From baf0863ea8b4ff658084b1018c84205f4df0f155 Mon Sep 17 00:00:00 2001
From: Michael Scherer <misc@redhat.com>
Date: Apr 20 2017 07:33:32 +0000
Subject: Add safeguard around "semodule -n -d sandbox"


Each time this package is updated, it remove the sandbox module, thus
making the sandbox command not working until someone reenable it.

The main cause is likely the non intuitive ordering of RPM post install
script, as %preun is run after %post. See the details on
https://fedoraproject.org/wiki/Packaging:Scriptlets

---

diff --git a/selinux-policy.spec b/selinux-policy.spec
index cb2e639..7f04686 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.13.1
-Release: 225.13%{?dist}
+Release: 225.14%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -112,10 +112,13 @@ fi;
 exit 0
 
 %preun sandbox
-semodule -n -d sandbox 2>/dev/null
-if /usr/sbin/selinuxenabled ; then
-    /usr/sbin/load_policy
-fi;exit 0
+if [ $1 -eq 0 ] ; then
+    semodule -n -d sandbox 2>/dev/null
+    if /usr/sbin/selinuxenabled ; then
+        /usr/sbin/load_policy
+    fi;
+fi;
+exit 0
 
 %package devel
 Summary: SELinux policy devel
@@ -675,6 +678,9 @@ exit 0
 %endif
 
 %changelog
+* Thu Apr 20 2017 Michael Scherer <misc@fedoraproject.org> - 3.13.1-225.14
+- fix #1380325, selinux-policy-sandbox always removing sandbox module on upgrade
+
 * Tue Apr 18 2017 Lukas Vrabec  <lvrabec@redhat.com> - 3.13.1-225.13
 - Add interface gssd_noatsecure()
 - Add interface gssproxy_noatsecure()