Bug 2071069

Summary: Boot fails with systemd-251~rc1-1.fc37 due to SELinux denials
Product: [Fedora] Fedora Reporter: Adam Williamson (Red Hat non-Fedora) <awilliam>
Component: selinux-policyAssignee: Zdenek Pytela <zpytela>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: urgent Docs Contact:
Priority: unspecified    
Version: rawhideCC: dan, dwalsh, fedoraproject, filbranden, flepied, grepl.miroslav, kevin, lnykryn, lvrabec, mmalik, msekleta, omosnace, pkoncity, robatino, ryncsn, ssahani, s, systemd-maint, vmojzis, yuwatana, zbyszek, zpytela
Target Milestone: ---Keywords: Reopened
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: AcceptedBlocker
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-04-07 17:52:42 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2009537    

Description Adam Williamson (Red Hat non-Fedora) 2022-04-01 18:13:42 UTC 
When systemd-251~rc1-1.fc37 appeared in Rawhide, composes started failing because some image builds don't work, apparently due to multiple services failing to start on boot. If you grab an image from one of the failed composes that *did* build, like https://kojipkgs.fedoraproject.org//work/tasks/5054/84965054/Fedora-Workstation-Live-x86_64-Rawhide-20220331.n.0.iso , it similarly does not boot, just showing some garbled failure messages on the console that look like multiple systemd services failing to start.

releng have untagged it from Rawhide for now to get composes working again.

This is an automatic F37 Beta blocker per "Bugs which entirely prevent the composition of one or more of the release-blocking images required to be built for a currently-pending (pre-)release" - https://fedoraproject.org/wiki/QA:SOP_blocker_bug_process#Automatic_blockers
Comment 1 Kevin Fenzi 2022-04-01 18:20:27 UTC 
I think this might be due to dbus not starting? but I didn't dig too deeply. ;(
Comment 2 Adam Williamson (Red Hat non-Fedora) 2022-04-01 18:23:49 UTC 
Ah, this seems to be an SELinux issue. Booting with `enforcing=0` works, and shows all these denials:

----
time->Fri Apr  1 18:20:43 2022
type=PROCTITLE msg=audit(1648851643.954:202): proctitle="/usr/lib/systemd/systemd-userdbd"
type=SYSCALL msg=audit(1648851643.954:202): arch=c000003e syscall=257 success=yes exit=4 a0=ffffff9c a1=7ffd7fad1cb0 a2=80000 a3=0 items=0 ppid=1 pid=1089 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-userdbd" exe="/usr/lib/systemd/systemd-userdbd" subj=system_u:system_r:systemd_userdbd_t:s0 key=(null)
type=AVC msg=audit(1648851643.954:202): avc:  denied  { open } for  pid=1089 comm="systemd-userdbd" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_userdbd_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
type=AVC msg=audit(1648851643.954:202): avc:  denied  { read } for  pid=1089 comm="systemd-userdbd" name="libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_userdbd_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:20:43 2022
type=PROCTITLE msg=audit(1648851643.959:203): proctitle="/usr/lib/systemd/systemd-userdbd"
type=SYSCALL msg=audit(1648851643.959:203): arch=c000003e syscall=262 success=yes exit=0 a0=4 a1=7f58b69dfbe9 a2=7ffd7fad1d80 a3=1000 items=0 ppid=1 pid=1089 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-userdbd" exe="/usr/lib/systemd/systemd-userdbd" subj=system_u:system_r:systemd_userdbd_t:s0 key=(null)
type=AVC msg=audit(1648851643.959:203): avc:  denied  { getattr } for  pid=1089 comm="systemd-userdbd" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_userdbd_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:20:43 2022
type=PROCTITLE msg=audit(1648851643.959:204): proctitle="/usr/lib/systemd/systemd-userdbd"
type=SYSCALL msg=audit(1648851643.959:204): arch=c000003e syscall=9 success=yes exit=140018993594368 a0=0 a1=350030 a2=1 a3=802 items=0 ppid=1 pid=1089 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-userdbd" exe="/usr/lib/systemd/systemd-userdbd" subj=system_u:system_r:systemd_userdbd_t:s0 key=(null)
type=AVC msg=audit(1648851643.959:204): avc:  denied  { map } for  pid=1089 comm="systemd-userdbd" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_userdbd_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:20:43 2022
type=PROCTITLE msg=audit(1648851643.959:205): proctitle="/usr/lib/systemd/systemd-userdbd"
type=SYSCALL msg=audit(1648851643.959:205): arch=c000003e syscall=9 success=yes exit=140018994012160 a0=7f58b6666000 a1=1fa000 a2=5 a3=812 items=0 ppid=1 pid=1089 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-userdbd" exe="/usr/lib/systemd/systemd-userdbd" subj=system_u:system_r:systemd_userdbd_t:s0 key=(null)
type=AVC msg=audit(1648851643.959:205): avc:  denied  { execute } for  pid=1089 comm="systemd-userdbd" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_userdbd_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:20:44 2022
type=PROCTITLE msg=audit(1648851644.713:207): proctitle="/usr/lib/systemd/systemd-resolved"
type=SYSCALL msg=audit(1648851644.713:207): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=7ffe8a07ba20 a2=80000 a3=0 items=0 ppid=1 pid=1088 auid=4294967295 uid=193 gid=193 euid=193 suid=193 fsuid=193 egid=193 sgid=193 fsgid=193 tty=(none) ses=4294967295 comm="systemd-resolve" exe="/usr/lib/systemd/systemd-resolved" subj=system_u:system_r:systemd_resolved_t:s0 key=(null)
type=AVC msg=audit(1648851644.713:207): avc:  denied  { open } for  pid=1088 comm="systemd-resolve" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
type=AVC msg=audit(1648851644.713:207): avc:  denied  { read } for  pid=1088 comm="systemd-resolve" name="libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:20:44 2022
type=PROCTITLE msg=audit(1648851644.713:208): proctitle="/usr/lib/systemd/systemd-resolved"
type=SYSCALL msg=audit(1648851644.713:208): arch=c000003e syscall=262 success=yes exit=0 a0=3 a1=7efe43f5dbe9 a2=7ffe8a07baf0 a3=1000 items=0 ppid=1 pid=1088 auid=4294967295 uid=193 gid=193 euid=193 suid=193 fsuid=193 egid=193 sgid=193 fsgid=193 tty=(none) ses=4294967295 comm="systemd-resolve" exe="/usr/lib/systemd/systemd-resolved" subj=system_u:system_r:systemd_resolved_t:s0 key=(null)
type=AVC msg=audit(1648851644.713:208): avc:  denied  { getattr } for  pid=1088 comm="systemd-resolve" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:20:44 2022
type=PROCTITLE msg=audit(1648851644.713:209): proctitle="/usr/lib/systemd/systemd-resolved"
type=SYSCALL msg=audit(1648851644.713:209): arch=c000003e syscall=9 success=yes exit=139630521352192 a0=0 a1=350030 a2=1 a3=802 items=0 ppid=1 pid=1088 auid=4294967295 uid=193 gid=193 euid=193 suid=193 fsuid=193 egid=193 sgid=193 fsgid=193 tty=(none) ses=4294967295 comm="systemd-resolve" exe="/usr/lib/systemd/systemd-resolved" subj=system_u:system_r:systemd_resolved_t:s0 key=(null)
type=AVC msg=audit(1648851644.713:209): avc:  denied  { map } for  pid=1088 comm="systemd-resolve" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:20:44 2022
type=PROCTITLE msg=audit(1648851644.714:210): proctitle="/usr/lib/systemd/systemd-resolved"
type=SYSCALL msg=audit(1648851644.714:210): arch=c000003e syscall=9 success=yes exit=139630521769984 a0=7efe43a66000 a1=1fa000 a2=5 a3=812 items=0 ppid=1 pid=1088 auid=4294967295 uid=193 gid=193 euid=193 suid=193 fsuid=193 egid=193 sgid=193 fsgid=193 tty=(none) ses=4294967295 comm="systemd-resolve" exe="/usr/lib/systemd/systemd-resolved" subj=system_u:system_r:systemd_resolved_t:s0 key=(null)
type=AVC msg=audit(1648851644.714:210): avc:  denied  { execute } for  pid=1088 comm="systemd-resolve" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:20:47 2022
type=AVC msg=audit(1648851647.638:229): avc:  denied  { read } for  pid=1137 comm="systemd-machine" name="libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_machined_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:20:47 2022
type=AVC msg=audit(1648851647.638:230): avc:  denied  { open } for  pid=1137 comm="systemd-machine" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_machined_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:20:47 2022
type=AVC msg=audit(1648851647.638:231): avc:  denied  { getattr } for  pid=1137 comm="systemd-machine" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_machined_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:20:47 2022
type=AVC msg=audit(1648851647.638:232): avc:  denied  { map } for  pid=1137 comm="systemd-machine" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_machined_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:20:47 2022
type=AVC msg=audit(1648851647.638:233): avc:  denied  { execute } for  pid=1137 comm="systemd-machine" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_machined_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:20:47 2022
type=AVC msg=audit(1648851647.906:234): avc:  denied  { read } for  pid=1136 comm="systemd-logind" name="libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:20:47 2022
type=AVC msg=audit(1648851647.906:235): avc:  denied  { open } for  pid=1136 comm="systemd-logind" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:20:47 2022
type=AVC msg=audit(1648851647.906:236): avc:  denied  { getattr } for  pid=1136 comm="systemd-logind" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:20:47 2022
type=AVC msg=audit(1648851647.906:237): avc:  denied  { map } for  pid=1136 comm="systemd-logind" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:20:47 2022
type=AVC msg=audit(1648851647.906:238): avc:  denied  { execute } for  pid=1136 comm="systemd-logind" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:20:57 2022
type=AVC msg=audit(1648851657.633:260): avc:  denied  { read } for  pid=1228 comm="systemd-hostnam" name="libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:20:57 2022
type=AVC msg=audit(1648851657.633:261): avc:  denied  { open } for  pid=1228 comm="systemd-hostnam" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:20:57 2022
type=AVC msg=audit(1648851657.633:262): avc:  denied  { getattr } for  pid=1228 comm="systemd-hostnam" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:20:57 2022
type=AVC msg=audit(1648851657.633:263): avc:  denied  { map } for  pid=1228 comm="systemd-hostnam" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:20:57 2022
type=AVC msg=audit(1648851657.633:264): avc:  denied  { execute } for  pid=1228 comm="systemd-hostnam" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:21:12 2022
type=AVC msg=audit(1648851672.942:281): avc:  denied  { read } for  pid=1387 comm="systemctl" name="libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:NetworkManager_dispatcher_iscsid_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:21:12 2022
type=AVC msg=audit(1648851672.942:282): avc:  denied  { open } for  pid=1387 comm="systemctl" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:NetworkManager_dispatcher_iscsid_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:21:12 2022
type=AVC msg=audit(1648851672.942:283): avc:  denied  { getattr } for  pid=1387 comm="systemctl" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:NetworkManager_dispatcher_iscsid_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:21:12 2022
type=AVC msg=audit(1648851672.942:284): avc:  denied  { map } for  pid=1387 comm="systemctl" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:NetworkManager_dispatcher_iscsid_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:21:12 2022
type=AVC msg=audit(1648851672.942:285): avc:  denied  { execute } for  pid=1387 comm="systemctl" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:NetworkManager_dispatcher_iscsid_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:21:15 2022
type=AVC msg=audit(1648851675.343:295): avc:  denied  { read } for  pid=1441 comm="systemd-user-ru" name="libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:21:15 2022
type=AVC msg=audit(1648851675.343:296): avc:  denied  { open } for  pid=1441 comm="systemd-user-ru" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:21:15 2022
type=AVC msg=audit(1648851675.343:297): avc:  denied  { getattr } for  pid=1441 comm="systemd-user-ru" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:21:15 2022
type=AVC msg=audit(1648851675.343:298): avc:  denied  { map } for  pid=1441 comm="systemd-user-ru" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 18:21:15 2022
type=AVC msg=audit(1648851675.343:299): avc:  denied  { execute } for  pid=1441 comm="systemd-user-ru" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 14:21:48 2022
type=AVC msg=audit(1648837308.382:323): avc:  denied  { read } for  pid=1790 comm="systemd-hostnam" name="libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 14:21:48 2022
type=AVC msg=audit(1648837308.382:324): avc:  denied  { open } for  pid=1790 comm="systemd-hostnam" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 14:21:48 2022
type=AVC msg=audit(1648837308.383:325): avc:  denied  { getattr } for  pid=1790 comm="systemd-hostnam" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 14:21:48 2022
type=AVC msg=audit(1648837308.383:326): avc:  denied  { map } for  pid=1790 comm="systemd-hostnam" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 14:21:48 2022
type=AVC msg=audit(1648837308.383:327): avc:  denied  { execute } for  pid=1790 comm="systemd-hostnam" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 14:21:53 2022
type=AVC msg=audit(1648837313.283:335): avc:  denied  { read } for  pid=1979 comm="systemd-localed" name="libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_localed_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 14:21:53 2022
type=AVC msg=audit(1648837313.283:336): avc:  denied  { open } for  pid=1979 comm="systemd-localed" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_localed_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 14:21:53 2022
type=AVC msg=audit(1648837313.283:337): avc:  denied  { getattr } for  pid=1979 comm="systemd-localed" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_localed_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 14:21:53 2022
type=AVC msg=audit(1648837313.283:338): avc:  denied  { map } for  pid=1979 comm="systemd-localed" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_localed_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 14:21:53 2022
type=AVC msg=audit(1648837313.283:339): avc:  denied  { execute } for  pid=1979 comm="systemd-localed" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_localed_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 14:22:13 2022
type=AVC msg=audit(1648837333.771:348): avc:  denied  { read } for  pid=2302 comm="systemd-timedat" name="libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_timedated_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 14:22:13 2022
type=AVC msg=audit(1648837333.771:349): avc:  denied  { open } for  pid=2302 comm="systemd-timedat" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_timedated_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 14:22:13 2022
type=AVC msg=audit(1648837333.771:350): avc:  denied  { map } for  pid=2302 comm="systemd-timedat" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_timedated_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
----
time->Fri Apr  1 14:22:13 2022
type=AVC msg=audit(1648837333.772:351): avc:  denied  { execute } for  pid=2302 comm="systemd-timedat" path="/usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so" dev="dm-0" ino=7301 scontext=system_u:system_r:systemd_timedated_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
Comment 3 Zbigniew Jędrzejewski-Szmek 2022-04-01 18:26:53 UTC 
Apologies. I forgot to test with selinux.

Maybe it's because of the change on naming from /usr/lib/systemd/libsystemd-shared-250.so
to /usr/lib/systemd/libsystemd-shared-251-rc1-1.fc37.so ?
Comment 4 Zbigniew Jędrzejewski-Szmek 2022-04-02 09:04:55 UTC 
https://github.com/fedora-selinux/selinux-policy/pull/1128
Comment 5 Fedora Update System 2022-04-04 10:11:48 UTC 
FEDORA-2022-547b0bc17c has been submitted as an update to Fedora 37. https://bodhi.fedoraproject.org/updates/FEDORA-2022-547b0bc17c
Comment 6 Fedora Update System 2022-04-04 10:15:09 UTC 
FEDORA-2022-547b0bc17c has been pushed to the Fedora 37 stable repository.
If problem still persists, please make note of it in this bug report.
Comment 7 Zbigniew Jędrzejewski-Szmek 2022-04-04 10:17:38 UTC 
I pushed a build with some changes reverted. Hopefully this will be enough to fix the selinux denial.
Once the selinux patch is merged, I'll revert the work-around in systemd.
Comment 8 Kevin Fenzi 2022-04-06 21:28:47 UTC 
It was not enough. The compose still failed and I had to untag that build too. 

https://pagure.io/releng/failed-composes/issue/3311 is the failure with systemd-251~rc1-2.fc37

It's in anaconda calling get_nm_client() ?

https://kojipkgs.fedoraproject.org//work/tasks/2356/85212356/screenshot.ppm
Comment 9 Dan Horák 2022-04-07 06:40:14 UTC 
Yes, it is anaconda setting up the network.
Comment 10 Zdenek Pytela 2022-04-07 07:04:06 UTC 
I can't see any AVC denial with systemd-251~rc1-2.fc37.x86_64 and selinux-policy-36.6-1.fc37.noarch.
Can you give me an audit log or tell me what else is needed to have installed or configured?
Comment 11 Dan Horák 2022-04-07 15:23:03 UTC 
I suspect there is another issue. I have booted the installer from Fedora-Rawhide-20220405.n.1 with selinux=0 and it still fails. Looks to me dbus-broker gracefully finishes while it should stay running ...
Comment 12 Kevin Fenzi 2022-04-07 17:47:19 UTC 
Thanks Dan. Shall we open a new systemd bug on this issue, since this bug (the selinux denials) is solved?
Comment 13 Zbigniew Jędrzejewski-Szmek 2022-04-07 17:51:39 UTC 
I think there's an issue with symlink enablement which I need to debug. It's probably not related to selinux.
No need to file a bug, it's on my list.
Comment 14 Zbigniew Jędrzejewski-Szmek 2022-04-07 17:52:42 UTC 
I'll close this based on the understanding the the original issue is fixed.
Comment 15 Dan Horák 2022-04-07 18:17:04 UTC 
sounds like a plan, thanks :-)
Comment 16 Fedora Update System 2022-04-12 20:39:04 UTC 
FEDORA-2022-6b91a6b9db has been submitted as an update to Fedora 37. https://bodhi.fedoraproject.org/updates/FEDORA-2022-6b91a6b9db
Comment 17 Fedora Update System 2022-04-12 20:40:33 UTC 
FEDORA-2022-6b91a6b9db has been pushed to the Fedora 37 stable repository.
If problem still persists, please make note of it in this bug report.