Bug 2042520

This seems to affect other Things depending on selinux as well.

For example flatpak upgrade failed with:


Warning: Failed to get revokefs-fuse socket from system-helper: Could not activate remote peer.
Warning: Could not activate remote peer.
Warning: Failed to get revokefs-fuse socket from system-helper: Could not activate remote peer.
Error: Could not activate remote peer.
Warning: Failed to get revokefs-fuse socket from system-helper: Could not activate remote peer.
Warning: Could not activate remote peer.
Warning: Failed to get revokefs-fuse socket from system-helper: Could not activate remote peer.
Error: Could not activate remote peer.



When Selinux was disabled it worked again

Please update to selinux-policy-35.11-1 and let me know if the problems persist.

I can confirm this fixes the issue for me (downloaded from the koji build server as packages are not yet available on repos)

@Alessandro Bruni

Hi, may I ask you to describe the procedure you attempted to obtain and install the RPM package selinux-policy-35.11-1 from the Koji build system website?

I tried to get the 'noarch' variant directly ay the URL https://kojipkgs.fedoraproject.org//packages/selinux-policy/35.11/1.fc35/noarch/selinux-policy-35.11-1.fc35.noarch.rpm, then I launched dnf to install it with the following command:

dnf install ./selinux-policy-35.11-1.fc35.noarch.rpm

However, the installation fails on a missing dependency, that I am not able to find on the Koji website, nor on the testing repositories for Fedora:
Error: 
 Problem: conflicting requests
  - nothing provides selinux-policy-any = 35.11-1.fc35 needed by selinux-policy-35.11-1.fc35.noarch
(try to add '--skip-broken' to skip uninstallable packages)

Thanks for the patience, I'm sure it will be useful to others to find a quick solution down here.

Run rpm -qa selinux-policy* on your system and it'll tell you which others you need.

Most likely targeted and another one I can't remember on top of my head.

Files are here https://koji.fedoraproject.org/koji/buildinfo?buildID=1879547

(In reply to Mathieu Chouquet-Stringer from comment #5)
> Run rpm -qa selinux-policy* on your system and it'll tell you which others
> you need.
> 
> Most likely targeted and another one I can't remember on top of my head.
> 
> Files are here https://koji.fedoraproject.org/koji/buildinfo?buildID=1879547

By running the command you showed me, I see that I have the following packages installed:
selinux-policy-35.10-1.fc35.noarch
selinux-policy-targeted-35.10-1.fc35.noarch

However, dnf and also rpm commands refuse to install both RPMs, because selinux-policy-targeted depends on selinux-policy, and selinux-policy depends on the "bogus" selinux-policy-any that I cannot get from anywhere.

# dnf install ./selinux-policy-targeted-35.11-1.fc35.noarch.rpm 
Error: 
 Problem: conflicting requests
  - nothing provides selinux-policy = 35.11-1.fc35 needed by selinux-policy-targeted-35.11-1.fc35.noarch
(try to add '--skip-broken' to skip uninstallable packages)

# dnf install ./selinux-policy-35.11-1.fc35.noarch.rpm
Error: 
 Problem: conflicting requests
  - nothing provides selinux-policy-any = 35.11-1.fc35 needed by selinux-policy-35.11-1.fc35.noarch
(try to add '--skip-broken' to skip uninstallable packages)

I can assume, based on the answers given above, that I'm the only one stuck on a dependency like this.

You need to upgrade both at the same time, that's the only way to solve dependencies. IF package A depends on B and B on A..if you try to install A or B separately, that's not going to work.

dnf upgrade selinux-policy*35.11*

And you can see selinux-policy-targeted is provided the "any" package by running rpm -qp --provides selinux-policy-targeted-35.11-1.fc35.noarch.rpm.

The way it works is selinux-policy requires a policy, because there are multiple ones, the policy packages provides the "any" policy so selinux-policy is happy...

For instance selinux-policy-minimum also provides "any":

%rpm -qp --provides selinux-policy-minimum-35.11-1.fc35.noarch.rpm
config(selinux-policy-minimum) = 35.11-1.fc35
selinux-policy-any = 35.11-1.fc35
selinux-policy-minimum = 35.11-1.fc35

(In reply to Mathieu Chouquet-Stringer from comment #8)

That makes sense and moreover it works as you described:

(from the directory where I dowloaded both RPMs)
# dnf upgrade selinux-policy*35.11*
Dependencies resolved.
===============================================================================================================================================================
 Package                                        Architecture                  Version                                Repository                           Size
===============================================================================================================================================================
Upgrading:
 selinux-policy                                 noarch                        35.11-1.fc35                           @commandline                         70 k
 selinux-policy-targeted                        noarch                        35.11-1.fc35                           @commandline                        6.4 M

Transaction Summary
===============================================================================================================================================================
Upgrade  2 Packages

Total size: 6.4 M
Is this ok [y/N]:

After the installation I was able to run containers as root and non-root users:

# podman run hello-world:latest 

Hello from Docker!

Thanks @mathieu-acct for explaining the use of dnf package manager with local dependant RPMs

I found that running sudo dnf downgrade selinux-policy
rolling back to the previous version alleviated the issue until a fix / update hits the mirrors.

@zpytela 

After installing the selinux-policy-35.11-1 the problem is fixed
Thanks!

I believe any problems like this should be resolved with selinux-policy-35.11-1.fc35 or newer.
Downgrading to selinux-policy-35.9-1.fc35 is also a possible approach.

I am going to close this BZ now, please let me know again or create a new bz in case of outstanding problems.

*** This bug has been marked as a duplicate of bug 2042369 ***