Public bug reported: refpolicy 2:2.20260906-1 (synced from Debian) fails its autopkgtests in stonking on amd64 with "badpkg": the selinux-policy-default and selinux- policy-mls packages refuse to install.
https://autopkgtest.ubuntu.com/packages/r/refpolicy/stonking/amd64 Log: https://autopkgtest.ubuntu.com/results/autopkgtest-stonking/stonking/amd64/r/refpolicy/20260926_002710_219d1@/log.gz testbed running kernel: Linux 6.8.0-139-generic Preparing to unpack .../selinux-policy-default_2%3a2.20260906-1_all.deb ... This policy fails to load on Debian 6.x kernels so aborting dpkg: error processing archive ... (--unpack): new selinux-policy-default package preinst maintainer script subprocess failed with exit status 1 ... validate-default FAIL badpkg validate-mls FAIL badpkg Cause: this upload added a guard at the top of the preinst of selinux- policy-{default,mls}: VER=$(uname -r |cut -c1) if [ "$VER" -eq "6" ]; then echo "This policy fails to load on Debian 6.x kernels so aborting" exit 1 fi Debian changelog: "Made preinst abort when 6.x kernel is running to avoid kernel panic". The previous version 2:2.20260804-1 passes on the same infrastructure. Issues: - Any 6.x kernel blocks installation, including Debian trixie (6.12) and all current Ubuntu kernels; autopkgtest testbeds run 6.8, so the tests can never pass. - The check uses the running kernel (uname -r), not the kernel the policy will eventually be loaded on (containers, chroots, image builds, testbeds). - Checking only the first character is fragile (e.g. would also match a 60.x kernel); dpkg --compare-versions would be more correct. - The underlying kernel panic is not documented in the changelog or in any Debian bug, so it is unclear which kernels/features are actually affected. Debian status: the same regression blocks migration to testing there: "Migration status for refpolicy (2:2.20260804-1 to 2:2.20260906-1): BLOCKED ... Autopkgtest for refpolicy/2:2.20260906-1: amd64: Regression, arm64: Regression, armhf: Regression, i386: Regression, ppc64el: Regression, riscv64: Pass" No Debian bug about this currently exists; this should be forwarded to Debian. Note: the same upload also adds conflicts with ALSA, PulseAudio and gdm3, which may cause further installability issues in Ubuntu. Suggested resolution: ask Debian to document the 6.x panic and restrict/replace the guard with a precise check (or fix the policy). Until then, keep 2:2.20260804-1 in stonking. ** Affects: refpolicy (Ubuntu) Importance: Undecided Status: New ** Tags: update-excuse ** Tags added: update-excuse -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2169263 Title: refpolicy 2:2.20260906-1: preinst refuses to install on any 6.x kernel, autopkgtests fail (badpkg) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/refpolicy/+bug/2169263/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
