Bug 2489103

systemd-bless-boot-generator is confined:

f45# ls -lZ /usr/lib/systemd/system-generators/systemd-bless-boot-generator
-rwxr-xr-x. 1 root root system_u:object_r:systemd_bless_boot_generator_exec_t:s0 11512 Jun 27 02:00 /usr/lib/systemd/system-generators/systemd-bless-boot-generator

Your system is either mislabeled or contains old policy.

Thanks for your reply Zdenek; I've built a fresh image today from rawhide and still see the same behavior, even though the file is indeed labeled as you say. Perhaps the execution context has something to do with it (the executable is ran by a systemd service, when I run it manually it *does* work).

See here for some versions/more log output:

```
# dnf list --installed | grep policy
policycoreutils.x86_64                   3.11-1.fc45                             <unknown>
selinux-policy.noarch                    45.9-1.fc45                             <unknown>
selinux-policy-targeted.noarch           45.9-1.fc45                             <unknown>

# systemctl status systemd-bless-boot.service
× systemd-bless-boot.service - Mark the Current Boot Loader Entry as Good
     Loaded: loaded (/usr/lib/systemd/system/systemd-bless-boot.service; enabled-runtime; preset: disabled)
    Drop-In: /usr/lib/systemd/system/service.d
             └─10-timeout-abort.conf
     Active: failed (Result: exit-code) since Mon 2026-07-20 14:52:49 UTC; 2min 7s ago
 Invocation: 3c5a516454474ecf8e00370ab0e8d9ca
       Docs: man:systemd-bless-boot.service(8)
    Process: 622 ExecStart=/usr/lib/systemd/systemd-bless-boot good (code=exited, status=1/FAILURE)
   Main PID: 622 (code=exited, status=1/FAILURE)
   Mem peak: 1.6M
        CPU: 7ms

Jul 20 14:52:49 teamsbc systemd[1]: Starting systemd-bless-boot.service - Mark the Current Boot Loader Entry as Good...
Jul 20 14:52:49 teamsbc systemd-bless-boot[622]: Failed to rename '/loader/entries/teamsbc-7.2.0-0.rc3.260715g58717b2a1365.29.fc45.x86_64+2-1.conf' to '/loader/entries/teamsbc-7.2.0-0.rc3.260715g58717b2a1365.29.fc45.x86_64.conf': Permission denied
Jul 20 14:52:49 teamsbc systemd[1]: systemd-bless-boot.service: Main process exited, code=exited, status=1/FAILURE
Jul 20 14:52:49 teamsbc systemd[1]: systemd-bless-boot.service: Failed with result 'exit-code'.
Jul 20 14:52:49 teamsbc systemd[1]: Failed to start systemd-bless-boot.service - Mark the Current Boot Loader Entry as Good.

# systemctl restart systemd-bless-boot.service
Job for systemd-bless-boot.service failed because the control process exited with error code.
See "systemctl status systemd-bless-boot.service" and "journalctl -xeu systemd-bless-boot.service" for details.

# grep systemd-bless-boot /var/log/audit/audit.log 
type=SERVICE_START msg=audit(1784559357.508:182): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-bless-boot comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'UID="root" AUID="unset"

# ls -lZ /usr/lib/systemd/system-generators/systemd-bless-boot-generator 
-rwxr-xr-x. 1 root root system_u:object_r:systemd_bless_boot_generator_exec_t:s0 11512 Jun 27 00:00 /usr/lib/systemd/system-generators/systemd-bless-boot-generator
```
```

Sorry, the audit.log grep was incomplete since the process name is abbreviated, here are both lines (the same denial as before):

```
# grep systemd-bless /var/log/audit/audit.log 
type=AVC msg=audit(1784559357.507:181): avc:  denied  { rename } for  pid=1003 comm="systemd-bless-b" name="teamsbc-7.2.0-0.rc3.260715g58717b2a1365.29.fc45.x86_64+2-1.conf" dev="sda1" ino=7 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=file permissive=0
type=SERVICE_START msg=audit(1784559357.508:182): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-bless-boot comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'UID="root" AUID="unset"
```

I am sorry, I misunderstood it was the generator, probably mislead by comm="systemd-bless-b"
This is another case:

f45# ls -lZ /usr/lib/systemd/systemd-bless-boot 
-rwxr-xr-x. 1 root root system_u:object_r:init_exec_t:s0 29168 Jun 27 02:00 /usr/lib/systemd/systemd-bless-boot

Can you set the system into permissive mode and gather all denials?

Even better if it can be reproduced by
setenforce 0
systemctl daemon-reload

additional denials can be audited:
https://fedoraproject.org/wiki/SELinux/Debugging#Enable_full_auditing

Hey Zdenek, when I set the system to permissive mode during the build of the image and boot it I only get one denial which is the same as already shown here :)

``
# ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today
type=AVC msg=AUDIT(07/27/26 05:16:25.856:76) : avc: denied { rename } for pid=658 comm=systemd-bless-b name=teamsbc-7.2.0-0.rc4.260725g0ce37745d4bf.39.fc45.x86_64+2-1.conf dev="sda1" ino=7 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=file permissive=1
```

I saw a related bugzilla (for a different systemd service that wants to rename files on the ESP) popped up as well: https://bugzilla.redhat.com/show_bug.cgi?id=2507393 the denial there is the same but through a different service.

This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.