Hi, installing Fedora in containers fails strangely (see below). It seems to be selinux related, since booting with selinux=0 allows the installation to continue. Strangely, just 'setenforce 0' does not work by itself. I feel like I'm missing something obvious here. The host is rawhide with selinux-policy-3.13.1-54.fc21.noarch. # yum -y --releasever=20 --nogpg --installroot=$c --disablerepo='*' --enablerepo=fedora install systemd passwd yum fedora-release vim-minimal sudo .. Running transaction check Running transaction test Transaction test succeeded Running transaction Installing : libgcc-4.9.0-5.fc21.x86_64 1/25 Installing : fedora-release-rawhide-21-0.6.noarch 2/25 Installing : fedora-release-21-0.6.noarch 3/25 Installing : setup-2.9.0-1.fc21.noarch 4/25 Installing : filesystem-3.2-24.fc21.x86_64 5/25 Installing : basesystem-10.0-9.fc20.noarch 6/25 Installing : ncurses-base-5.9-13.20140323.fc21.noarch 7/25 Installing : tzdata-2014c-1.fc21.noarch 8/25 Installing : nss-softokn-freebl-3.16.1-2.fc21.x86_64 9/25 Installing : glibc-common-2.19.90-18.fc21.x86_64 10/25 Installing : glibc-2.19.90-18.fc21.x86_64 11/25 warning: %post(glibc-2.19.90-18.fc21.x86_64) scriptlet failed, exit status 127 Non-fatal POSTIN scriptlet failure in rpm package glibc-2.19.90-18.fc21.x86_64 Installing : libstdc++-4.9.0-5.fc21.x86_64 12/25 warning: %post(libstdc++-4.9.0-5.fc21.x86_64) scriptlet failed, exit status 127 Non-fatal POSTIN scriptlet failure in rpm package libstdc++-4.9.0-5.fc21.x86_64 Installing : ncurses-libs-5.9-13.20140323.fc21.x86_64 13/25 warning: %post(ncurses-libs-5.9-13.20140323.fc21.x86_64) scriptlet failed, exit status 127 Non-fatal POSTIN scriptlet failure in rpm package ncurses-libs-5.9-13.20140323.fc21.x86_64 Installing : bash-4.3.18-1.fc21.x86_64 14/25 Installing : libsepol-2.3-1.fc21.x86_64 15/25 warning: %post(libsepol-2.3-1.fc21.x86_64) scriptlet failed, exit status 127 Non-fatal POSTIN scriptlet failure in rpm package libsepol-2.3-1.fc21.x86_64 .. error: %pre(ca-certificates-2013.1.94-18.fc20.noarch) scriptlet failed, exit status 127 Error in PREIN scriptlet in rpm package ca-certificates-2013.1.94-18.fc20.noarch... When I boot the host with selinux=0, things seems to work fine. Nothing useful in the logs as far as I can see. When I chroot into the container seems to work. Zbyszek

On Wed, May 28, 2014 at 10:41:45AM -0400, Daniel J Walsh wrote: > Yum -y update your entire computer and yum reinstall > selinux-policy-targeted Should fix the problem. Nope. No effect afaict. Any pointers how to debug this?

On 05/28/2014 01:40 PM, Richard W.M. Jones wrote: > On Wed, May 28, 2014 at 06:32:04PM +0200, Zbigniew Jędrzejewski-Szmek wrote: >> On Wed, May 28, 2014 at 10:41:45AM -0400, Daniel J Walsh wrote: >>> Yum -y update your entire computer and yum reinstall >>> selinux-policy-targeted Should fix the problem. >> Nope. No effect afaict. Any pointers how to debug this? > Does it list any AVCs if you run this command shortly after the > failure?

> # ausearch -ts recent -m avc

rpm -q selinux-policy-targeted

This looks like the old bug we had with a bad selinux policy update.