Bug 1443778

Summary: selinux-policy-sandbox always disable the sandbox module on upgrade
Product: [Fedora] Fedora Reporter: Michael S. <misc>
Component: selinux-policyAssignee: Lukas Vrabec <lvrabec>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 26CC: dominick.grift, dwalsh, lvrabec, mgrepl, plautrba, pmoore, ssekidde
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: selinux-policy-3.13.1-260.1.fc26 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-07-17 04:52:08 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
patch to fix the issue none

Description Michael S. 2017-04-20 00:07:43 UTC 
Created attachment 1272816 [details]
patch to fix the issue

Description of problem:

selinux-policy-sandbox always disable the sandbox module on upgrade, thus making 'sandbox' show on a regular basis a rather curious message. It took me a while to figure what was cuasing this until I tought about searching the rpm scriptlet. 



Version-Release number of selected component (if applicable):
selinux-policy-sandbox-3.13.1-249.fc26.noarch
but also affect EL7.


How reproducible:
each time

Steps to Reproduce:
1. use sandbox
2. wait for a selinux-policy-sandbox upgrade
3. upgrade

Actual results:
sandbox show a unhelpful message:

$ sandbox id
ERROR: could not find datum for type sandbox_t
/usr/bin/sandbox: Sandbox Policy is not currently installed.
You need to install the selinux-policy-sandbox package in order to run this command

Expected results:
$ sandbox id                     
uid=1000 gid=1000 groupes=1000,10,135 contexte=unconfined_u:unconfined_r:sandbox_t:s0:c749,c8

Additional info:

This is linked to https://bugzilla.redhat.com/show_bug.cgi?id=1380325, filled for RHEL 7 (who basically ask for a better message).

And a patch is attached against master in dist-git.
Comment 1 Petr Lautrbach 2017-04-20 07:31:34 UTC 
Applied. Thanks!

https://src.fedoraproject.org/cgit/rpms/selinux-policy.git/commit/?id=c8b7cd49fbf18dcd42b1a42948e10d9a3e79d45d
https://src.fedoraproject.org/cgit/rpms/selinux-policy.git/commit/?h=f26&id=94a9a7255e9dd03e64a98e33989bae4744194ab8
Comment 2 Petr Lautrbach 2017-04-20 07:34:17 UTC 
https://src.fedoraproject.org/cgit/rpms/selinux-policy.git/commit/?h=f25&id=baf0863ea8b4ff658084b1018c84205f4df0f155
Comment 3 Petr Lautrbach 2017-04-20 07:38:58 UTC 
https://src.fedoraproject.org/cgit/rpms/selinux-policy.git/commit/?h=f24&id=cdf4543ac4d445ad629a61ba9d16c9bbb9992117
Comment 4 Fedora Update System 2017-07-11 17:07:18 UTC 
selinux-policy-3.13.1-260.1.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-c2721b7375
Comment 5 Fedora Update System 2017-07-12 08:38:31 UTC 
selinux-policy-3.13.1-260.1.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-c2721b7375
Comment 6 Fedora Update System 2017-07-17 04:52:08 UTC 
selinux-policy-3.13.1-260.1.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.