Description of problem: After upgrading selinux-policy-mls, yum threw the following error messages:

  Updating   : selinux-policy-mls-3.13.1-224.fc26.noarch                 53/156 
/etc/selinux/mls/contexts/files/file_contexts.bin:  line 1 error due to: Non-ASCII characters found
/etc/selinux/mls/contexts/files/file_contexts.homedirs.bin:  line 1 error due to: Non-ASCII characters found
  Updating   : selinux-policy-targeted-3.13.1-224.fc26.noarch            54/156 

/bin/su is affected as well:
% su
Password: 
/etc/selinux/mls/contexts/files/file_contexts.bin:  line 1 error due to: Non-ASCII characters found
/etc/selinux/mls/contexts/files/file_contexts.homedirs.bin:  line 1 error due to: Non-ASCII characters found

Reverting selinux-policy and selinux-policy-mls to 3.13.1-222 clears up the error messages.

The problem appears to be in the preinstall scriptlet:

     if [ -e /etc/selinux/mls/.policy.sha512 ]; then 
        POLICY_FILE=`ls /etc/selinux/mls/policy/policy.* | sort | head -1` 
        sha512=`sha512sum $POLICY_FILE | cut -d ' ' -f 1`; 
	checksha512=`cat /etc/selinux/mls/.policy.sha512`; 
	if [ "$sha512" == "$checksha512" ] ; then 
		rm /etc/selinux/mls/.rebuild; 
	fi; 

So we look at the .policy.sha512 from the previous release - and then we compute the sha512 of the *current* policy, which is still the *previous* version because we're in preinstall, not postinstall.  So of course they match, so we nuke .rebuild and then the postinstall doesn't run semodule.

What *should* happen:

the pre-install saves the sha512 file in a .pre, and then hash the policy and compare in the postinstall....


Version-Release number of selected component (if applicable):
selinux-policy-mls-3.13.1-224.fc26

How reproducible:
selinux-policy-mls-3.13.1-224.fc26

Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info: