Dear Maintainer,

In refpolicy 2:2.20260906-1, an unconditional abort was added to debian/preinst.policy:

  VER=$(uname -r |cut -c1)
  if [ "$VER" -eq "6" ]; then
    echo "This policy fails to load on Debian 6.x kernels so aborting"
    exit 1
  fi

This check causes severe regressions across Debian and Ubuntu:

1. It blocks installation and upgrade on any 6.x kernel, including the standard Debian trixie kernel (6.12) and current Ubuntu kernels.
2. Checking uname -r against the running kernel breaks package installation inside containers (LXC, Docker), chroots, debootstrap, disk image builders, and CI testbeds. In these environments, SELinux is inactive and the running host kernel is unrelated to policy usage.
3. In debian/postinst.policy, semodule is already called with -n (noreload) whenever SELinux is not active or not the configured flavour:
     if [ "${SELINUXTYPE}" != "${flavour}" ] || ! selinuxenabled; then
         noreload='-n'
     fi
   Therefore, when SELinux is not active, the policy is never loaded into the kernel during package installation.
4. Autopkgtests for refpolicy (validate-default, validate-mls) fail on all 6.x architectures with "badpkg" because the packages cannot even be unpacked. This is currently blocking the migration of refpolicy 2:2.20260906-1 to Debian testing across amd64, arm64, armhf, ppc64el, and i386.

To resolve this without risking kernel panics on systems actively running SELinux on 6.x kernels, the check should only evaluate if SELinux is actually active on the system (selinuxenabled). If SELinux is inactive, chroot/container installations and autopkgtests should proceed cleanly.

This issue is also tracked in Ubuntu at:
https://bugs.launchpad.net/ubuntu/+source/refpolicy/+bug/2169263

The patch below guards the preinst check with a selinuxenabled test:
--- a/debian/preinst.policy
+++ b/debian/preinst.policy
@@ -1,9 +1,11 @@
 #!/bin/sh
 set -e

We believe that the bug you reported is fixed in the latest version of
refpolicy, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1149696@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Russell Coker <russell@coker.com.au> (supplier of updated refpolicy package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 29 Sep 2026 19:48:23 +1000
Source: refpolicy
Architecture: source
Version: 2:2.20260929-1
Distribution: unstable
Urgency: medium
Maintainer: Debian SELinux maintainers <selinux-devel@lists.alioth.debian.org>
Changed-By: Russell Coker <russell@coker.com.au>
Closes: 1149696
Changes:
 refpolicy (2:2.20260929-1) unstable; urgency=medium
 .
   * Made preinst abort when 6.x kernel is running to avoid kernel panic
   * Conflict with ALSA, Pulseaudio, and gdm3.  Use sddm and Pipewire.
   * Removed aisexec amtu bugzilla gatekeeper gitosis hddtemp i18n_input ifplugd
     kerneloops kismet mojomojo ncftool openca openct pads pegasus pingd portmap
     portreserve portslave prelink pxe qmail qpid quantum rdisc remotelogin
     rlogin telnet rshd rssh sblim sensord seunshare slocate slpd snort tzdata
     wdmd xfs zarafa zebra (quagga, ospf, rip, and bgpd) as they aren't in
     Debian, you can get the policy for them from the selinux-policy-src
     package, they could be added back if there is a need.
   * Included apt getty policy in base
   * The policy for ipsec and isns seems unlikely to work, let me know if you want this.
   * Upstream added a patch to make this kernel load on Trixie kernels, tested
     with 6.12.107+deb13 Closes: #1149696
   * Make booleans init_mounton_non_security and init_create_mountpoints default to true
   * Added some mapping for the auto restorecon to handle /usr/sbin and
     /usr/bin equivalency and also /usr/lib*
Checksums-Sha1:
 d8159f1ba14efb2da6df037b7278ce12e39901e9 2499 refpolicy_2.20260929-1.dsc
 e07f1580adeff3824fc78d3a5a46837e92a11660 700500 refpolicy_2.20260929.orig.tar.xz
 9dcd869dbf08b2f38491e64710ad745a8d15e577 107132 refpolicy_2.20260929-1.debian.tar.xz
 063319bef3bdd51a3c6d4460ade7e08b692d2ea9 8367 refpolicy_2.20260929-1_amd64.buildinfo
Checksums-Sha256:
 3587a0660b674ef00c55cda89d5638159294ff2b3c21a698d7c6cd948b1fea5c 2499 refpolicy_2.20260929-1.dsc
 9132b29ecf8a8da3892412477b2657522edd6bf5b80568ef258232320b3e3cc3 700500 refpolicy_2.20260929.orig.tar.xz
 0f579ce28ace7778238454c98e419630a465d62672da4df312d809b3d1d8e273 107132 refpolicy_2.20260929-1.debian.tar.xz
 7b047359815952427529284cf80ff1a90e87426b3c84913124a84946c7f83001 8367 refpolicy_2.20260929-1_amd64.buildinfo
Files:
 ccfb744539245f5abd2a833878c6c5be 2499 admin optional refpolicy_2.20260929-1.dsc
 110d6b272bb8d905a9cc680c3bca1826 700500 admin optional refpolicy_2.20260929.orig.tar.xz
 702c951d07c9868643e46e44fd3376ce 107132 admin optional refpolicy_2.20260929-1.debian.tar.xz
 6c7da74783eb2315ee4626e4a1291e27 8367 admin optional refpolicy_2.20260929-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEn31hncwG9XwCqmbH0UHNMPxLj3kFAmrAnJMACgkQ0UHNMPxL
j3nZsQ/8DLqBqpxl2pl2DtOF0/N6iy4Ew79FyXzI3q0KhvdCfSzyTnbaD7oV4UDZ
wP1D6Y0DGs3rjkCBHUiivkurStPRxxexsQRSyUErz64SuDs+RI+b8Uthp1laBdq2
CmY00qeHI3N1BqD+wqTZWNyPPD4w58qXpjyDHYAui6YqChQCIZ9ESIiWZpIgoTVJ
r/2zwqVklvTDLh5KVPMUZ3NlPR4izdVkqfDWLXVdqOlqg+m6/Cb/58KWMlmPIRoG
hKwBd0U8qQvPPD2O4OhywFLZrRkT9oWabQ2MH3nOwLgey5P2iDwE0aF9uVUy8on2
voh7ihep/9RRwsFpNg1tUVWlN2P9DjOeeuYsYlWZiX+ra0C+UdrqwP7cKk17AmlV
Qrvyr3TJdwVMWYUp8WSWO/hLOzHLyrVKc674d6PU9RLTsq/4naEl8KxZkRyViHqG
rejSz4ixnYMD7a7QyPBXZyg8b0i0utkIWp7qnHDmMtvRuivIxWr6ZpDgXjpJ3ETh
wE/PARbybB9qhSWZX2QjB+yoKOMthnPIwvFvDLKZRk/KHq+aTNq24X0+Eo3T2SyP
LuWGh4Pbf6T0h7h9nj/mI+r/l7qxmAaoTXTmwUMgf5WKj6yOKiraJ4ECousxsAFN
U+P/l7LB13VQqQdJKrDI+sspQTe3Vj6qVCa2HHCHidrQjrDIC2M=
=1Ivf
-----END PGP SIGNATURE-----