Bug 2541402

its starts in permissive mode:

# getenforce 
Permissive
[root@ip-172-31-29-11 ~]# systemctl stop systemd-imds-early-network.service
[root@ip-172-31-29-11 ~]# systemctl start systemd-imds-early-network.service
[root@ip-172-31-29-11 ~]# systemctl status systemd-imds-early-network.service
● systemd-imds-early-network.service - Enable Pre-IMDS Networking
     Loaded: loaded (/usr/lib/systemd/system/systemd-imds-early-network.service; enabled-runtime; preset: disabled)
    Drop-In: /usr/lib/systemd/system/service.d
             └─10-timeout-abort.conf
             /run/systemd/generator.early/systemd-imds-early-network.service.d
             └─50-dmi-id.conf
     Active: active (exited) since Fri 2026-09-25 12:59:28 UTC; 6s ago
 Invocation: 8ed7b32600a2416a8282a9a27643ad4b
       Docs: man:systemd-imdsd@.service(8)
    Process: 3324 ExecStart=/usr/lib/systemd/systemd-imdsd --setup-network (code=exited, status=0/SUCCESS)
   Main PID: 3324 (code=exited, status=0/SUCCESS)
   Mem peak: 2M
        CPU: 11ms

Proposed as a Blocker for 45-final by Fedora user psklenar using the blocker tracking app because:

 after system is started , one  service is not started:

Last login: Fri Sep 25 13:10:28 2026 from 3.15.154.109
[systemd]
Failed Units: 1
  systemd-imds-early-network.service

I believed its a blocker due to:
https://fedoraproject.org/wiki/Fedora_45_Final_Release_Criteria#System_services

AI note:

The IMDS feature was introduced in systemd 261.

Upstream systemd v261 release notes (NEWS), 2026-06-19 - the "IMDS
subsystem" section documents systemd-imdsd, systemd-imds and the
systemd-imds-early-network / generator that pull the service into boot
when a supported cloud is detected:
  https://github.com/systemd/systemd/releases/tag/v261

systemd 260 does not ship these files; systemd 261 is the first that does.
selinux-policy has no rules for this feature yet, so the service fails
under SELinux Enforcing.

Thanks for reporting. Confining a new service takes months and we unfortunately don't have test coverage.
Moreover, the service seems not to be enabled by default so I don't think it qualifies for a blocker.

(In reply to Zdenek Pytela from comment #4)
> Moreover, the service seems not to be enabled by default ...

It seems that 'systemd-imds-generator' recognizes cloud, and starts systemd-imds-early-network.
In other words its default at each cloud (amazon-ec2, Azure, ...)

(In reply to Petr Sklenar from comment #5)
> (In reply to Zdenek Pytela from comment #4)
> > Moreover, the service seems not to be enabled by default ...
> 
> It seems that 'systemd-imds-generator' recognizes cloud, and starts
> systemd-imds-early-network.
> In other words its default at each cloud (amazon-ec2, Azure, ...)

OK, taking back. The first part keeps being valid - the report came too late for full service confinement, so I don't think it is reasonable to block the release.

If you still have the system at hand, can you boot the system in permissive mode and gather all denials?

Well, we don't have to write a new policy to address the blocker, necessarily. We could also simply disable the service by default. Presumably it doesn't do anything anyway since it's blocked by SELinux, so disabling it shouldn't make anything worse?

Let's CC zbyszsek for his opinion.

Created attachment 2158678 [details]
journalctl -b

journalctl -b > journalctl-b

The AVCs can be find in journalctl-b.

The denials happen in early boot - systemd-imds-early-network.service runs
in sysinit.target, before auditd is ready to write. So 'ausearch' dont find such a denials

(In reply to Petr Sklenar from comment #8)
during SELINUX=permissive in /etc/selinux/config

Discussed in 2026-09-28 blocker review meeting: https://meetbot-raw.fedoraproject.org//blocker-review_matrix_fedoraproject-org/2026-09-28/f45-blocker-review.2026-09-28-16.00.html . This is accepted as a blocker as a violation of final criterion "All system services present after installation with one of the release-blocking package sets must start properly, unless they require hardware which is not present". We note that disabling the service by default would be an acceptable resolution; if that's the only practical option, the bug should be re-assigned to systemd.

FEDORA-2026-430ec11225 (systemd-262-3.fc46) has been submitted as an update to Fedora 46.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-430ec11225

FEDORA-2026-e3388d1568 (systemd-262-3.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-e3388d1568

Eventually, the SELinux policy will need to be updated too. Do we need a separate bugzilla to track this?

Thanks for the quick fix!

yes,  I'll open a separate BZ for selinux-policy.

+could you please reassign this Bugzilla to the systemd component?

Great. (FWIW, anybody can reassign.)

(In reply to Zbigniew Jędrzejewski-Szmek from comment #15)
> Great. (FWIW, anybody can reassign.)
I see ...

thanks

filled Bug 2543273 - AVC denial: systemd-imds-early-network.service fails at boot with AVC denials

FEDORA-2026-430ec11225 (systemd-262-3.fc46) has been pushed to the Fedora 46 stable repository.
If problem still persists, please make note of it in this bug report.

FEDORA-2026-e3388d1568 has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-e3388d1568`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-e3388d1568

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

FEDORA-2026-e3388d1568 (systemd-262-3.fc45) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.