F20 selinux issue breaks updates

[Kobuck]

Follow these instructions:

https://fedoraproject.org/wiki/Commo...during_updates

Post full console output if you run into any problems.

I do daily updates with cli yum. eg. " yum update"

Both you and Leigh say the dependency of selinux-policy-targeted on selinux-policy will ensure proper behaviour. In my case it did not.

In my case I pulled in the selinux-policy 3.12.1.-116.fc20 packages on one day, then when
selinux-policy 3.12.1-117.fc20 came along, it was pulled in with a normal update.

It was at that point I noticed the problem. Using my netbook which hadn't been updated yet I have duplicated the sequence of events.

Before the ----117 update:

# yum list selinux-policy*
.
.
Installed Packages
selinux-policy.noarch                      3.12.1-116.fc20              @updates
selinux-policy-targeted.noarch             3.12.1-116.fc20              @updates
Available Packages
selinux-policy.noarch                      3.12.1-117.fc20              updates 
selinux-policy-devel.noarch                3.12.1-117.fc20              updates 
selinux-policy-doc.noarch                  3.12.1-117.fc20              updates 
selinux-policy-minimum.noarch              3.12.1-117.fc20              updates 
selinux-policy-mls.noarch                  3.12.1-117.fc20              updates 
selinux-policy-sandbox.noarch              3.12.1-117.fc20              updates 
selinux-policy-targeted.noarch             3.12.1-117.fc20              updates

after a normal yum update in which numerous script errors occur:

[CODE]# yum list selinux-policy*
.
.
Installed Packages
selinux-policy.noarch 3.12.1-117.fc20 @updates
selinux-policy-targeted.noarch 3.12.1-116.fc20 @updates
Available Packages
selinux-policy-devel.noarch 3.12.1-117.fc20 updates
selinux-policy-doc.noarch 3.12.1-117.fc20 updates
selinux-policy-minimum.noarch 3.12.1-117.fc20 updates
selinux-policy-mls.noarch 3.12.1-117.fc20 updates
selinux-policy-sandbox.noarch 3.12.1-117.fc20 updates
selinux-policy-targeted.noarch 3.12.1-117.fc20 updates /CODE]

I think this is the condition most users are discovering a problem. ( like I did )

Running your recommended solve:

# setenforce 0
# yum clean expire-cache
Loaded plugins: langpacks
Cleaning repos: fedora updates
2 metadata files removed
# yum update selinux-policy
Loaded plugins: langpacks
fedora/20/i386/metalink                                  |  17 kB     00:00     
updates/20/i386/metalink                                 |  16 kB     00:00     
No packages marked for update

I most respectfully submit that something like:

# setenforce 0
# yum update selinux-policy-targeted
# setenforce 1

This has corrected the problem on both of my machines experiencing the bug.

[mschwendt]

Revised reply:

Both you and Leigh say the dependency of selinux-policy-targeted on selinux-policy will ensure proper behaviour.

That's a misunderstanding. "Proper behaviour" cannot be guaranteed due to the case of the bad selinux policy that prevents updates from installing properly and causing duplicates to be left behind.

What I meant only applies to the work-around after running "setenforcing 0". The package dependency is strict enough to pull in the -targeted subpackage of selinux-policy when running "yum update selinux-policy" and not specifying the -targeted subpackage or selinux-policy\*

Your case is a slightly different one. That's because meanwhile the selinux-policy update has entered the normal stable updates repo and is offered to anyone not enabling permissive mode.

You've tried to update from the bad -116.fc20 to -117.fc20 (the fix) already, which failed partially because you've not done it in selinux permissive mode. I agree that other users will run into the same problem, especially if they don't read about the fix announcement early enough.

The output for the reproducer is at the bottom of this post. As you can see, the installation ends up with a partially failed install of selinux-policy-targeted, which needs to be corrected with another "yum update selinux-policy-targeted" (as you write) or the early "yum update selinux-policy\*":

  setenforce 0
  yum clean expire-cache
  yum update selinux-policy\*
  setenforce 1

The reproducer output:

# yum update
Loaded plugins: auto-update-debuginfo, langpacks, refresh-packagekit
Resolving Dependencies
--> Running transaction check
---> Package selinux-policy.noarch 0:3.12.1-116.fc20 will be updated
---> Package selinux-policy.noarch 0:3.12.1-117.fc20 will be an update
---> Package selinux-policy-targeted.noarch 0:3.12.1-116.fc20 will be updated
---> Package selinux-policy-targeted.noarch 0:3.12.1-117.fc20 will be an update
--> Finished Dependency Resolution

Dependencies Resolved

================================================== ==============================
Package Arch Version Repository Size
================================================== ==============================
Updating:
selinux-policy noarch 3.12.1-117.fc20 updates 316 k
selinux-policy-targeted noarch 3.12.1-117.fc20 updates 3.6 M

Transaction Summary
================================================== ==============================
Upgrade 2 Packages

Total download size: 3.9 M
Is this ok [y/d/N]: y
Downloading packages:
updates/20/x86_64/prestodelta | 1.3 MB 00:02
(1/2): selinux-policy-3.12.1-117.fc20.noarch.rpm | 316 kB 00:04
(2/2): selinux-policy-targeted-3.12.1-117.fc20.noarch.rpm | 3.6 MB 00:04
--------------------------------------------------------------------------------
Total 868 kB/s | 3.9 MB 00:04
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Warning: RPMDB altered outside of yum.
Updating : selinux-policy-3.12.1-117.fc20.noarch 1/4
warning: %post(selinux-policy-3.12.1-117.fc20.noarch) scriptlet failed, exit status 127
Non-fatal POSTIN scriptlet failure in rpm package selinux-policy-3.12.1-117.fc20.noarch
warning: %triggerin(selinux-policy-3.12.1-117.fc20.noarch) scriptlet failed, exit status 127
Non-fatal <unknown> scriptlet failure in rpm package selinux-policy-3.12.1-117.fc20.noarch
error: %pre(selinux-policy-targeted-3.12.1-117.fc20.noarch) scriptlet failed, exit status 127
Error in PREIN scriptlet in rpm package selinux-policy-targeted-3.12.1-117.fc20.noarch
Cleanup : selinux-policy-3.12.1-116.fc20.noarch 3/4
error: selinux-policy-targeted-3.12.1-117.fc20.noarch: install failed
error: selinux-policy-targeted-3.12.1-116.fc20.noarch: erase skipped
warning: %postun(selinux-policy-3.12.1-116.fc20.noarch) scriptlet failed, exit status 127
Non-fatal POSTUN scriptlet failure in rpm package selinux-policy-3.12.1-116.fc20.noarch
Verifying : selinux-policy-3.12.1-117.fc20.noarch 1/4
selinux-policy-targeted-3.12.1-116.fc20.noarch was supposed to be removed but is not!
Verifying : selinux-policy-targeted-3.12.1-116.fc20.noarch 2/4
Verifying : selinux-policy-3.12.1-116.fc20.noarch 3/4
Verifying : selinux-policy-targeted-3.12.1-117.fc20.noarch 4/4

Updated:
selinux-policy.noarch 0:3.12.1-117.fc20

Failed:
selinux-policy-targeted.noarch 0:3.12.1-116.fc20
selinux-policy-targeted.noarch 0:3.12.1-117.fc20

Complete!

# rpm -qa selinux-policy\*
selinux-policy-targeted-3.12.1-116.fc20.noarch
selinux-policy-3.12.1-117.fc20.noarch

# yum update selinux-policy
Loaded plugins: auto-update-debuginfo, langpacks, refresh-packagekit
No packages marked for update

# yum update selinux-policy\*
Loaded plugins: auto-update-debuginfo, langpacks, refresh-packagekit
Resolving Dependencies
--> Running transaction check
---> Package selinux-policy-targeted.noarch 0:3.12.1-116.fc20 will be updated
---> Package selinux-policy-targeted.noarch 0:3.12.1-117.fc20 will be an update
--> Finished Dependency Resolution

Dependencies Resolved

================================================== ==============================
Package Arch Version Repository Size
================================================== ==============================
Updating:
selinux-policy-targeted noarch 3.12.1-117.fc20 updates 3.6 M

Transaction Summary
================================================== ==============================
Upgrade 1 Package

Total size: 3.6 M
Is this ok [y/d/N]: y
Downloading packages:
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Updating : selinux-policy-targeted-3.12.1-117.fc20.noarch 1/2
Cleanup : selinux-policy-targeted-3.12.1-116.fc20.noarch 2/2
Verifying : selinux-policy-targeted-3.12.1-117.fc20.noarch 1/2
Verifying : selinux-policy-targeted-3.12.1-116.fc20.noarch 2/2

Updated:
selinux-policy-targeted.noarch 0:3.12.1-117.fc20

Complete!

[Kobuck]

Thanks for your patient response.

So if both selinux-policy and selinux-policy-targeted are at ...-117.f20 are we back under control??

[alphacrucis]

I noticed after follwing Leigh's instructions, I couldn't unlock the screen saver lock when it came on while I was away from the PC. Seems to be ok now after a reboot.

[R3v0lut10nary]

People still use that garbage?

[ILMostro]

Added as a Forum-Wide Announcement.

Good call, Bob; and thanks leigh, as always!

Sent from my Nexus 7

[clariceoshea]

# setenforce 0
# yum clean expire-cache
# yum update selinux-policy\*
# setenforce 1

worked and now I have a clean update thanks