What were you trying to do that didn't work?

Upgrade from RHEL 9.3 to 9.4 with selinux module 'unconfined' disabled.

Please provide the package NVR for which bug is seen:

selinux-policy-targeted-38.1.35-2.el9_4.0.2.

How reproducible:

Consistently

Steps to reproduce

1. Start with an EL 9.3 host
2. Disable unconfined policy module (semodule -d unconfined)
3. Upgrade to EL 9.4
4.  

Or

1. Start with generic el 9.4 host
2. semodule -d unconfined
3.  

Expected results

Selinux policy continue to work without errors post update

Ability to disable unconfined module

Actual results

Failed to resolve typeattributeset statement at /var/lib/selinux/targeted/tmp/modules/100/sap/cil:29
Failed to resolve AST
semodule:  Failed!

Custom selinux modules fail to re-apply

Use case 2, unconfined module is not disabled.

Work-Around:

1. semodule -e unconfined
2. dnf update
3. semodule -d sap
4. semodule -d unconfined