Bug 2483872
| Summary: | cri-o failed to start after upgrade to fedora coreos 44.20260510.3.1 (stable) due to selinux issue | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Junjie Yuan <yuan> |
| Component: | cri-o1.35 | Assignee: | Brad Smith <bradley.g.smith> |
| Status: | CLOSED DUPLICATE | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 44 | CC: | bradley.g.smith, go-sig |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2026-06-02 14:06:32 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Even after restoring the SELinux context of the binary, it still fails to start. Running `setenforce 0` can temporarily work around the issue. crio selinux (default, no changed): core@k8s-gpu-worker-001:~$ ls -lZ /usr/bin/crio -rwxr-xr-x. 1 root root system_u:object_r:container_runtime_exec_t:s0 75423640 Jan 1 1970 /usr/bin/crio Thank you for the report. Please see https://bugzilla.redhat.com/show_bug.cgi?id=2477939 for more information. There is also information at https://github.com/coreos/fedora-coreos-tracker/issues/2148. *** This bug has been marked as a duplicate of bug 2477939 *** |
Description of problem: cri-o failed to start due to selinux issue, upgrade coreos to newer version (testing 44.20260523.2.1) can't resolve it. Version-Release number of selected component (if applicable): fedora coreos 44.20260510.3.1 cri-o1.35-1.35.3-1.fc44.x86_64 container-selinux-2.247.0-1.fc44.noarch How reproducible: Steps to Reproduce: 1. systemctl enable --now crio 2. upgrade fedora core from previous version 3. crio failed to start Actual results: crio failed to start due to selinux issue Expected results: crio running Additional info: selinux: time->Tue Jun 2 02:58:34 2026 type=AVC msg=audit(1780369114.463:4115): avc: denied { execmem } for pid=33265 comm="crio" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=0 ---- time->Tue Jun 2 02:58:44 2026 type=AVC msg=audit(1780369124.712:4121): avc: denied { execmem } for pid=33305 comm="crio" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=0 ---- time->Tue Jun 2 02:58:54 2026 type=AVC msg=audit(1780369134.962:4127): avc: denied { execmem } for pid=33354 comm="crio" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=0 ---- time->Tue Jun 2 02:59:05 2026 type=AVC msg=audit(1780369145.212:4131): avc: denied { execmem } for pid=33392 comm="crio" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=0 crio log: Jun 02 02:57:02 k8s-gpu-worker-001 systemd[1]: crio.service: Scheduled restart job, restart counter is at 695. Jun 02 02:57:02 k8s-gpu-worker-001 systemd[1]: Starting crio.service - Container Runtime Interface for OCI (CRI-O)... Jun 02 02:57:02 k8s-gpu-worker-001 (crio)[32879]: crio.service: Referenced but unset environment variable evaluates to an empty string: CRIO_CONFIG_OPTIONS, CRIO_METRICS_OPTIONS, CRIO_NETWORK_OPTIONS, CRIO_RUNTIME_OPTIONS, CRIO_STORAGE_OPTIONS Jun 02 02:57:02 k8s-gpu-worker-001 crio[32879]: /usr/bin/crio: error while loading shared libraries: cannot make segment writable for relocation: Permission denied Jun 02 02:57:02 k8s-gpu-worker-001 systemd[1]: crio.service: Main process exited, code=exited, status=127/n/a Jun 02 02:57:02 k8s-gpu-worker-001 systemd[1]: crio.service: Failed with result 'exit-code'. Jun 02 02:57:02 k8s-gpu-worker-001 systemd[1]: Failed to start crio.service - Container Runtime Interface for OCI (CRI-O).