Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 837644 - sec-policy/selinux-base-2.20220106-r2 depends on sec-policy/selinux-xserver
Summary: sec-policy/selinux-base-2.20220106-r2 depends on sec-policy/selinux-xserver
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: SELinux (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: SE Linux Bugs
Depends on:
Reported: 2022-04-10 12:13 UTC by Alexander Wetzel
Modified: 2022-04-10 19:07 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

emere --info after update & workaround (emerge-info,6.03 KB, text/plain)
2022-04-10 12:19 UTC, Alexander Wetzel
gentoo portage patch for selinux-base-2.20220106-r2 (sddm-revert.patch,2.21 KB, patch)
2022-04-10 16:35 UTC, Alexander Wetzel
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Wetzel 2022-04-10 12:13:18 UTC
When updating my amd64 (stable) selinux server the selinux policy load failed.
Many - or probably all - sec-policy/selinux-* ebuilds printed this warning:
 * SELinux module load failed. Trying full reload...
 * Failed to reload SELinux policies.
 * To reload, run the following command from within /usr/share/selinux/strict:
 *   semodule -i base.pp -i $(ls *.pp | grep -v base.pp)
 * or
 *   semodule -i base.pp -i $(ls *.pp | grep -v base.pp | grep -v unconfined.pp)
 * depending on if you need the unconfined domain loaded as well or not.

Trying the reload also failed (The server is using mcs):

owl /usr/share/selinux/mcs #  semodule -i base.pp -i $(ls *.pp | grep -v base.pp)
Failed to resolve selinuxuser statement at /var/lib/selinux/mcs/tmp/modules/400/base/cil:5557
Failed to resolve AST
semodule:  Failed!

Looking at the reported file/line this statement is causing the problem:
(selinuxuser sddm xdm ((s0) (s0)))

After emerging sec-policy/selinux-xserver the updated base policy can be loaded.

Another of my servers is running strict instead of mcs and has the same generic issue.
For some reasons emerge itself did not report but reloading all selinux modules also fails over the same statment: 

deagol /usr/share/selinux/strict #  semodule -i base.pp -i $(ls *.pp | grep -v base.pp | grep -v unconfined.pp)
Failed to resolve selinuxuser statement at /var/lib/selinux/strict/tmp/modules/400/base/cil:4461
Failed to resolve AST
semodule:  Failed!

After "emerge -1 sec-policy/selinux-xserver" the same command works as expected.

Reproducible: Always

Steps to Reproduce:
1. make sure sec-policy/selinux-xserver is not installed and "semodule -l | grep xserver" is empty.
2. Confirm that there is no /usr/share/*/xserver.pp file installed
3. update at least sec-policy/selinux-base (better all) selinux mudules to 2.20220106-r2
4. try reloading the selinux modules (cd /usr/share/selinux/<selinux-mode>; semodule -i base.pp
Actual Results:  
For MCS, strict will have a different line number:

Failed to resolve selinuxuser statement at /var/lib/selinux/mcs/tmp/modules/400/base/cil:5557
Failed to resolve AST
semodule:  Failed!

Expected Results:  
<successful load of modules, no output>

sec-policy/selinux-base-2.20220106-r2 should not depend on sec-policy/selinux-xserver
Comment 1 Alexander Wetzel 2022-04-10 12:19:31 UTC
Created attachment 769844 [details]
emere --info after update & workaround

Output from emerge --info sec-policy/selinux-base (with sec-policy/selinux-xserver installed)
Comment 2 Alexander Wetzel 2022-04-10 16:16:49 UTC
The problematic ebuild is sec-policy/selinux-base-policy-2.20220106-r2, not sec-policy/selinux-base-2.20220106-r2.

The bug is in the patchbundle for 2.20220106-r2 and seems to be already reverted by the maintainer (perfinion) in 2.20220106-r3 for another reason:

Updating only sec-policy/selinux-base-policy to 2.20220106-r3 failed and I did not want to update all selinux policies to ~amd64. So I just ported the reverted commit manually into a crude portage patch and with the thus patched sec-policy/selinux-base-policy I could remove sec-policy/selinux-xserver again.
Comment 3 Alexander Wetzel 2022-04-10 16:35:25 UTC
Created attachment 769859 [details, diff]
gentoo portage patch for selinux-base-2.20220106-r2

First, looks like selinux-base-2.20220106-r2 is the problematic ebuild after all...

This is the manual port of to gentoo portage patch.

With this in /etc/portage/patches/sec-policy/selinux-base-2.20220106-r2 and a reinstall of selinux-base-2.20220106-r2 I was able to remove the xserver module and make reload all selinux modules.

So I guess the correct solution will be making 2.20220106-r3 stable...
Comment 4 Kenton Groombridge gentoo-dev 2022-04-10 17:25:42 UTC
Upstream bug:
Comment 5 Jason Zaman gentoo-dev 2022-04-10 19:07:17 UTC
Stabilized -r3 in

The main difference from -r2 is reverting the sddm commit so things should work again. I will discuss with upstream and figure out how to handle this best