Bug 1373297

Summary: openssh can't be installed without selinux-policy
Product: Red Hat Enterprise Linux 7 Reporter: Petr Lautrbach <plautrba>
Component: opensshAssignee: Jakub Jelen <jjelen>
Status: CLOSED ERRATA QA Contact: Stanislav Zidek <szidek>
Severity: high Docs Contact:
Priority: unspecified    
Version: 7.3CC: hannsj_uhl, lmiksik, nmavrogi, snagar
Target Milestone: rcKeywords: Regression
Target Release: 7.3   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: openssh-6.6.1p1-31.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-11-03 20:20:42 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Petr Lautrbach 2016-09-05 21:34:18 UTC
Description of problem:

Since 6.6.1p1-29.el7 release, openssh can't be installed without selinux-policy. This is a regression against rhel-7.2 where openssh package doesn't require selinux-policy at all.

The problem is in this patch:

 %if %{WITH_SELINUX}
+Requires: selinux-policy >= 3.13.1-92
 Requires: libselinux >= 1.27.7

Given that openssh is always compiled with SELinux support, it brings a hard requirement on selinux-policy. However, openssh can be used without SELinux and selinux-policy. I believe that the correct change would be:


 %if %{WITH_SELINUX}
-Requires: selinux-policy >= 3.13.1-92
+Conflicts: selinux-policy < 3.13.1-92
 Requires: libselinux >= 1.27.7

Comment 4 Jakub Jelen 2016-09-06 09:23:47 UTC
Related Fedora Packaging Guidelines (that I missed) for future reference:
https://fedoraproject.org/wiki/Packaging:Conflicts#Optional_Functionality

Comment 9 errata-xmlrpc 2016-11-03 20:20:42 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2016-2588.html