I am switching from strict to targeted profile. I have POLICYTYPES="strict targeted" in /etc/portage/make.conf (Used to be strict only) While reemerging my policy ebuilds, I received the following error during the squid policy build: WARN: postinst SELinux module load failed. Trying full reload... Failed to reload SELinux policies. semodule -b base.pp -i $(ls *.pp | grep -v base.pp | grep -v unconfined.pp) yields the following error message: Unable to resolve name: httpd_squid_script_exec_t Failed to resolve filecon statement at 3 of /var/lib/selinux/targeted/tmp/modules/400/squid/cil Failed to resolve ast semodule: Failed! Reproducible: Always Steps to Reproduce: 1. emerge -1v sec-policy/selinux-squid 2. 3. Actual Results: Error on install Expected Results: Package installs correctly # emerge --info Portage 2.2.20 (python 2.7.9-final-0, hardened/linux/amd64/selinux, gcc-4.8.4, glibc-2.20-r2, 4.1.4-hardened x86_64) ================================================================= System uname: Linux-4.1.4-hardened-x86_64-Intel-R-_Xeon-R-_CPU_E5620_@_2.40GHz-with-gentoo-2.2 KiB Mem: 2053744 total, 1132720 free KiB Swap: 262140 total, 262140 free Timestamp of repository gentoo: Wed, 12 Aug 2015 13:30:01 +0000 sh bash 4.3_p33-r2 ld GNU ld (Gentoo 2.24 p1.4) 2.24 app-shells/bash: 4.3_p33-r2::gentoo dev-lang/perl: 5.20.2::gentoo dev-lang/python: 2.7.9-r1::gentoo, 3.4.1::gentoo dev-util/pkgconfig: 0.28-r2::gentoo sys-apps/baselayout: 2.2::gentoo sys-apps/openrc: 0.17::gentoo sys-apps/sandbox: 2.6-r1::gentoo sys-devel/autoconf: 2.69::gentoo sys-devel/automake: 1.15::gentoo sys-devel/binutils: 2.24-r3::gentoo sys-devel/gcc: 4.8.4::gentoo sys-devel/gcc-config: 1.7.3::gentoo sys-devel/libtool: 2.4.6::gentoo sys-devel/make: 4.1-r1::gentoo sys-kernel/linux-headers: 3.18::gentoo (virtual/os-headers) sys-libs/glibc: 2.20-r2::gentoo Repositories: gentoo location: /usr/portage sync-type: rsync sync-uri: rsync://rsync.gentoo.org/gentoo-portage priority: -1000 ACCEPT_KEYWORDS="amd64" ACCEPT_LICENSE="* -@EULA" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-march=core2 -O2 -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/gconf /etc/gentoo-release /etc/sandbox.d /etc/terminfo" CXXFLAGS="-march=core2 -O2 -pipe" DISTDIR="/usr/portage/distfiles" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync news parallel-fetch preserve-libs protect-owned sandbox selinux sesandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://www.gtlib.gatech.edu/pub/gentoo ftp://ftp.gtlib.gatech.edu/pub/gentoo http://gentoo.mirrors.pair.com/ ftp://gentoo.mirrors.pair.com/" LANG="en_US.utf8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" MAKEOPTS="-j2" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/var/tmp" USE="acl amd64 berkdb bindist bzip2 cli cracklib crypt cxx dri gdbm hardened iconv ipv6 justify mmx mmxext modules multilib ncurses nls nptl open_perms openmp pam pax_kernel pcre pie readline selinux session sse sse2 ssl ssp tcpd unconfined unicode urandom xattr xtpax zlib" ABI_X86="64" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="mmx mmxext sse sse2" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-5" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_4" RUBY_TARGETS="ruby19 ruby20" USERLAND="GNU" VIDEO_CARDS="fbdev glint intel mach64 mga nouveau nv r128 radeon savage sis tdfx trident vesa via vmware dummy v4l" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, USE_PYTHON
Uninstalling package, rebuilding sec-policy/selinux-apache (which is a dependency), then reinstalling fixed the problem. I would resolve this, but I would like to leave it open in case this is an issue that could be handled programmatically. Anyway, I'll leave that decision to you learned scholars.
(In reply to Shawn Kovalchick from comment #1) > Uninstalling package, rebuilding sec-policy/selinux-apache (which is a > dependency), then reinstalling fixed the problem. Uninstalling is probably not required, just emerge selinux-apache first then do selinux-squid. > I would resolve this, but I would like to leave it open in case this is an > issue that could be handled programmatically. Anyway, I'll leave that > decision to you learned scholars. As for why this was not automatic ... I have no idea. The ebuilds have had DEPEND="${DEPEND} sec-policy/selinux-apache " RDEPEND="${RDEPEND} sec-policy/selinux-apache " in them ever since release 2.20141203-r1 so portage *should* emerge it first. Did you only "emerge -1v selinux-squid" and hit this error or did you re-emerge all of them with: "emerge -v1 $(qlist -IC sec-policy)"? the latter will re-emerge all of them and should thus do selinux-apache before selinux-squid.
I don't think the problem was with the dependency. My theory is that after switching from the strict to the targeted policy, the apache policy bits had not yet been included in whatever was needed for the squid policy to compile. (I'm referring to the semodule command in my initial comment.) So even though the apache module had been built, the semodule part had not yet run (or maybe it had failed previously and I didn't notice). Running the semodule command with squid still installed would fail. After uninstalling squid and rerunning the semodule command, the squid policy installed correctly. To answer your later question, I ran emerge -1v <<ls from /var/db/whatever/.../sec-policy>>. (I'll note that qlist line for next time). I thought it rebuilt the apache module first, but I can't be certain.
I *think* that the problem is that Portage rebuilds does not honor the dependency tree in the same sense as when the dependency has not been built yet. When you change POLICY_TYPES="strict" to POLICY_TYPES="strict targeted" and then rebuild the policies, Portage will think that selinux-apache is already installed (when building selinux-squid) so does not 'push' that dependency up the tree. It'll just rebuild it as part of the large rebuild you've done. Perhaps we should update the documentation to first rebuild the dependency-sensitive ones (i.e. those that are dependencies of others). From a quick grep this would be: sec-policy/selinux-daemontools sec-policy/selinux-dbus sec-policy/selinux-inetd sec-policy/selinux-java sec-policy/selinux-kerberos sec-policy/selinux-lpd sec-policy/selinux-milter sec-policy/selinux-remotelogin sec-policy/selinux-ucspitcp sec-policy/selinux-virt sec-policy/selinux-xserver But it would be even better if this was dynamically calculated in the command. Perhaps there is even a way to trigger Portage to think the packages are not installed yet?
Maybe a flag (use flag, feature flag, etc.) could be set instead of a make.conf option. If the use flag changed, the it would trigger a recompile? Also, I noticed that selinux-apache was not in your list of dependencies.
