Bug 1723118

Summary: kickstart installation with GNOME and Xfce: DNF error in POSTIN scriplet of flatpak-selinux
Product: [Fedora] Fedora Reporter: René Genz <liebundartig>
Component: flatpakAssignee: David King <amigadave>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 30CC: amigadave, klember, terje.rosten
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: flatpak-1.4.1-3.fc31 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-25 22:25:25 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
kickstart file
none
a file from /tmp ; output of RPM packages
none
the other log files from /tmp
none
Protect sourcing of /etc/selinux/config none

Description René Genz 2019-06-22 23:51:53 UTC 
Created attachment 1583610 [details]
kickstart file

Description of problem:
Kickstart installation of either:
- @^xfce-desktop-environment  and   @workstation-product
or
- @^workstation-product-environment  and  @xfce-desktop
fails with text: Error in POSTIN scriptlet in rpm package flatpak-selinux

Leaving out the 2nd part works. Installing the 2nd part after installation is done works too.

I could not select 'flatpak-selinux' as component in this bugzilla, hence I used 'flatpak'.

Version-Release number of selected component (if applicable):
flatpak-selinux-1.4.1-1.fc30.x86_64

How reproducible:
easy, 100%

Steps to Reproduce:
0. upload WS_lbox178 somewhere
1. download https://download.fedoraproject.org/pub/fedora/linux/releases/30/Workstation/x86_64/iso/Fedora-Workstation-netinst-x86_64-30-1.2.iso
2. start computer with that ISO file
3. in Fedora menu press tab key and use this text and press enter:
vmlinuz initrd=initrd.img ks=http://path/to/WS_lbox178
4. wait for error message to appear

Actual results:
Installation aborts with text:
---8<---
Error

  The following error occurred while installing. This is a fatal error and
  installation will be aborted.

  DNF error: Error in POSTIN scriptlet in rpm package flatpak-selinux
---8<---


Expected results:
installation should finish without problem or error message.
Like it did some weeks ago.

Additional info:
Workarounds:
1) add "-flatpak-selinux" to %packages

2) use only "fedora" repository for installation; do not use "updates" repository
Comment 1 René Genz 2019-06-22 23:54:09 UTC 
Created attachment 1583611 [details]
a file from /tmp ; output of RPM packages
Comment 2 René Genz 2019-06-22 23:57:23 UTC 
Created attachment 1583612 [details]
the other log files from /tmp
Comment 3 René Genz 2019-06-23 00:18:09 UTC 
for what it is worth: I tracked the installed packages; put their names in the kickstart file; disabled the groups in the kickstart file, enabled "@^minimal-environment", and started another installation.
The total number of packages was smaller than before. The installation finished without problems. The GNOME/Xfce combination is required to trigger the problem.
Comment 4 Terje Røsten 2019-06-25 19:23:24 UTC 
I also got this error and I think I found the root cause.

flatpak-selinux has %post script:

 https://src.fedoraproject.org/rpms/flatpak/blob/f30/f/flatpak.spec#_167

 %selinux_modules_install %{_datadir}/selinux/packages/flatpak.pp.bz2

which expands to:

postinstall scriptlet (using /bin/sh):

. /etc/selinux/config 
_policytype= 
if [ -z "${_policytype}" ]; then 
  _policytype="targeted" 
fi 
if [ "${SELINUXTYPE}" = "${_policytype}" ]; then 
  /usr/sbin/semodule -n -s ${_policytype} -X 200 -i /usr/share/selinux/packages/flatpak.pp.bz2 
  /usr/sbin/selinuxenabled && /usr/sbin/load_policy || : 
fi

The problem is that /etc/selinux/config is in 

$ rpm -qf  /etc/selinux/config
selinux-policy-3.14.3-39.fc30.noarch

however flatpak-selinux have only weak requires like this:

Requires:       selinux-policy >= %{_selinux_policy_version}

however it must be the stronger  (note the extra post)

Requires(post):       selinux-policy >= %{_selinux_policy_version}

The problem can be seen in rpm db:

$ rpm -q --qf '%{name} %{INSTALLTIME}\n'  flatpak-selinux selinux-policy

flatpak-selinux 1561488293
selinux-policy  1561488294

selinux-policy is installed after flatpak-selinux
Comment 5 Terje Røsten 2019-07-04 18:41:33 UTC 
Created attachment 1587455 [details]
Protect sourcing of /etc/selinux/config

Patch to protect all sourcing of /etc/selinux/config.
Comment 6 Terje Røsten 2019-07-04 18:44:38 UTC 
Sorry, should be added to https://bugzilla.redhat.com/show_bug.cgi?id=1723940