Package ipa-selinux-4.9.6-6.module+el8.5.0+12660+88e16a2c.noarch is already installed.
Error:
Problem: cannot install the best candidate for the job
- nothing provides selinux-policy >= 3.14.3-80.el8_5.1 needed by
ipa-selinux-4.9.6-10.module+el8.5.0+13587+92118e57.noarch
- nothing provides selinux-policy-base >= 3.14.3-80.el8_5.1 needed by
ipa-selinux-4.9.6-10.module+el8.5.0+13587+92118e57.noarch
(try to add '--skip-broken' to skip uninstallable packages or '--nobest'
to use not only best candidate packages)
The latest available selinux-policy & selinux-policy-base is 3.14.3-80.el8. I guess I
just need to wait for updated packages to appear?
Thanks, I'll discuss this with SELinux policy team tomorrow.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
2:40 a.m.
New subject: [WARN] Please refrain from installing RhSA-2021:5082 yet
On ke, 15 joulu 2021, Alexander Bokovoy via FreeIPA-users wrote:
On ke, 15 joulu 2021, Sam Morris via FreeIPA-users wrote:
>>On ma, 13 joulu 2021, Alexander Bokovoy via FreeIPA-users wrote:
>>
>>RHSA-2021:5142 adds RHEL IdM fix that should work together with Samba
>>changes introduced in RHSA-2021:5082.
>>
>>https://access.redhat.com/errata/RHSA-2021:5142
>>
>>Both samba and RHEL IdM packages in RHEL 8.5 can now be upgraded.
>
>I'm unable to install the new update:
>
># dnf install ipa-selinux
>Updating Subscription Management repositories.
>Last metadata expiration check: 2:11:29 ago on Wed 15 Dec 2021 15:49:46 UTC.
>Package ipa-selinux-4.9.6-6.module+el8.5.0+12660+88e16a2c.noarch is already
installed.
>Error:
>Problem: cannot install the best candidate for the job
> - nothing provides selinux-policy >= 3.14.3-80.el8_5.1 needed by
ipa-selinux-4.9.6-10.module+el8.5.0+13587+92118e57.noarch
> - nothing provides selinux-policy-base >= 3.14.3-80.el8_5.1 needed by
ipa-selinux-4.9.6-10.module+el8.5.0+13587+92118e57.noarch
>(try to add '--skip-broken' to skip uninstallable packages or
'--nobest' to use not only best candidate packages)
>
>The latest available selinux-policy & selinux-policy-base is 3.14.3-80.el8. I
guess I just need to wait for updated packages to appear?
Thanks, I'll discuss this with SELinux policy team tomorrow.
As a workaround, you can skip upgrading ipa-selinux package if that is
possible (it seemed to work in my tests). 'dnf upgrade' should make it
possible to skip that.
Meanwhile, we are looking at doing selinux-policy updates soon.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
4:48 a.m.
New subject: [WARN] Please refrain from installing RhSA-2021:5082 yet
On Thu, 2021-12-16 at 10:40 +0200, Alexander Bokovoy wrote:
As a workaround, you can skip upgrading ipa-selinux package if that is
possible (it seemed to work in my tests). 'dnf upgrade' should make it
possible to skip that.
Thanks. For me a 'dnf upgrade --nobest' did the trick.
--
Sam Morris <https://robots.org.uk/>
PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9
10:53 a.m.
New subject: [WARN] Please refrain from installing RhSA-2021:5082 yet
On to, 16 joulu 2021, Sam Morris wrote:
On Thu, 2021-12-16 at 10:40 +0200, Alexander Bokovoy wrote:
>
> As a workaround, you can skip upgrading ipa-selinux package if that is
> possible (it seemed to work in my tests). 'dnf upgrade' should make it
> possible to skip that.
Thanks. For me a 'dnf upgrade --nobest' did the trick.
As of now, selinux-policy update is out and should not prevent upgrade
in RHEL 8.5.z anymore.
Also, RHEL 7.9.z was updated with fixed samba and ipa packages.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
855
days inactive
858
days old
freeipa-users@lists.fedorahosted.org
6 comments
2 participants
participants (2)
-
Alexander Bokovoy -
Sam Morris