[rpms/selinux-policy] f44: Rebuild policy before running {binsbin|varrun}-convert.sh

[rpms/selinux-policy] f44: Rebuild policy before running {binsbin|varrun}-convert.sh

[Vit Mojzis]

            A new commit has been pushed.

            Repo   : rpms/selinux-policy
            Branch : f44
            Commit : ca9ffc1af2b2eed4dd2dc7d7457511ad6cea2124
            Author : Vit Mojzis <vmojzis@redhat.com>
            Date   : 2026-06-05T21:25:47+02:00
            Stats  : +4/-3 in 1 file(s)
            URL    : https://src.fedoraproject.org/rpms/selinux-policy/c/ca9ffc1af2b2eed4dd2dc7d7457511ad6cea2124?branch=f44

            Log:
            Rebuild policy before running {binsbin|varrun}-convert.sh

Both {binsbin|varrun}-convert.sh scripts use
/etc/selinux/<policytype>/contexts/files/file_contexts file, which is
updated during policy rebuild. Therefore the policy needs to be rebuilt
before the scripts are executed in order for
%remove{Binsbin|VarRun}ModuleLua to take effect.

Without the policy rebuild, both extra_{binsbin|varrun} modules get
removed on each selinux-policy-targeted update, since
%remove{Binsbin|VarRun}ModuleLua removes the module file, but there is
no change to /contexts/files/file_contexts and
{binsbin|varrun}-convert.sh result in noop (no module installation).

Also, fix labels of both /var/run and /usr/sbin since %relabel is
executed before the -convert scripts.

Fixes:
  Grafana running as unconfined service after selinux-policy update.
  $ sudo dnf install grafana
  $ sudo dnf reinstall selinux-policy-targeted
  $ sudo systemctl start grafana-server
  $ ps -efZ | grep grafana-server
  system_u:system_r:unconfined_service_t:s0 grafana ...

---
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 0971366..5775a64 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -587,11 +587,11 @@ exit 0
 
 %posttrans targeted
 %checkConfigConsistency targeted
+%postInstall $1 targeted
 %{_libexecdir}/selinux/varrun-convert.sh targeted
 %{_libexecdir}/selinux/binsbin-convert.sh targeted
-%postInstall $1 targeted
 restorecon -Ri /usr/lib/sysimage/rpm /var/lib/rpm /etc/mdevctl.d
-restorecon -i /usr/sbin/fapolicyd* /usr/sbin/usbguard*
+restorecon -Ri /usr/sbin /var/run
 
 %postun targeted
 if [ $1 = 0 ]; then
@@ -773,10 +773,11 @@ exit 0
 
 %posttrans mls
 %checkConfigConsistency mls
+%postInstall $1 mls
 %{_libexecdir}/selinux/varrun-convert.sh mls
 %{_libexecdir}/selinux/binsbin-convert.sh mls
-%postInstall $1 mls
 restorecon -Ri /usr/lib/sysimage/rpm /var/lib/rpm
+restorecon -Ri /usr/sbin /var/run
 
 %postun mls
 if [ $1 = 0 ]; then