Skip to content

[1.4] ci: update policycoreutils for CentOS 10#5125

Merged
cyphar merged 1 commit intoopencontainers:release-1.4from
kolyshkin:1.4-5123
Feb 26, 2026
Merged

[1.4] ci: update policycoreutils for CentOS 10#5125
cyphar merged 1 commit intoopencontainers:release-1.4from
kolyshkin:1.4-5123

Conversation

@kolyshkin
Copy link
Contributor

Backport of #5123 to release-1.4 branch.


When container-selinux 4:2.246.0-1.el10 is installed, it produces the following %post script warnings:

...
Running scriptlet: container-selinux-4:2.246.0-1.el10.noarch 26/37
Installing : container-selinux-4:2.246.0-1.el10.noarch 26/37
Running scriptlet: container-selinux-4:2.246.0-1.el10.noarch 26/37
libsemanage.semanage_pipe_data: Child process /usr/libexec/selinux/hll/pp failed with code: 255. (No data available).
libsemanage.semanage_compile_module: container: libsepol.policydb_read: policydb module version 24 does not match my version range 4-23.
libsemanage.semanage_compile_module: container: libsepol.sepol_module_package_read: invalid module in module package (at section 0).
libsemanage.semanage_compile_module: container: libsepol.sepol_ppfile_to_module_package: Failed to read policy package.
libsemanage.semanage_direct_commit: Failed to compile hll files into cil files. (No data available).
semodule: Failed!
...

For some reason, dnf install still succeeds, but when the selinux tests fail with:

chcon: failed to change context of '/tmp/bats-run-3MMyYP/runc.szTqBc/bundle/runc' to ‘system_u:object_r:container_runtime_exec_t:s0’: Invalid argument

All this is fixed once policycoreutils is added to the list of RPMS so it is updated (from 3.9-3.el10 to 3.10-1.el10) during the same transaction.

(cherry picked from commit 3235c5a)

When container-selinux 4:2.246.0-1.el10 is installed, it produces the
following %post script warnings:

> ...
>   Running scriptlet: container-selinux-4:2.246.0-1.el10.noarch            26/37
>   Installing       : container-selinux-4:2.246.0-1.el10.noarch            26/37
>   Running scriptlet: container-selinux-4:2.246.0-1.el10.noarch            26/37
> libsemanage.semanage_pipe_data: Child process /usr/libexec/selinux/hll/pp failed with code: 255. (No data available).
> libsemanage.semanage_compile_module: container: libsepol.policydb_read: policydb module version 24 does not match my version range 4-23.
> libsemanage.semanage_compile_module: container: libsepol.sepol_module_package_read: invalid module in module package (at section 0).
> libsemanage.semanage_compile_module: container: libsepol.sepol_ppfile_to_module_package: Failed to read policy package.
> libsemanage.semanage_direct_commit: Failed to compile hll files into cil files. (No data available).
> semodule:  Failed!
> ...

For some reason, dnf install still succeeds, but when the selinux tests
fail with:

> chcon: failed to change context of '/tmp/bats-run-3MMyYP/runc.szTqBc/bundle/runc' to ‘system_u:object_r:container_runtime_exec_t:s0’: Invalid argument

All this is fixed once policycoreutils is added to the list of RPMS so
it is updated (from 3.9-3.el10 to 3.10-1.el10) during the same
transaction.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit 3235c5a)
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
@kolyshkin kolyshkin added this to the 1.4.1 milestone Feb 25, 2026
@kolyshkin kolyshkin added backport/1.4-pr A backport PR to release-1.4 area/ci labels Feb 25, 2026
@cyphar cyphar merged commit 81dc3f3 into opencontainers:release-1.4 Feb 26, 2026
41 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/ci backport/1.4-pr A backport PR to release-1.4

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants