From e9fa604b58c17549819025175cd08092373a2d7e Mon Sep 17 00:00:00 2001
From: Vit Mojzis <vmojzis@redhat.com>
Date: Mon, 23 Feb 2026 12:32:52 +0100
Subject: [PATCH] Rebuild policy before running {binsbin|varrun}-convert.sh

Both {binsbin|varrun}-convert.sh scripts use
/etc/selinux/<policytype>/contexts/files/file_contexts file, which is
updated during policy rebuild. Therefore the policy needs to be rebuilt
before the scripts are executed in order for
%remove{Binsbin|VarRun}ModuleLua to take effect.

Without the policy rebuild, both extra_{binsbin|varrun} modules get
removed on each selinux-policy-targeted update, since
%remove{Binsbin|VarRun}ModuleLua removes the module file, but there is
no change to /contexts/files/file_contexts and
{binsbin|varrun}-convert.sh result in noop (no module installation).

Also, fix labels of both /var/run and /usr/sbin since %relabel is
executed before the -convert scripts.

Resolves: RHEL-141813
---
 selinux-policy.spec | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/selinux-policy.spec b/selinux-policy.spec
index f910d4e5..60afa3ef 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -625,11 +625,11 @@ exit 0
 
 %posttrans targeted
 %checkConfigConsistency targeted
+%postInstall $1 targeted
 %{_libexecdir}/selinux/varrun-convert.sh targeted
 %{_libexecdir}/selinux/binsbin-convert.sh targeted
-%postInstall $1 targeted
 %{_sbindir}/restorecon -Ri /usr/lib/sysimage/rpm /var/lib/rpm /etc/mdevctl.d
-%{_sbindir}/restorecon -i /usr/sbin/fapolicyd* /usr/sbin/usbguard*
+%{_sbindir}/restorecon -Ri /usr/sbin /var/run
 
 %postun targeted
 if [ $1 = 0 ]; then
@@ -966,10 +966,11 @@ exit 0
 
 %posttrans mls
 %checkConfigConsistency mls
+%postInstall $1 mls
 %{_libexecdir}/selinux/varrun-convert.sh mls
 %{_libexecdir}/selinux/binsbin-convert.sh mls
-%postInstall $1 mls
 %{_sbindir}/restorecon -Ri /usr/lib/sysimage/rpm /var/lib/rpm
+%{_sbindir}/restorecon -Ri /usr/sbin /var/run
 
 %postun mls
 if [ $1 = 0 ]; then