FEDORA-2026-80e3b8ff73 is the new sidetag bodhi update. It is green except unrelated crashes in nfsrahead.

We need either to rebuild this package in a sidetag or re-tag this one to the sidetag where FreeIPA will be build. And then submit this whole sidetag together to Bodhi.

I do not see any SELinux problems from FreeIPA tests. There are two SELinux issues coming from systemd, though.

The failure seem to be unrelated to these packages:

sss_string_array_free : /usr/lib64/sssd/modules/sssd_krb5_passkey_plugin.so :: ERROR sss_string_array_free found in multiple paths (['/usr/lib64/sssd/modules/sssd_krb5_passkey_plugin.so', '/usr/lib64/sssd/modules/sssd_krb5_idp_plugin.so'])
sss_radius_message_encode : /usr/lib64/sssd/modules/sssd_krb5_passkey_plugin.so :: ERROR sss_radius_message_encode found in multiple paths (['/usr/lib64/sssd/modules/sssd_krb5_passkey_plugin.so', '/usr/lib64/sssd/modules/sssd_krb5_idp_plugin.so'])
sss_string_array_copy : /usr/lib64/sssd/modules/sssd_krb5_passkey_plugin.so :: ERROR sss_string_array_copy found in multiple paths (['/usr/lib64/sssd/modules/sssd_krb5_passkey_plugin.so', '/usr/lib64/sssd/modules/sssd_krb5_idp_plugin.so'])
sss_strings_to_json_array : /usr/lib64/sssd/modules/sssd_krb5_passkey_plugin.so :: ERROR sss_strings_to_json_array found in multiple paths (['/usr/lib64/sssd/modules/sssd_krb5_passkey_plugin.so', '/usr/lib64/sssd/modules/sssd_krb5_idp_plugin.so'])
sss_radiuskdc_challenge_free : /usr/lib64/sssd/modules/sssd_krb5_passkey_plugin.so :: ERROR sss_radiuskdc_challenge_free found in multiple paths (['/usr/lib64/sssd/modules/sssd_krb5_passkey_plugin.so', '/usr/lib64/sssd/modules/sssd_krb5_idp_plugin.so'])

E.g. it comes from SSSD modules built using the same infrastructure in SSSD code.

Ok, looks like pk-backend needs the same set of operations permitted as with the unconfined_t domain. I'll work on that tonight.

FEDORA-2026-165f7e7dec contains discussion of incomplete SELinux policy.

Failures are due to incomplete SELinux policy. See FEDORA-2026-165f7e7dec for details.

Adding -1 for preventing accidental push

I have rules for setfiles_t to relabel the files but it seems dnf runs unconfined and that rule does not exist:

time->Tue Feb 17 03:07:08 2026
type=AVC msg=audit(1771315628.219:384): avc:  denied  { relabelto } for  pid=1412 comm="dnf" name="oidc_child;6994219a" dev="dm-0" ino=5432835 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sssd_mfa_exec_t:s0 tclass=file permissive=0
----
time->Tue Feb 17 03:07:09 2026
type=AVC msg=audit(1771315629.947:434): avc:  denied  { relabelto } for  pid=1412 comm="dnf" name="passkey_child;6994219a" dev="dm-0" ino=5442824 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sssd_mfa_exec_t:s0 tclass=file permissive=0

FYI, We've changed SELinux policy in FreeIPA to allow standalone use of SSSD helpers on non-enrolled systems. However, https://openqa.fedoraproject.org/tests/4300757#step/role_deploy_domain_controller/19 shows that SSSD subpackage cannot be installed with new SELinux context.

I am not sure what specifically should I do here, perhaps we have to update main Fedora SELinux policy in the same bodhi update as well?

OpenQA tests are green.

Thanks for the rebuild. OpenQA tests are fine.

Thanks for the rebuild. OpenQA tests are fine.

SELinux AVCs are known and related to new systemd/ssh helpers. Already supported in selinux-policy in updates-testing.