RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Description of problem:

  Upgrading        : selinux-policy-34.1.26-1.el9.noarch                115/663 
  Running scriptlet: selinux-policy-34.1.26-1.el9.noarch                115/663 
Failed to resolve allow statement at /var/lib/selinux/targeted/tmp/modules/200/container/cil:373
Failed to resolve AST
/usr/sbin/semodule:  Failed!

Version-Release number of selected component (if applicable):

old: selinux-policy-34.1.22-1.el9.noarch
new: selinux-policy-34.1.26-1.el9.noarch

How reproducible:

?

Steps to Reproduce:
1. Install selinux-policy-34.1.22-1.el9.noarch
2. Upgrade to selinux-policy-34.1.26-1.el9.noarch

Actual results:

See above.

Additional info:

It doesn't appear to have any negative effect on the machine
after the upgrade.  I have SELinux enforcing and nothing
appears to be broken.

# rpm -qf /var/lib/selinux/targeted/tmp/modules/200/container/cil
file /var/lib/selinux/targeted/tmp/modules/200/container/cil is not owned by any package

# ls -l
total 48
-rw-------. 1 root root 14570 Mar  1 12:20 cil
-rw-------. 1 root root 25176 Mar  1 12:20 hll
-rw-------. 1 root root     2 Mar  1 12:20 lang_ext

Richard,

What is the container-selinux package version?

This is the latest one: container-selinux-2.178.0-1.el9

Currently installed is:

$ rpm -q container-selinux
container-selinux-2.167.0-1.module+el9beta+12444+200de489.noarch

Looking through the dnf logs, that package has not been touched at
all (neither installed or upgraded) since the logs started on
2022-01-07.  Logs older than that have been rotated away.

I'm not sure how I ended up with that package installed originally.

Please update to the latest version of container-selinux.

*** This bug has been marked as a duplicate of bug 2039050 ***