On Wed, Sep 20, 2023 at 8:25 AM Michael D. Setzer II via users <users(a)lists.fedoraproject.org&gt; wrote: In running dnf update on 5 machines noticed a fail message on 3 or 5? To double check ran dnf reinstall selinux* and get this on failing systems? Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Running scriptlet: selinux-policy-minimum-38.28-1.fc38.noarch 1/1 Running scriptlet: selinux-policy-targeted-38.28-1.fc38.noarch 1/1 Preparing : 1/1 Reinstalling : selinux-policy-38.28-1.fc38.noarch 1/8 Running scriptlet : selinux-policy-38.28-1.fc38.noarch 1/8 Running scriptlet : selinux-policy-minimum-38.28-1.fc38.noarch 2/8 Reinstalling : selinux-policy-minimum-38.28-1.fc38.noarch 2/8 Running scriptlet : selinux-policy-minimum-38.28-1.fc38.noarch 2/8 Running scriptlet : selinux-policy-targeted-38.28-1.fc38.noarch 3/8 Reinstalling : selinux-policy-targeted-38.28-1.fc38.noarch 3/8 Running scriptlet : selinux-policy-targeted-38.28-1.fc38.noarch 3/8 Failed to resolve allow statement at /var/lib/selinux/targeted/tmp/modules/200/container/cil:1186 Failed to resolve AST /usr/sbin/semodule: Failed! Reinstalling : selinux-policy-devel-38.28-1.fc38.noarch 4/8 Running scriptlet : selinux-policy-devel-38.28-1.fc38.noarch 4/8 Cleanup : selinux-policy-devel-38.28-1.fc38.noarch 5/8 Running scriptlet : selinux-policy-38.28-1.fc38.noarch 6/8 Cleanup : selinux-policy-38.28-1.fc38.noarch 6/8 Running scriptlet : selinux-policy-38.28-1.fc38.noarch 6/8 Cleanup : selinux-policy-minimum-38.28-1.fc38.noarch 7/8 Running scriptlet : selinux-policy-minimum-38.28-1.fc38.noarch 7/8 Cleanup : selinux-policy-targeted-38.28-1.fc38.noarch 8/8 Running scriptlet : selinux-policy-targeted-38.28-1.fc38.noarch 8/8 Running scriptlet : selinux-policy-minimum-38.28-1.fc38.noarch 8/8 Running scriptlet : selinux-policy-targeted-38.28-1.fc38.noarch 8/8 Verifying : selinux-policy-38.28-1.fc38.noarch 1/8 Verifying : selinux-policy-38.28-1.fc38.noarch 2/8 Verifying : selinux-policy-devel-38.28-1.fc38.noarch 3/8 Verifying : selinux-policy-devel-38.28-1.fc38.noarch 4/8 Verifying : selinux-policy-minimum-38.28-1.fc38.noarch 5/8 Verifying : selinux-policy-minimum-38.28-1.fc38.noarch 6/8 Verifying : selinux-policy-targeted-38.28-1.fc38.noarch 7/8 Verifying : selinux-policy-targeted-38.28-1.fc38.noarch 8/8 Reinstalled: selinux-policy-38.28-1.fc38.noarch selinux-policy-devel-38.28-1.fc38.noarch selinux-policy-minimum-38.28-1.fc38.noarch selinux-policy-targeted-38.28-1.fc38.noarch Complete! Other day get a message about about regex version not matching, and was told to reintall container-selinux. That doesn't seem to fix issue. Did find changing to minimum option gets rid of the regex message? But why 2 of the machines seem to have no problem, but other 3 get same message? Michael, The update restults may depend on other components or if some customizations are in place. What version is container-selinux? rpm -qa "selinux-policy*" "*-selinux"

I cannot reproduce your problem using any updating path with the latest package versions. _______________________________________________ users mailing list -- users(a)lists.fedoraproject.org To unsubscribe send an email to users-leave(a)lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.or g Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue -- Zdenek Pytela Security SELinux team

From: &#160; &#160;Zdenek Pytela &lt;<a href="mailto:zpytela@redhat.com" target=&quot;_blank&quot;&gt;zpytela(a)redhat.com&lt;/a&gt;&amp;gt;&lt;br&gt; Subject: &#160; &#160; &#160; &#160; Re: Noticed Failed message with selinux-policy-targeted on 3 of 5 machines??<br> To: &#160; &#160; &#160;<a href="mailto:mikes@guam.net" target=&quot;_blank&quot;&gt;mikes(a)guam.net&lt;/a&gt;,&lt;br&gt; On Thu, Sep 21, 2023 at 12:28 AM Michael D. Setzer II <mikes(a)guam.net&gt; wrote: On 20 Sep 2023 at 19:57, Zdenek Pytela wrote: From: Zdenek Pytela <zpytela(a)redhat.com&gt; Date sent: Wed, 20 Sep 2023 19:57:31 +0200 Subject: Re: Noticed Failed message with selinux-policy-targeted on 3 of 5 machines?? To: mikes(a)guam.net, Community support for Fedora users <users(a)lists.fedoraproject.org&gt; Send reply to: Community support for Fedora users <users(a)lists.fedoraproject.org&gt; > > > > On Wed, Sep 20, 2023 at 8:25 AM Michael D. Setzer II via users > <users(a)lists.fedoraproject.org&gt; wrote: > In running dnf update on 5 machines noticed a fail message on 3 or 5? > To double check ran dnf reinstall selinux* and get this on failing > systems? > > Running transaction check > Transaction check succeeded. > Running transaction test > Transaction test succeeded. > Running transaction > Running scriptlet: > selinux-policy-minimum-38.28-1.fc38.noarch 1/1 > Running scriptlet: > selinux-policy-targeted-38.28-1.fc38.noarch 1/1 > Preparing : 1/1 > Reinstalling : selinux-policy-38.28-1.fc38.noarch 1/8 > Running scriptlet : selinux-policy-38.28-1.fc38.noarch 1/8 > Running scriptlet : > selinux-policy-minimum-38.28-1.fc38.noarch 2/8 > Reinstalling : > selinux-policy-minimum-38.28-1.fc38.noarch 2/8 > Running scriptlet : > selinux-policy-minimum-38.28-1.fc38.noarch 2/8 > Running scriptlet : > selinux-policy-targeted-38.28-1.fc38.noarch 3/8 > Reinstalling : selinux-policy-targeted-38.28-1.fc38.noarch 3/8 > Running scriptlet : > selinux-policy-targeted-38.28-1.fc38.noarch 3/8 > Failed to resolve allow statement at > /var/lib/selinux/targeted/tmp/modules/200/container/cil:1186 > Failed to resolve AST > /usr/sbin/semodule: Failed! > > Reinstalling : selinux-policy-devel-38.28-1.fc38.noarch 4/8 > Running scriptlet : selinux-policy-devel-38.28-1.fc38.noarch 4/8 > Cleanup : selinux-policy-devel-38.28-1.fc38.noarch 5/8 > Running scriptlet : selinux-policy-38.28-1.fc38.noarch 6/8 > Cleanup : selinux-policy-38.28-1.fc38.noarch 6/8 > Running scriptlet : selinux-policy-38.28-1.fc38.noarch 6/8 > Cleanup : selinux-policy-minimum-38.28-1.fc38.noarch 7/8 > Running scriptlet : > selinux-policy-minimum-38.28-1.fc38.noarch 7/8 > Cleanup : selinux-policy-targeted-38.28-1.fc38.noarch 8/8 > Running scriptlet : > selinux-policy-targeted-38.28-1.fc38.noarch 8/8 > Running scriptlet : > selinux-policy-minimum-38.28-1.fc38.noarch 8/8 > Running scriptlet : > selinux-policy-targeted-38.28-1.fc38.noarch 8/8 > Verifying : selinux-policy-38.28-1.fc38.noarch 1/8 > Verifying : selinux-policy-38.28-1.fc38.noarch 2/8 > Verifying : selinux-policy-devel-38.28-1.fc38.noarch 3/8 > Verifying : selinux-policy-devel-38.28-1.fc38.noarch 4/8 > Verifying : selinux-policy-minimum-38.28-1.fc38.noarch 5/8 > Verifying : selinux-policy-minimum-38.28-1.fc38.noarch 6/8 > Verifying : selinux-policy-targeted-38.28-1.fc38.noarch 7/8 > Verifying : selinux-policy-targeted-38.28-1.fc38.noarch 8/8 > > Reinstalled: > selinux-policy-38.28-1.fc38.noarch > selinux-policy-devel-38.28-1.fc38.noarch > selinux-policy-minimum-38.28-1.fc38.noarch > selinux-policy-targeted-38.28-1.fc38.noarch > > Complete! > > Other day get a message about about regex version not matching, and > was told to > reintall container-selinux. That doesn't seem to fix issue. > Did find changing to minimum option gets rid of the regex message? > But why 2 of the machines seem to have no problem, but other 3 get > same message? > Michael, > > The update restults may depend on other components or if some > customizations are in place. What version is container-selinux? > > rpm -qa "selinux-policy*" "*-selinux" > rpm -qa | grep selinux-policy selinux-policy-38.28-1.fc38.noarch selinux-policy-minimum-38.28-1.fc38.noarch selinux-policy-devel-38.28-1.fc38.noarch selinux-policy-doc-38.28-1.fc38.noarch selinux-policy-targeted-38.28-1.fc38.noarch I wanted to see other packages, too. Maybe also semodule -lfull | grep -v ^100 Noticed one machine that gets failed didn't have selinux-policy-doc installed and installed it, then tried reinstalling all the selinux-policy and still got error? Failed to resolve allow statement at /var/lib/selinux/targeted/tmp/modules/200/container/cil:1186 Failed to resolve AST /usr/sbin/semodule: Failed! Files in that directory are -rw-------. 1 root root 2 Sep 21 08:09 lang_ext -rw-------. 1 root root 24411 Sep 21 08:09 hll -rw-------. 1 root root 13487 Sep 21 08:09 cil The cil file is a binary file, so not sure what :1186 means? that tmp directory doesn't exist on my notebook that doesn't have error? It's a temporary directory used for the policy rebuild. Try this: f39# file /var/lib/selinux/targeted/active/modules/200/container/cil /var/lib/selinux/targeted/active/modules/200/container/cil: bzip2 compressed data, block size = 500k f39# file -z /var/lib/selinux/targeted/active/modules/200/container/cil /var/lib/selinux/targeted/active/modules/200/container/cil: ASCII text, with very long lines (446) (bzip2 compressed data, block size = 500k) f39# bunzip2 </var/lib/selinux/targeted/active/modules/200/container/cil | sed -n '1180,1187p' What's in the output?

set selinux to minimal on machines. Don't understand this.

> I cannot reproduce your problem using any updating path with the latest > package versions. > > _______________________________________________ > users mailing list -- users(a)lists.fedoraproject.org > To unsubscribe send an email to users-leave(a)lists.fedoraproject.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.or > g > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue > > > -- > > Zdenek Pytela > Security SELinux team +------------------------------------------------------------+ Michael D. Setzer II - Computer Science Instructor (Retired) mailto:mikes@guam.net mailto:msetzerii@gmail.com Guam - Where America's Day Begins G4L Disk Imaging Project maintainer http://sourceforge.net/projects/g4l/ +------------------------------------------------------------+ -- Zdenek Pytela Security SELinux team

From: &#160; &#160;Zdenek Pytela &lt;<a href="mailto:zpytela@redhat.com" target=&quot;_blank&quot;&gt;zpytela(a)redhat.com&lt;/a&gt;&amp;gt;&lt;br&gt; Subject: &#160; &#160; &#160; &#160; Re: Noticed Failed message with selinux-policy-targeted on 3 of 5 machines??<br> To: &#160; &#160; &#160;<a href="mailto:mikes@guam.net" target=&quot;_blank&quot;&gt;mikes(a)guam.net&lt;/a&gt;&lt;br&gt; On Thu, Sep 21, 2023 at 7:21 PM Michael D. Setzer II <mikes(a)guam.net&gt; wrote: On 21 Sep 2023 at 16:23, Zdenek Pytela wrote: From: Zdenek Pytela <zpytela(a)redhat.com&gt; Date sent: Thu, 21 Sep 2023 16:23:01 +0200 Subject: Re: Noticed Failed message with selinux-policy-targeted on 3 of 5 machines?? To: mikes(a)guam.net Copies to: Community support for Fedora users <users(a)lists.fedoraproject.org&gt; Send reply to: Community support for Fedora users <users(a)lists.fedoraproject.org&gt; > From: &#160; &#160;Zdenek Pytela &lt;<a href="mailto:zpytela@redhat.com" target=&quot;_blank&quot;&gt;zpytela(a)redhat.com </a>&gt;<br> > Subject: &#160; &#160; &#160; &#160; Re: Noticed Failed message with selinux-policy-targeted on 3 of 5 machines??<br> > To: &#160; &#160; &#160;<a href="mailto:mikes@guam.net" target=&quot;_blank&quot;&gt;mikes(a)guam.net&lt;/a&gt;,&lt;br&gt; > > > > On Thu, Sep 21, 2023 at 12:28 AM Michael D. Setzer II <mikes(a)guam.net&gt; > wrote: > On 20 Sep 2023 at 19:57, Zdenek Pytela wrote: > > From: Zdenek Pytela <zpytela(a)redhat.com&gt; > Date sent: Wed, 20 Sep 2023 19:57:31 +0200 > Subject: Re: Noticed Failed message with selinux-policy-targeted > on 3 of 5 machines?? > To: mikes(a)guam.net, > Community support for Fedora users > <users(a)lists.fedoraproject.org&gt; > Send reply to: Community support for Fedora users > <users(a)lists.fedoraproject.org&gt; > > > > > > > > > On Wed, Sep 20, 2023 at 8:25 AM Michael D. Setzer II via users > > <users(a)lists.fedoraproject.org&gt; wrote: > > In running dnf update on 5 machines noticed a fail message on 3 or > 5? > > To double check ran dnf reinstall selinux* and get this on failing > > systems? > > > > Running transaction check > > Transaction check succeeded. > > Running transaction test > > Transaction test succeeded. > > Running transaction > > Running scriptlet: > > selinux-policy-minimum-38.28-1.fc38.noarch 1/1 > > Running scriptlet: > > selinux-policy-targeted-38.28-1.fc38.noarch 1/1 > > Preparing : 1/1 > > Reinstalling : selinux-policy-38.28-1.fc38.noarch 1/8 > > Running scriptlet : selinux-policy-38.28-1.fc38.noarch 1/8 > > Running scriptlet : > > selinux-policy-minimum-38.28-1.fc38.noarch 2/8 > > Reinstalling : > > selinux-policy-minimum-38.28-1.fc38.noarch 2/8 > > Running scriptlet : > > selinux-policy-minimum-38.28-1.fc38.noarch 2/8 > > Running scriptlet : > > selinux-policy-targeted-38.28-1.fc38.noarch 3/8 > > Reinstalling : selinux-policy-targeted-38.28-1.fc38.noarch 3/8 > > Running scriptlet : > > selinux-policy-targeted-38.28-1.fc38.noarch 3/8 > > Failed to resolve allow statement at > > /var/lib/selinux/targeted/tmp/modules/200/container/cil:1186 > > Failed to resolve AST > > /usr/sbin/semodule: Failed! > > > > Reinstalling : selinux-policy-devel-38.28-1.fc38.noarch 4/8 > > Running scriptlet : selinux-policy-devel-38.28-1.fc38.noarch 4/8 > > Cleanup : selinux-policy-devel-38.28-1.fc38.noarch 5/8 > > Running scriptlet : selinux-policy-38.28-1.fc38.noarch 6/8 > > Cleanup : selinux-policy-38.28-1.fc38.noarch 6/8 > > Running scriptlet : selinux-policy-38.28-1.fc38.noarch 6/8 > > Cleanup : selinux-policy-minimum-38.28-1.fc38.noarch 7/8 > > Running scriptlet : > > selinux-policy-minimum-38.28-1.fc38.noarch 7/8 > > Cleanup : selinux-policy-targeted-38.28-1.fc38.noarch 8/8 > > Running scriptlet : > > selinux-policy-targeted-38.28-1.fc38.noarch 8/8 > > Running scriptlet : > > selinux-policy-minimum-38.28-1.fc38.noarch 8/8 > > Running scriptlet : > > selinux-policy-targeted-38.28-1.fc38.noarch 8/8 > > Verifying : selinux-policy-38.28-1.fc38.noarch 1/8 > > Verifying : selinux-policy-38.28-1.fc38.noarch 2/8 > > Verifying : selinux-policy-devel-38.28-1.fc38.noarch 3/8 > > Verifying : selinux-policy-devel-38.28-1.fc38.noarch 4/8 > > Verifying : selinux-policy-minimum-38.28-1.fc38.noarch 5/8 > > Verifying : selinux-policy-minimum-38.28-1.fc38.noarch 6/8 > > Verifying : selinux-policy-targeted-38.28-1.fc38.noarch 7/8 > > Verifying : selinux-policy-targeted-38.28-1.fc38.noarch 8/8 > > > > Reinstalled: > > selinux-policy-38.28-1.fc38.noarch > > selinux-policy-devel-38.28-1.fc38.noarch > > selinux-policy-minimum-38.28-1.fc38.noarch > > selinux-policy-targeted-38.28-1.fc38.noarch > > > > Complete! > > > > Other day get a message about about regex version not matching, > and > > was told to > > reintall container-selinux. That doesn't seem to fix issue. > > Did find changing to minimum option gets rid of the regex message? > > But why 2 of the machines seem to have no problem, but other 3 get > > same message? > > Michael, > > > > The update restults may depend on other components or if some > > customizations are in place. What version is container-selinux? > > > > rpm -qa "selinux-policy*" "*-selinux" > > > > rpm -qa | grep selinux-policy > selinux-policy-38.28-1.fc38.noarch > selinux-policy-minimum-38.28-1.fc38.noarch > selinux-policy-devel-38.28-1.fc38.noarch > selinux-policy-doc-38.28-1.fc38.noarch > selinux-policy-targeted-38.28-1.fc38.noarch > I wanted to see other packages, too. Maybe also > > semodule -lfull | grep -v ^100 > > > Noticed one machine that gets failed didn't have selinux-policy-doc > installed and installed it, then tried reinstalling all the > selinux-policy and still got error? > Failed to resolve allow statement at > /var/lib/selinux/targeted/tmp/modules/200/container/cil:1186 > Failed to resolve AST > /usr/sbin/semodule: Failed! > Files in that directory are > -rw-------. 1 root root 2 Sep 21 08:09 lang_ext > -rw-------. 1 root root 24411 Sep 21 08:09 hll > -rw-------. 1 root root 13487 Sep 21 08:09 cil > > The cil file is a binary file, so not sure what :1186 means? > that tmp directory doesn't exist on my notebook that doesn't have > error? > It's a temporary directory used for the policy rebuild. Try this: > > f39# file /var/lib/selinux/targeted/active/modules/200/container/cil > /var/lib/selinux/targeted/active/modules/200/container/cil: bzip2 compressed data, block size = > 500k > f39# file -z /var/lib/selinux/targeted/active/modules/200/container/cil > /var/lib/selinux/targeted/active/modules/200/container/cil: ASCII text, with very long lines (446) > (bzip2 compressed data, block size = 500k) > f39# bunzip2 </var/lib/selinux/targeted/active/modules/200/container/cil | sed -n '1180,1187p' > > What's in the output? (allow container_runtime_domain spc_t (netlink_crypto_socket (relabelfrom relabelto))) (allow container_runtime_domain spc_t (sctp_socket (relabelfrom relabelto))) (allow container_runtime_domain spc_t (icmp_socket (relabelfrom relabelto))) (allow container_runtime_domain spc_t (ax25_socket (relabelfrom relabelto))) (allow container_runtime_domain spc_t (ipx_socket (relabelfrom relabelto))) (allow container_runtime_domain spc_t (netrom_socket (relabelfrom relabelto))) (allow container_runtime_domain spc_t (bridge_socket (relabelfrom relabelto))) (allow container_runtime_domain spc_t (atmpvc_socket (relabelfrom relabelto))) It looks like you have quite an old container-selinux installed. (I already asked twice to confirm.)

> > set selinux to minimal on machines. > Don't understand this. /usr/bin/python3 -Es /usr/share/system-config-selinux/system-config-selinux.py Under Status set to Permissive, Permissive, Minimum since Targeted was showing failed message. I'd never recommend using minimum policy to work around instead of resolving a problem. > > > > I cannot reproduce your problem using any updating path with the > latest > > package versions. > > > > _______________________________________________ > > users mailing list -- users(a)lists.fedoraproject.org > > To unsubscribe send an email to users-leave(a)lists.fedoraproject.org > > Fedora Code of Conduct: > > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > > List Guidelines: > https://fedoraproject.org/wiki/Mailing_list_guidelines > > List Archives: > > > https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.or > > g > > Do not reply to spam, report it: > > https://pagure.io/fedora-infrastructure/new_issue > > > > > > -- > > > > Zdenek Pytela > > Security SELinux team > > > +------------------------------------------------------------+ > Michael D. Setzer II - Computer Science Instructor (Retired) > mailto:mikes@guam.net > mailto:msetzerii@gmail.com > Guam - Where America's Day Begins > G4L Disk Imaging Project maintainer > http://sourceforge.net/projects/g4l/ > +------------------------------------------------------------+ > > > > > > -- > > Zdenek Pytela > Security SELinux team +------------------------------------------------------------+ Michael D. Setzer II - Computer Science Instructor (Retired) mailto:mikes@guam.net mailto:msetzerii@gmail.com Guam - Where America's Day Begins G4L Disk Imaging Project maintainer http://sourceforge.net/projects/g4l/ +------------------------------------------------------------+ -- Zdenek Pytela Security SELinux team

From: &#160; &#160;Zdenek Pytela &lt;<a href="mailto:zpytela@redhat.com" target=&quot;_blank&quot;&gt;zpytela(a)redhat.com&lt;/a&gt;&amp;gt; <br></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">[...]</blockquote>&gt; <br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> On Thu, Sep 21, 2023 at 3:30 PM Michael D. Setzer II via users <users(a)lists.fedoraproject.org&gt; wrote: On 21 Sep 2023 at 20:09, Zdenek Pytela wrote: From: Zdenek Pytela <zpytela(a)redhat.com&gt; [...] > > It looks like you have quite an old container-selinux installed. (I already > asked twice to confirm.) > All 5 machines show the same container-selinux-2.221.1-1.fc38.noarch So, why it works on some, but not others? Different histories or "bitrot". History could involve an old policy set in a way that is no longer correct. Same issue on more than one system could be shared history (package installs, manual selinux policy tweaks) or corrupt data copied from one machine to another.

-- George N. White III