yum update / SELinux problem?

[Kam Leo]

On 3/1/07, Jim Cornette <fc-cornette at insight.rr.com> wrote:
> Jonathan Rawle wrote:
> > I have a problem installing updates via yum. I usually type
> > sudo yum update
> > and have sudoers set up to allow this. However, I've recently started to see
> > messages of the form:
> > error: %pre(packagename) scriptlet failed, exit status 255
> > It seems to install the new package, but does not remove the old one, which
> > has taken some sorting out!
> >
> > It also doesn't work if I su to root and type yum update. But it DOES work
> > if I disable SELinux with setenforce 0
> >
> > I'm seeing the following AVC messages in dmesg:
> >
> > audit(1172787681.632:38): avc:  denied  { transition } for  pid=7147
> > comm="yum" name="bash" dev=sda1 ino=2154415
> > scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023
> > tcontext=system_u:system_r:rpm_script_t:s0-s0:c0.c1023 tclass=process
> >
> > Seeing as we don't have everyone complaining that yum is broken, I assume my
> > filesystem is wrongly labelled or something. I did fixfiles check and
> > couldn't see anything that looked significant...
> >
> > Why is it xdm_t? Is it something to do with me using kdm as my login manager
> > (most people use gdm)?
> >
> > So I wondered if anyone has any ideas of how to fix this? I don't want to
> > have to switch off enforcing every time I do an update!
> >
> > Thanks in advance,
> >
> >
> > Jonathan
> >
> >
>
> I'd drop to runlevel 1 and then run 'fixfiles relabel' and answer yes to
> remove files in /tmp. Of course if you store files there, you ought to
> pick a different location.
>
> After relabeling a reboot is needed especially if you cleared the /tmp
> files.
>
> I used to run 'setenforce 0' quite a bit before running yum because of
> the Exit Status 255 error with the scriptlets that were related to
> SELinux. Either by pure luck or because of the security content being
> corrected, I no longer needed to setenforce to 0 before updating after
> the relabeling.
>
> It is a bug and has been because of system policy in some cases and at
> the package level in other cases.
>
> Jim
>

Any chance that you have some obsolete scripts left over by performing
update instead of upgrade?