RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Description of problem:
I already made for tpm2-abrmd-selinux upstream policy some improvements related of tpm2-abrmd usage with keylime. [1] Keylime should communicate with tpm2-tabrmd and need allowing rules for proper working.  I've added PR to tpm2-tabrmd for SELinux policy, which should allow proper run of keylime with tpm2-abrmd. This PR is already merged in upstream policy, but it should be good to add it into official distributed policy. In keylime we have now workaround solution, but for more secure policy where will be granted only needed permission should be used interfaces which were already add in tpm2-abrmd upstream. [2] [3] 
Also could be good to add it also to RHEL-9.1, where is also keylime released.

Version-Release number of selected component (if applicable):
tpm2-abrmd-selinux-2.3.1-6.el9.noarch


Actual results:
In tpm2-tabrmd selinux policy now missing upstream change which allow tpm2-abrmd work with keylime.


Expected results:
Missing rules will be added to distributed tpm2-abrmd-selinux package.


[1] https://github.com/tpm2-software/tpm2-abrmd/commit/2075b8519d2e6f57807ce4df8177b31520de8f90

[2] https://github.com/RedHat-SP-Security/keylime-selinux/blob/3c23ccc63959cf60384e6b4c33b43e3335d0f4dd/keylime.te#L100

[3] https://github.com/RedHat-SP-Security/keylime-selinux/blob/3c23ccc63959cf60384e6b4c33b43e3335d0f4dd/keylime.te#L127

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (tpm2-abrmd-selinux bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:2362