Bug 2461399
| Summary: | NetworkManager Strongswan VPN connection fails with "Failure creating the temporary file" if not "All users may connect to this network" | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | imma <Immanuel.Hartung> |
| Component: | NetworkManager | Assignee: | Lubomir Rintel <lkundrak> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 44 | CC: | alekcejk, bgalvani, chkr, ffmancera, ihuguet, jmcahier, jvaclav, lkundrak, mclasen, opensource, rstrode, tikkanen, vbenes |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | NetworkManager-1.58~rc1-1.fc45 | Doc Type: | --- |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2026-07-03 22:45:37 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
imma
2026-04-24 09:39:29 UTC
This message is a reminder that Fedora Linux 42 is nearing its end of life. Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a 'version' of '42'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, change the 'version' to a later Fedora Linux version. Note that the version field may be hidden. Click the "Show advanced fields" button if you do not see it. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora Linux 42 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora Linux, you are encouraged to change the 'version' to a later version prior to this bug being closed. (In reply to Fedora Release Engineering from comment #1) > This message is a reminder that Fedora Linux 42 is nearing its end of life. > Fedora will stop maintaining and issuing updates for Fedora Linux 42 on > 2026-05-13. > It is Fedora's policy to close all bug reports from releases that are no > longer > maintained. At that time this bug will be closed as EOL if it remains open > with a > 'version' of '42'. > The very same bug exists in F44 and I guess it is due CVE-2025-9615 bug fix in strongswan. I had a look at the problem and created a bug report upstream: https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/work_items/1957 The VPN connection fails, if the connection is configured just for a single user. One workaround is to enable "Make available to other users" in the VPN settings. However, according to https://discussion.fedoraproject.org/t/upgrade-from-f43-to-f44-broke-strongswan-vpn/190397 there might be an additional problem related to SELinux. So far, I didn't had the change to test that yet. I had the same problem after upgrading to Fedora 44.
VPN: IPsec/IKEv2 (StrongSwan)
22 May 09:54:03 ** charon-nm[64857] : 05[CFG] received initiate for NetworkManager connection ***
22 May 09:54:03 ** NetworkManager[41667] : <warn> [17..4] vpn[0x5..50,828..6a7,‘***’] : failed to connect : 'Failure creating the temporary file'
Solution:
- 1: move the "server > certificate" file to a location accessible to everyone
- 2: enable ‘Make available to other users’
And that's it!
I tested the strongswan plugin with SELinux: a) having "Make available to other users" disabled - the file system access in /run/NetworkManager/cert is indeed blocked by SELinux - I created https://bugzilla.redhat.com/show_bug.cgi?id=2481246 b) having "Make available to other users" enabled - as noted in comment #4, it is necessary to put the certificate file into a location accessible for everyone (or at least to the user root (e.g. via file ACLs), since the strongswan plugin runs as root but without the CAP_DAC_OVERRIDE capability) - if SELinux is enabled, then the file needs to have one of the cert-specific SELinux contexts (e.g. cert_t or home_cert_t), typically automatically set when the files is copied in one of the standard certificate directories FEDORA-2026-564f8cdd1e (NetworkManager-1.57.4~dev-3.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-564f8cdd1e FEDORA-2026-c78cbf0bf9 (NetworkManager-1.56.1-2.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-c78cbf0bf9 FEDORA-2026-c78cbf0bf9 has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-c78cbf0bf9` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-c78cbf0bf9 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2026-c78cbf0bf9 (NetworkManager-1.56.1-2.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-2026-1b99e62c51 (NetworkManager-1.58~rc1-1.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-1b99e62c51 FEDORA-2026-1b99e62c51 (NetworkManager-1.58~rc1-1.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report. |