Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1405175

Summary: Upgrade fails %post: Re-declaration of type pkcsslotd_t
Product: Red Hat Enterprise Linux 7 Reporter: Bill Nottingham <notting>
Component: selinux-policyAssignee: Lukas Vrabec <lvrabec>
Status: CLOSED ERRATA QA Contact: Milos Malik <mmalik>
Severity: unspecified Docs Contact: Mirek Jahoda <mjahoda>
Priority: high    
Version: 7.3CC: lvrabec, mgrepl, mjahoda, mmalik, plautrba, pvrabec, ssekidde
Target Milestone: rcKeywords: ZStream
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Previously, the pkcsslotd module was renamed to pkcs. As a consequence, system update from Red Hat Enterprise Linux 7.0 to 7.3 failed. The SELinux policy store migration process has been fixed to skip the pkcsslotd module, and the failure during the system update no longer occurs.
 Story Points: ---
Clone Of:
: 1411660 (view as bug list) Environment:
Last Closed: 2017-08-01 15:20:12 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1411660    

Description Bill Nottingham 2016-12-15 19:14:04 UTC 
Description of problem:

...

Loaded plugins: product-id, subscription-manager
Resolving Dependencies
--> Running transaction check
---> Package libselinux.x86_64 0:2.2.2-6.el7 will be updated
--> Processing Dependency: libselinux = 2.2.2-6.el7 for package: libselinux-utils-2.2.2-6.el7.x86_64
--> Processing Dependency: libselinux = 2.2.2-6.el7 for package: libselinux-python-2.2.2-6.el7.x86_64
---> Package libselinux.x86_64 0:2.5-6.el7 will be an update
--> Processing Dependency: libsepol(x86-64) >= 2.5-6 for package: libselinux-2.5-6.el7.x86_64
--> Processing Dependency: libsepol.so.1(LIBSEPOL_1.0)(64bit) for package: libselinux-2.5-6.el7.x86_64
---> Package libsemanage.x86_64 0:2.1.10-16.el7 will be updated
---> Package libsemanage.x86_64 0:2.5-4.el7 will be an update
---> Package selinux-policy-targeted.noarch 0:3.12.1-153.el7 will be updated
---> Package selinux-policy-targeted.noarch 0:3.13.1-102.el7_3.7 will be an update
--> Processing Dependency: selinux-policy = 3.13.1-102.el7_3.7 for package: selinux-policy-targeted-3.13.1-102.el7_3.7.noarch
--> Processing Dependency: selinux-policy = 3.13.1-102.el7_3.7 for package: selinux-policy-targeted-3.13.1-102.el7_3.7.noarch
--> Processing Dependency: policycoreutils >= 2.5 for package: selinux-policy-targeted-3.13.1-102.el7_3.7.noarch
--> Running transaction check
---> Package libselinux-python.x86_64 0:2.2.2-6.el7 will be updated
---> Package libselinux-python.x86_64 0:2.5-6.el7 will be an update
---> Package libselinux-utils.x86_64 0:2.2.2-6.el7 will be updated
---> Package libselinux-utils.x86_64 0:2.5-6.el7 will be an update
---> Package libsepol.x86_64 0:2.1.9-3.el7 will be updated
---> Package libsepol.x86_64 0:2.5-6.el7 will be an update
---> Package policycoreutils.x86_64 0:2.2.5-11.el7 will be updated
---> Package policycoreutils.x86_64 0:2.5-9.el7 will be an update
---> Package selinux-policy.noarch 0:3.12.1-153.el7 will be updated
---> Package selinux-policy.noarch 0:3.13.1-102.el7_3.7 will be an update
--> Processing Conflict: libselinux-2.5-6.el7.x86_64 conflicts systemd < 219-20
--> Restarting Dependency Resolution with new changes.
--> Running transaction check
---> Package systemd.x86_64 0:208-11.el7 will be updated
--> Processing Dependency: systemd = 208-11.el7 for package: libgudev1-208-11.el7.x86_64
--> Processing Dependency: systemd = 208-11.el7 for package: systemd-sysv-208-11.el7.x86_64
---> Package systemd.x86_64 0:219-30.el7_3.6 will be an update
--> Processing Dependency: systemd-libs = 219-30.el7_3.6 for package: systemd-219-30.el7_3.6.x86_64
--> Processing Dependency: kmod >= 18-4 for package: systemd-219-30.el7_3.6.x86_64
--> Running transaction check
---> Package kmod.x86_64 0:14-9.el7 will be updated
---> Package kmod.x86_64 0:20-9.el7 will be an update
---> Package libgudev1.x86_64 0:208-11.el7 will be updated
---> Package libgudev1.x86_64 0:219-30.el7_3.6 will be an update
--> Processing Dependency: glib2 >= 2.42 for package: libgudev1-219-30.el7_3.6.x86_64
---> Package systemd-libs.x86_64 0:208-11.el7 will be updated
---> Package systemd-libs.x86_64 0:219-30.el7_3.6 will be an update
---> Package systemd-sysv.x86_64 0:208-11.el7 will be updated
---> Package systemd-sysv.x86_64 0:219-30.el7_3.6 will be an update
--> Running transaction check
---> Package glib2.x86_64 0:2.36.3-5.el7 will be updated
---> Package glib2.x86_64 0:2.46.2-4.el7 will be an update
--> Processing Conflict: systemd-219-30.el7_3.6.x86_64 conflicts dracut < 033-243
--> Restarting Dependency Resolution with new changes.
--> Running transaction check
---> Package dracut.x86_64 0:033-161.el7 will be updated
--> Processing Dependency: dracut = 033-161.el7 for package: dracut-network-033-161.el7.x86_64
--> Processing Dependency: dracut = 033-161.el7 for package: dracut-config-rescue-033-161.el7.x86_64
---> Package dracut.x86_64 0:033-463.el7 will be an update
--> Running transaction check
---> Package dracut-config-rescue.x86_64 0:033-161.el7 will be updated
---> Package dracut-config-rescue.x86_64 0:033-463.el7 will be an update
---> Package dracut-network.x86_64 0:033-161.el7 will be updated
---> Package dracut-network.x86_64 0:033-463.el7 will be an update
--> Processing Conflict: systemd-219-30.el7_3.6.x86_64 conflicts initscripts < 9.49.28-1
--> Restarting Dependency Resolution with new changes.
--> Running transaction check
---> Package initscripts.x86_64 0:9.49.17-1.el7 will be updated
---> Package initscripts.x86_64 0:9.49.37-1.el7 will be an update
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
 Package                  Arch    Version             Repository           Size
================================================================================
Updating:
 dracut                   x86_64  033-463.el7         rhel-7-server-rpms  317 k
 initscripts              x86_64  9.49.37-1.el7       rhel-7-server-rpms  431 k
 libselinux               x86_64  2.5-6.el7           rhel-7-server-rpms  161 k
 libsemanage              x86_64  2.5-4.el7           rhel-7-server-rpms  144 k
 selinux-policy-targeted  noarch  3.13.1-102.el7_3.7  rhel-7-server-rpms  6.4 M
 systemd                  x86_64  219-30.el7_3.6      rhel-7-server-rpms  5.2 M
Updating for dependencies:
 dracut-config-rescue     x86_64  033-463.el7         rhel-7-server-rpms   54 k
 dracut-network           x86_64  033-463.el7         rhel-7-server-rpms   96 k
 glib2                    x86_64  2.46.2-4.el7        rhel-7-server-rpms  2.3 M
 kmod                     x86_64  20-9.el7            rhel-7-server-rpms  115 k
 libgudev1                x86_64  219-30.el7_3.6      rhel-7-server-rpms   76 k
 libselinux-python        x86_64  2.5-6.el7           rhel-7-server-rpms  234 k
 libselinux-utils         x86_64  2.5-6.el7           rhel-7-server-rpms  151 k
 libsepol                 x86_64  2.5-6.el7           rhel-7-server-rpms  288 k
 policycoreutils          x86_64  2.5-9.el7           rhel-7-server-rpms  841 k
 selinux-policy           noarch  3.13.1-102.el7_3.7  rhel-7-server-rpms  412 k
 systemd-libs             x86_64  219-30.el7_3.6      rhel-7-server-rpms  368 k
 systemd-sysv             x86_64  219-30.el7_3.6      rhel-7-server-rpms   63 k

Transaction Summary
================================================================================
Upgrade  6 Packages (+12 Dependent packages)

Total download size: 18 M
Downloading packages:
Delta RPMs disabled because /usr/bin/applydeltarpm not installed.
warning: /var/cache/yum/x86_64/7Server/rhel-7-server-rpms/packages/dracut-config-rescue-033-463.el7.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID fd431d51: NOKEY
Public key for dracut-config-rescue-033-463.el7.x86_64.rpm is not installed
--------------------------------------------------------------------------------
Total                                              3.2 MB/s |  18 MB  00:05     
Retrieving key from file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
Importing GPG key 0xFD431D51:
 Userid     : "Red Hat, Inc. (release key 2) <security>"
 Fingerprint: 567e 347a d004 4ade 55ba 8a5f 199e 2f91 fd43 1d51
 Package    : redhat-release-server-7.0-1.el7.x86_64 (@anaconda/7.0)
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
Importing GPG key 0x2FA658E0:
 Userid     : "Red Hat, Inc. (auxiliary key) <security>"
 Fingerprint: 43a6 e49c 4a38 f4be 9abf 2a53 4568 9c88 2fa6 58e0
 Package    : redhat-release-server-7.0-1.el7.x86_64 (@anaconda/7.0)
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Updating   : libsepol-2.5-6.el7.x86_64                                   1/36 
  Updating   : libselinux-2.5-6.el7.x86_64                                 2/36 
  Updating   : systemd-libs-219-30.el7_3.6.x86_64                          3/36 
  Updating   : kmod-20-9.el7.x86_64                                        4/36 
  Updating   : systemd-219-30.el7_3.6.x86_64                               5/36 
  Updating   : dracut-033-463.el7.x86_64                                   6/36 
  Updating   : glib2-2.46.2-4.el7.x86_64                                   7/36 
  Updating   : libsemanage-2.5-4.el7.x86_64                                8/36 
  Updating   : libselinux-utils-2.5-6.el7.x86_64                           9/36 
  Updating   : policycoreutils-2.5-9.el7.x86_64                           10/36 
  Updating   : selinux-policy-3.13.1-102.el7_3.7.noarch                   11/36 
  Updating   : selinux-policy-targeted-3.13.1-102.el7_3.7.noarch          12/36 
Re-declaration of type pkcsslotd_t
Failed to create node
Bad type declaration at /etc/selinux/targeted/tmp/modules/400/pkcsslotd/cil:1
semodule:  Failed!
  Updating   : initscripts-9.49.37-1.el7.x86_64                           13/36 
  Updating   : libgudev1-219-30.el7_3.6.x86_64                            14/36 
  Updating   : dracut-network-033-463.el7.x86_64                          15/36 
  Updating   : dracut-config-rescue-033-463.el7.x86_64                    16/36 
  Updating   : systemd-sysv-219-30.el7_3.6.x86_64                         17/36 
  Updating   : libselinux-python-2.5-6.el7.x86_64                         18/36 
  Cleanup    : selinux-policy-targeted-3.12.1-153.el7.noarch              19/36 
  Cleanup    : selinux-policy-3.12.1-153.el7.noarch                       20/36 
  Cleanup    : dracut-config-rescue-033-161.el7.x86_64                    21/36 
  Cleanup    : systemd-sysv-208-11.el7.x86_64                             22/36 
  Cleanup    : dracut-network-033-161.el7.x86_64                          23/36 
  Cleanup    : policycoreutils-2.2.5-11.el7.x86_64                        24/36 
  Cleanup    : libgudev1-208-11.el7.x86_64                                25/36 
  Cleanup    : initscripts-9.49.17-1.el7.x86_64                           26/36 
  Cleanup    : libsemanage-2.1.10-16.el7.x86_64                           27/36 
  Cleanup    : dracut-033-161.el7.x86_64                                  28/36 
  Cleanup    : systemd-208-11.el7.x86_64                                  29/36 
  Cleanup    : systemd-libs-208-11.el7.x86_64                             30/36 
  Cleanup    : glib2-2.36.3-5.el7.x86_64                                  31/36 
  Cleanup    : libselinux-utils-2.2.2-6.el7.x86_64                        32/36 
  Cleanup    : libselinux-python-2.2.2-6.el7.x86_64                       33/36 
  Cleanup    : libselinux-2.2.2-6.el7.x86_64                              34/36 
  Cleanup    : libsepol-2.1.9-3.el7.x86_64                                35/36 
  Cleanup    : kmod-14-9.el7.x86_64                                       36/36 
  Verifying  : libsepol-2.5-6.el7.x86_64                                   1/36 
  Verifying  : libselinux-2.5-6.el7.x86_64                                 2/36 
  Verifying  : systemd-219-30.el7_3.6.x86_64                               3/36 
  Verifying  : libselinux-python-2.5-6.el7.x86_64                          4/36 
  Verifying  : systemd-libs-219-30.el7_3.6.x86_64                          5/36 
  Verifying  : libselinux-utils-2.5-6.el7.x86_64                           6/36 
  Verifying  : kmod-20-9.el7.x86_64                                        7/36 
  Verifying  : dracut-033-463.el7.x86_64                                   8/36 
  Verifying  : dracut-network-033-463.el7.x86_64                           9/36 
  Verifying  : glib2-2.46.2-4.el7.x86_64                                  10/36 
  Verifying  : policycoreutils-2.5-9.el7.x86_64                           11/36 
  Verifying  : initscripts-9.49.37-1.el7.x86_64                           12/36 
  Verifying  : systemd-sysv-219-30.el7_3.6.x86_64                         13/36 
  Verifying  : dracut-config-rescue-033-463.el7.x86_64                    14/36 
  Verifying  : selinux-policy-targeted-3.13.1-102.el7_3.7.noarch          15/36 
  Verifying  : libgudev1-219-30.el7_3.6.x86_64                            16/36 
  Verifying  : selinux-policy-3.13.1-102.el7_3.7.noarch                   17/36 
  Verifying  : libsemanage-2.5-4.el7.x86_64                               18/36 
  Verifying  : dracut-config-rescue-033-161.el7.x86_64                    19/36 
  Verifying  : systemd-sysv-208-11.el7.x86_64                             20/36 
  Verifying  : dracut-network-033-161.el7.x86_64                          21/36 
  Verifying  : selinux-policy-3.12.1-153.el7.noarch                       22/36 
  Verifying  : libselinux-utils-2.2.2-6.el7.x86_64                        23/36 
  Verifying  : glib2-2.36.3-5.el7.x86_64                                  24/36 
  Verifying  : initscripts-9.49.17-1.el7.x86_64                           25/36 
  Verifying  : systemd-libs-208-11.el7.x86_64                             26/36 
  Verifying  : libsemanage-2.1.10-16.el7.x86_64                           27/36 
  Verifying  : libsepol-2.1.9-3.el7.x86_64                                28/36 
  Verifying  : selinux-policy-targeted-3.12.1-153.el7.noarch              29/36 
  Verifying  : kmod-14-9.el7.x86_64                                       30/36 
  Verifying  : policycoreutils-2.2.5-11.el7.x86_64                        31/36 
  Verifying  : libgudev1-208-11.el7.x86_64                                32/36 
  Verifying  : libselinux-python-2.2.2-6.el7.x86_64                       33/36 
  Verifying  : systemd-208-11.el7.x86_64                                  34/36 
  Verifying  : dracut-033-161.el7.x86_64                                  35/36 
  Verifying  : libselinux-2.2.2-6.el7.x86_64                              36/36 

Updated:
  dracut.x86_64 0:033-463.el7                                                   
  initscripts.x86_64 0:9.49.37-1.el7                                            
  libselinux.x86_64 0:2.5-6.el7                                                 
  libsemanage.x86_64 0:2.5-4.el7                                                
  selinux-policy-targeted.noarch 0:3.13.1-102.el7_3.7                           
  systemd.x86_64 0:219-30.el7_3.6                                               

Dependency Updated:
  dracut-config-rescue.x86_64 0:033-463.el7                                     
  dracut-network.x86_64 0:033-463.el7                                           
  glib2.x86_64 0:2.46.2-4.el7                                                   
  kmod.x86_64 0:20-9.el7                                                        
  libgudev1.x86_64 0:219-30.el7_3.6                                             
  libselinux-python.x86_64 0:2.5-6.el7                                          
  libselinux-utils.x86_64 0:2.5-6.el7                                           
  libsepol.x86_64 0:2.5-6.el7                                                   
  policycoreutils.x86_64 0:2.5-9.el7                                            
  selinux-policy.noarch 0:3.13.1-102.el7_3.7                                    
  systemd-libs.x86_64 0:219-30.el7_3.6                                          
  systemd-sysv.x86_64 0:219-30.el7_3.6                                          

Complete!

...

This is just with the basic RHEL selinux packages, but this also means that any package with policy modules installed in the same transaction will break.

Version-Release number of selected component (if applicable):

selinux-policy-3.13.1-102.el7_3.7

How reproducible:

100%

Steps to Reproduce:
1. install base RHEL 7
2. update policy

Actual results:

failure in %post
Comment 1 Petr Lautrbach 2016-12-16 09:57:00 UTC 
This problem appears only if a system is updated directly from RHEL-7.0 to RHEL-7.3. pkcsslotd module was renamed in RHEL-7.1 to pkcs so update from RHEL-7.1 and newer doesn't have this problem.
Comment 8 errata-xmlrpc 2017-08-01 15:20:12 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1861