Bug 2481404

Summary:	systemd-udevd not linked against libseccomp despite +SECCOMP build flag
Product:	[Fedora] Fedora	Reporter:	Uros Bizjak <ubizjak>
Component:	systemd	Assignee:	systemd-maint
Status:	CLOSED DUPLICATE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	44	CC:	daan.j.demeyer, fedoraproject, frantisek, lnykryn, msekleta, suraj.ghimire7, systemd-maint, vmihalko, yuwatana, zbyszek
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-05-26 09:12:32 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Uros Bizjak 2026-05-26 08:56:16 UTC

Description of problem:

systemd 259 (259.5-1.fc44) reports +SECCOMP in its build flags, but 
systemd-udevd and libsystemd-shared are not actually linked against 
libseccomp, causing the following warning at boot:

  systemd[1]: /usr/lib/systemd/system/systemd-udevd.service:56: System 
  call bpf cannot be resolved as libseccomp is not available, ignoring: 
  Operation not supported

Version-Release number of selected component (if applicable):

systemd 259 (259.5-1.fc44)
+PAM +AUDIT +SELINUX -APPARMOR +IMA +IPE +SMACK +SECCOMP -GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK +BTF +XKBCOMMON +UTMP +SYSVINIT +LIBARCHIVE

How reproducible:

Always.

Steps to Reproduce:

1. Boot Fedora 44 with libseccomp installed
2. Check dmesg or journalctl -b for the warning above

Actual results:

systemd-udevd silently skips syscall filters with a boot warning, 
reducing the intended security hardening.

Expected results:

systemd-udevd should be linked against libseccomp and syscall filtering 
should work as intended.

Additional info:

$ ldd /usr/lib/systemd/systemd-udevd | grep seccomp
(no output)

$ ldd /usr/lib64/systemd/libsystemd-shared-259.5-1.fc44.so | grep seccomp
(no output)

$ dnf list libseccomp
libseccomp.x86_64 2.6.0-3.fc44  (installed)

libseccomp is installed but systemd-udevd is not linked against it, 
meaning udevd runs without the intended seccomp syscall filtering 
despite the +SECCOMP build flag claiming otherwise.

Comment 1 Frantisek Sumsal 2026-05-26 09:12:15 UTC

This is expected - systemd/udev now uses dlopen() for libseccomp (and others) instead of direct linking. The actual issue is that libseccomp is now not pulled in into initrd which causes the warning - this is tracked in https://bugzilla.redhat.com/show_bug.cgi?id=2463540.

Comment 2 Frantisek Sumsal 2026-05-26 09:12:32 UTC


*** This bug has been marked as a duplicate of bug 2463540 ***