Bug 2150283

Summary:	Unable to install on CS9 against selinux-policy 38.1.1-1.el9
Product:	Red Hat Enterprise Linux 9	Reporter:	Cédric Jeanneret <cjeanner>
Component:	container-selinux	Assignee:	Jindrich Novy <jnovy>
Status:	CLOSED ERRATA	QA Contact:	Edward Shen <weshen>
Severity:	urgent	Docs Contact:
Priority:	unspecified
Version:	CentOS Stream	CC:	bstinson, jnovy, jwboyer, lsm5, mboddu, tsweeney, ypu, zpytela
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	container-selinux-2.193.0-2.el9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-05-09 07:33:44 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Cédric Jeanneret 2022-12-02 11:37:32 UTC

Description of problem:
Hello there,

There's apparently an issue with container-selinux 3:2.191.0-1.el9 on CS9: it can't get properly installed, failing with this error:

Failed to resolve allow statement at /var/lib/selinux/targeted/tmp/modules/200/container/cil:1219

After a check of that CIL file, it happens to be this line:

(allow container_domain init_t (bridge_socket (ioctl read write getattr lock append accept getopt)))

Apparently, that bridge_socket was removed from selinux-policy in this patch

Downgrading selinux-policy (as well as selinux-policy-targeted) to 34.1.47-1.el9 allows to properly install container-selinux, without any issue.

Care to have a look?

Thank you!

Cheers,

C.

PS: this opened on request from the original github issue:
https://github.com/containers/container-selinux/issues/198

Comment 1 Zdenek Pytela 2022-12-02 11:50:28 UTC

Unused security classes were removed as a side effect of policy sources rebase in selinux-policy-38.1.1-1.el9.
Please use selinux-policy-38.1.2-1.el9.

I thinks this bz can be closed as a dup of bz#2145266.

Comment 2 Jindrich Novy 2022-12-02 14:06:00 UTC

Zdenek, assuming we need to amend the "at least" dependency on selinux-policy-38.1.2-1.el9 in container-selinux so I will keep this open to track this.

Comment 3 Zdenek Pytela 2022-12-02 14:27:36 UTC

(In reply to Jindrich Novy from comment #2)
> Zdenek, assuming we need to amend the "at least" dependency on
> selinux-policy-38.1.2-1.el9 in container-selinux so I will keep this open to
> track this.

OK. Also note selinux-policy versions up to 34.1.47-1 contained the classes as well.

Comment 8 errata-xmlrpc 2023-05-09 07:33:44 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (container-selinux bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:2206