From c8b7cd49fbf18dcd42b1a42948e10d9a3e79d45d Mon Sep 17 00:00:00 2001
From: Michael Scherer <misc@redhat.com>
Date: Apr 20 2017 07:27:13 +0000
Subject: Add safeguard around "semodule -n -d sandbox"


Each time this package is updated, it remove the sandbox module, thus
making the sandbox command not working until someone reenable it.

The main cause is likely the non intuitive ordering of RPM post install
script, as %preun is run after %post. See the details on
https://fedoraproject.org/wiki/Packaging:Scriptlets

---

diff --git a/selinux-policy.spec b/selinux-policy.spec
index c5775e8..5604274 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.13.1
-Release: 251%{?dist}
+Release: 252%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -116,10 +116,13 @@ fi;
 exit 0
 
 %preun sandbox
-semodule -n -d sandbox 2>/dev/null
-if /usr/sbin/selinuxenabled ; then
-    /usr/sbin/load_policy
-fi;exit 0
+if [ $1 -eq 0 ] ; then
+    semodule -n -d sandbox 2>/dev/null
+    if /usr/sbin/selinuxenabled ; then
+        /usr/sbin/load_policy
+    fi;
+fi;
+exit 0
 
 %package devel
 Summary: SELinux policy devel
@@ -682,6 +685,9 @@ exit 0
 %endif
 
 %changelog
+* Thu Apr 20 2017 Michael Scherer <misc@fedoraproject.org> - 3.13.1-252
+- fix #1380325, selinux-policy-sandbox always removing sandbox module on upgrade
+
 * Tue Apr 18 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-251
 - Fix abrt module to reflect all changes in abrt release