Bug 2211935
| Summary: | BIND won't start after upgrade from Fedora 36 to Fedora 37 or 38 | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | D. Hugh Redelmeier <hugh> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED CANTFIX | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 38 | CC: | dwalsh, hugh, lvrabec, mmalik, nknazeko, omosnacek, pkoncity, vmojzis, zpytela |
| Target Milestone: | --- | Keywords: | Triaged |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-06-09 20:50:59 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
D. Hugh Redelmeier
2023-06-02 16:02:53 UTC
I've just installed a fresh F36 system, the named_write_master_zones boolean is turned on. After an update to F38 there is no change. $ rpm -qa bind* bind-license-9.18.15-1.fc38.noarch bind-libs-9.18.15-1.fc38.x86_64 bind-utils-9.18.15-1.fc38.x86_64 bind-dnssec-utils-9.18.15-1.fc38.x86_64 bind-9.18.15-1.fc38.x86_64 bind-chroot-9.18.15-1.fc38.x86_64 Was your system's first installation earlier? I think that Fedora was first installed on my machine in January 2021. From that, I deduce that it must have been Fedora 31. I don't remember the upgrade steps. At least one other time it was a two-version step. The named_write_master_zones tunable default value changed to on in 2018, so any system installed after that should have it turned on. Were there any customizations made on your system prior the update? # semanage export # semanage export boolean -D login -D interface -D user -D port -D node -D fcontext -D module -D ibendport -D ibpkey -D permissive -D boolean -m -1 named_write_master_zones boolean -m -1 virt_sandbox_use_all_caps boolean -m -1 virt_use_nfs # (In reply to D. Hugh Redelmeier from comment #4) > boolean -m -1 named_write_master_zones Since turning this boolean on is required, I suppose this is the state after manually running setsebool. yes, #4 reflected the state after the boolean was manually set. I don't have access to the state before I manually set the boolean. On a numerous tests, no problem appeared during testing F37->F38 upgrade. I've just tried F31->F33->F35->F37->F38 update and did not encounter any issue. If I understand this correctly, such a problem may appear on system installed more than 6 years ago, or when some related customization was made. (In reply to Zdenek Pytela from comment #7) > On a numerous tests, no problem appeared during testing F37->F38 upgrade. > I've just tried F31->F33->F35->F37->F38 update and did not encounter any > issue. > > If I understand this correctly, such a problem may appear on system > installed more than 6 years ago, or when some related customization was made. Thanks for trying to replicate. The problem is solved for me. I guess there is no need to put more effort into this. Close this if you wish to. This BZ may be useful for others that do stumble into this problem. Agree it is good we have this bz reported and the issue hopefully is isolated. There is the solution already mentioned by setroubleshoot, so should not be much of a problem. One thing though is that I don't see what other help we could provide in these cases, the other is have it confirmed. You mentioned "it must have been Fedora 31", is it possible it actually was F29 or earlier? (In reply to Zdenek Pytela from comment #9) > Agree it is good we have this bz reported and the issue hopefully is > isolated. There is the solution already mentioned by setroubleshoot, so > should not be much of a problem. One thing though is that I don't see what > other help we could provide in these cases, the other is have it confirmed. > You mentioned "it must have been Fedora 31", is it possible it actually was > F29 or earlier? BIND was working fine before I did an upgrade from F36 -> F38 via DNF. Since the problem was observed by Jim Hood after an upgrade from F36 -> F37, I inferred that the problem was in that step. My system was moderately customized by me to act as a gateway (router, DNS server, mail server, etc.) for my home. But I probably had not customized SELinux since I don't really know how to do that with finesse. (In reply to D. Hugh Redelmeier from comment #10) > BIND was working fine before I did an upgrade from F36 -> F38 via DNF. I looked more closely at the logs to check that what I said was precisely correct. BIND was working through the end of F36 on my machine. It worked after the final updates in preparation to the version upgrade. BIND failed on the first boot of F38. Given the current state of investigation, I am going to close this bz. If any new related information appears, feel free to reopen it or create a new one. |