I forwarded this issue to Debian BTS:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149696
In debian/postinst.policy, semodule is already called with -n (noreload) when
SELinux is not active or not the configured flavour:
if [ "${SELINUXTYPE}" != "${flavour}" ] || ! selinuxenabled; then
noreload='-n'; fi
Because of this, the policy is never loaded into the kernel during
package install on systems where SELinux is inactive. The unconditional
preinst abort broke unpack in containers, chroots, and autopkgtest
testbeds running 6.x kernels.
Guarding the check with [ -x /usr/sbin/selinuxenabled ] &&
selinuxenabled preserves the guard when SELinux is active, while
allowing packages to unpack and autopkgtests (validate-default,
validate-mls) to pass cleanly.
Attached debdiff: refpolicy_2.20260906-1ubuntu1.debdiff
** Description changed:
+ [ Impact ]
+
+ refpolicy 2:2.20260906-1 fails its autopkgtests in Ubuntu stonking with
+ "badpkg" because selinux-policy-default and selinux-policy-mls fail to
+ unpack.
+
+ In 2:2.20260906-1, an unconditional check was added to
+ debian/preinst.policy:
+
+ VER=$(uname -r |cut -c1)
+ if [ "$VER" -eq "6" ]; then
+ echo "This policy fails to load on Debian 6.x kernels so aborting"
+ exit 1
+ fi
+
+ This check aborts installation on all 6.x kernels, which are standard in
+ Debian trixie (6.12) and current Ubuntu releases (6.8 / 7.0). Checking
+ uname -r against the running kernel also breaks package installation
+ inside containers, chroots, image builders, and CI/autopkgtest testbeds
+ where SELinux is not active.
+
+ In debian/postinst.policy, semodule is already executed with -n (noreload)
whenever SELinux is not active or not the configured flavour:
+ if [ "${SELINUXTYPE}" != "${flavour}" ] || ! selinuxenabled; then
noreload='-n'; fi
+ When SELinux is not active, the policy is never loaded into the kernel during
package installation. Aborting in preinst during unpack is therefore
unnecessary when SELinux is inactive.
+
+ [ Fix ]
+
+ In debian/preinst.policy, guard the kernel check with [ -x
+ /usr/sbin/selinuxenabled ] && selinuxenabled, and use cut -d. -f1:
+
+ if [ -x /usr/sbin/selinuxenabled ] && selinuxenabled; then
+ VER=$(uname -r | cut -d. -f1)
+ if [ "$VER" = "6" ]; then
+ echo "This policy fails to load on Debian 6.x kernels so aborting"
+ exit 1
+ fi
+ fi
+
+ When SELinux is not active (default in Ubuntu, testbeds, containers, and
+ chroots), the package unpacks and configures cleanly.
+
+ [ Test Plan ]
+
+ 1. On a system running a 6.x kernel with SELinux inactive, install
selinux-policy-default:
+ # dpkg -i selinux-policy-default_2%3a2.20260906-1_all.deb
+ Result: Fails during unpack with "This policy fails to load on Debian 6.x
kernels so aborting" (exit code 1).
+ 2. Install the updated package:
+ # dpkg -i selinux-policy-default_2%3a2.20260906-1ubuntu1_all.deb
+ Result: Package unpacks and configures cleanly (exit code 0).
+ 3. Run autopkgtest validate-default and validate-mls:
+ Result: All modules link and expand via semodule --noreload and setfiles
passes with exit code 0.
+
+ [ Where problems could occur ]
+
+ The change is isolated to debian/preinst.policy. If SELinux is actively
+ running on a 6.x kernel, the safeguard aborts as originally intended by
+ the maintainer. On systems where SELinux is disabled, policy files are
+ unpacked and compiled offline without touching the running kernel.
+
+ [ Other Info ]
+
+ - Forwarded to Debian BTS:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149696
+ - Target series: stonking (Ubuntu 26.10)
+ - Target debdiff: refpolicy 2:2.20260906-1ubuntu1
+ - Autopkgtest results: validate-default passes cleanly with exit code 0.
+
+ --- [ Original Report ]
+
refpolicy 2:2.20260906-1 (synced from Debian) fails its autopkgtests in
stonking on amd64 with "badpkg": the selinux-policy-default and selinux-
policy-mls packages refuse to install.
https://autopkgtest.ubuntu.com/packages/r/refpolicy/stonking/amd64
Log:
https://autopkgtest.ubuntu.com/results/autopkgtest-stonking/stonking/amd64/r/refpolicy/20260926_002710_219d1@/log.gz
testbed running kernel: Linux 6.8.0-139-generic
Preparing to unpack .../selinux-policy-default_2%3a2.20260906-1_all.deb ...
This policy fails to load on Debian 6.x kernels so aborting
dpkg: error processing archive ... (--unpack):
new selinux-policy-default package preinst maintainer script subprocess
failed with exit status 1
...
validate-default FAIL badpkg
validate-mls FAIL badpkg
Cause: this upload added a guard at the top of the preinst of selinux-
policy-{default,mls}:
VER=$(uname -r |cut -c1)
if [ "$VER" -eq "6" ]; then
echo "This policy fails to load on Debian 6.x kernels so aborting"
exit 1
fi
Debian changelog: "Made preinst abort when 6.x kernel is running to avoid
kernel panic".
The previous version 2:2.20260804-1 passes on the same infrastructure.
Issues:
- Any 6.x kernel blocks installation, including Debian trixie (6.12) and all
current Ubuntu kernels; autopkgtest testbeds run 6.8, so the tests can never
pass.
- The check uses the running kernel (uname -r), not the kernel the policy
will eventually be loaded on (containers, chroots, image builds, testbeds).
- Checking only the first character is fragile (e.g. would also match a 60.x
kernel); dpkg --compare-versions would be more correct.
- The underlying kernel panic is not documented in the changelog or in any
Debian bug, so it is unclear which kernels/features are actually affected.
Debian status: the same regression blocks migration to testing there:
"Migration status for refpolicy (2:2.20260804-1 to 2:2.20260906-1): BLOCKED
... Autopkgtest for refpolicy/2:2.20260906-1: amd64: Regression, arm64:
Regression, armhf: Regression, i386: Regression, ppc64el: Regression, riscv64:
Pass"
No Debian bug about this currently exists; this should be forwarded to Debian.
Note: the same upload also adds conflicts with ALSA, PulseAudio and
gdm3, which may cause further installability issues in Ubuntu.
Suggested resolution: ask Debian to document the 6.x panic and
restrict/replace the guard with a precise check (or fix the policy).
Until then, keep 2:2.20260804-1 in stonking.
** Bug watch added: Debian Bug tracker #1149696
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149696
** Patch added: "refpolicy 2:2.20260906-1ubuntu1 debdiff for stonking"
https://bugs.launchpad.net/ubuntu/+source/refpolicy/+bug/2169263/+attachment/6004852/+files/refpolicy_2.20260906-1ubuntu1.debdiff
** Changed in: refpolicy (Ubuntu)
Status: New => Confirmed
** Tags added: autopkgtest patch regression selinux stonking
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169263
Title:
refpolicy 2:2.20260906-1: preinst refuses to install on any 6.x
kernel, autopkgtests fail (badpkg)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/refpolicy/+bug/2169263/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
