Re: Fwd: setools-console-analyses package

[Aristeidis Dimitriadis <ar.s.dimitriadis@xxxxxxxxx>]

On 8/6/19 12:00 PM, Petr Lautrbach wrote:

There are 2 versions of setools available in Fedora 30:

- setools-4.1.1-14.fc30 from standard Fedora repo - the affected version

- setools-4.2.0-1.module_f30+3425+bbab1a14 from Fedora modular

We need to ship the 4.1 version as it's the last version which supports
Python 2, python2-setools is required by python2-policycoreutils which
is required by other packages outside of SELinux space.

Therefore setools-4.2 is packaged in a module:

# dnf module enable setools

# dnf update setools-console-analyses
...
Upgraded:
  python3-setools-4.2.0-1.module_f30+3425+bbab1a14.x86_64  setools-console-analyses-4.2.0-1.module_f30+3425+bbab1a14.x86_64                                                                  
Complete!

# sedta -s sshd_t -p /etc/selinux/targeted/policy/policy.31
Transition 1: sshd_t -> nx_server_t

Domain transition rule(s):
allow sshd_t nx_server_t:process transition;
...

Using the modules version fixed my problem. Thank you!

However, it is still not clear to me why this happened. Why does python2-setools prevents setools-console-analyses from being updated? It requires python3-setools. Why can't we have an updated version of the command line tools using updated versions of the python3-setools AND the old versions of python2-setools for those packages that require them?

Isn't there a way to fix this rather ugly situation (other than getting rid of Python 2 completely)? A package is practically shipped broken at the moment.

Aristeidis Dimitriadis

Attachment: pEpkey.asc
Description: application/pgp-keys

_______________________________________________
selinux mailing list -- selinux@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to selinux-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/selinux@xxxxxxxxxxxxxxxxxxxxxxx