Bug 2283151

Summary: Postinstall script uses non-existent /usr/sbin/rm program and fails
Product: [Fedora] Fedora Reporter: jeff
Component: fail2banAssignee: Richard Shaw <hobbes1069>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: low Docs Contact:
Priority: unspecified    
Version: 40CC: anon.amish, hobbes1069, orion, song.fc
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: fail2ban-1.1.0-1.fc39 fail2ban-1.1.0-1.fc40 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2024-06-24 01:38:47 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description jeff 2024-05-24 21:25:20 UTC
Description of problem:
Installing fail2ban-selinux (which is a dependent package of fail2ban) with dnf causes the following error:

```
Error in POSTIN scriptlet in rpm package fail2ban-selinux
```

Version-Release number of selected component (if applicable):
1.0.2-15.fc40


How reproducible:
Always


Steps to Reproduce:
1. Fresh Fedora 40 install (Cinnamon Spin)
2. Run `sudo dnf install -q -y fail2ban-firewalld fail2ban-systemd`
3. See error.

Actual results:
Have error message, not sure about any actual problems though.

Expected results:
Not to have error.

Additional info:
Running `rpm -q --scripts fail2ban-selinux | grep -A15 ^postinstall` shows the line

```
usr/sbin/rm -rf ...
```

but that program does not exist (and no package seems to provide it). Likely should be /usr/bin/rm, maybe sbin version was removed in a recent version. All other programs it references in /usr/sbin do exist.

Comment 1 song.fc 2024-05-28 14:12:21 UTC
Same here on Fedora 40 Kinoite, it is not installable via rpm-ostree:

```
# rpm-ostree install fail2ban
Checking out tree baf6e43... done
Enabled rpm-md repositories: fedora-cisco-openh264 updates fedora updates-archive
Importing rpm-md... done
rpm-md repo 'fedora-cisco-openh264' (cached); generated: 2024-03-12T11:45:42Z solvables: 3
rpm-md repo 'updates' (cached); generated: 2024-05-28T01:05:10Z solvables: 15473
rpm-md repo 'fedora' (cached); generated: 2024-04-14T18:51:11Z solvables: 74881
rpm-md repo 'updates-archive' (cached); generated: 2024-05-22T01:41:39Z solvables: 13161
Resolving dependencies... done
Will download: 11 packages (967.2 kB)
Downloading from 'updates'... done
Downloading from 'fedora'... done
Importing packages... done
Checking out packages... done
Running pre scripts... done
Running post scripts... done
error: Running %post for fail2ban-selinux: bwrap(/bin/sh): 子进程已由信号 1 杀死(translation: Child killed by signal 1); run `journalctl -t 'rpm-ostree(fail2ban-selinux.post)'` for more information
```

```
# journalctl -r -t 'rpm-ostree(fail2ban-selinux.post)'
5月 28 22:07:06 sfc-HFMPBVX2 rpm-ostree(fail2ban-selinux.post)[198603]: libsemanage.semanage_direct_install_info: Overriding fail2ban module at lower priority 100 with module at priority 200.
5月 28 22:06:56 sfc-HFMPBVX2 rpm-ostree(fail2ban-selinux.post)[198602]: /proc/self/fd/5: 行 10: /usr/sbin/rm: 没有那个文件或目录(translation: No such file or directory)
```

I have tried with `rpm-ostree usroverlay` and `ln -s /usr/bin/rm /usr/sbin/rm`, but no luck.

Comment 2 song.fc 2024-05-28 14:28:03 UTC
I think this will be resolved by https://src.fedoraproject.org/rpms/selinux-policy/c/e66f4c2f3673833ae0aac94fd60dbeb061c5b088?branch=rawhide, anyone knows when will it be updated for f40?

Comment 3 song.fc 2024-06-12 05:03:44 UTC
As silverblue 40.20240612.0, this is fixed now, fail2ban installed successfully.

Comment 4 Richard Shaw 2024-06-12 11:41:02 UTC
(In reply to jeff from comment #0)
> 
> Additional info:
> Running `rpm -q --scripts fail2ban-selinux | grep -A15 ^postinstall` shows
> the line
> 
> ```
> usr/sbin/rm -rf ...
> ```
> 
> but that program does not exist (and no package seems to provide it). Likely
> should be /usr/bin/rm, maybe sbin version was removed in a recent version.
> All other programs it references in /usr/sbin do exist.

That's all governed by the selinux macros so not a direct package bug. Can you still reproduce?

Also, it looks like fail2ban failed to build with Python 3.13 so there may be a new build coming soon (if the fix is easy).

Comment 5 Fedora Update System 2024-06-15 01:31:34 UTC
FEDORA-2024-7e68838005 (fail2ban-1.1.0-1.fc40) has been submitted as an update to Fedora 40.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-7e68838005

Comment 6 Fedora Update System 2024-06-15 01:31:40 UTC
FEDORA-2024-16db7a23dd (fail2ban-1.1.0-1.fc39) has been submitted as an update to Fedora 39.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-16db7a23dd

Comment 7 Fedora Update System 2024-06-16 01:23:07 UTC
FEDORA-2024-7e68838005 has been pushed to the Fedora 40 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-7e68838005`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-7e68838005

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2024-06-16 01:40:25 UTC
FEDORA-2024-16db7a23dd has been pushed to the Fedora 39 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-16db7a23dd`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-16db7a23dd

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Fedora Update System 2024-06-24 01:38:47 UTC
FEDORA-2024-16db7a23dd (fail2ban-1.1.0-1.fc39) has been pushed to the Fedora 39 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 10 Fedora Update System 2024-06-24 06:36:18 UTC
FEDORA-2024-7e68838005 (fail2ban-1.1.0-1.fc40) has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.