Bug 2569355

Summary:	fapolicyd fails to start with file-libs 5.48: suspected compiled magic database format mismatch
Product:	[Fedora] Fedora	Reporter:	Petr Lautrbach <plautrba>
Component:	fapolicyd	Assignee:	Petr Lautrbach <plautrba>
Status:	ON_QA ---	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	44	CC:	dev, extras-qa, plautrba, rsroka, sgrubb
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:	2568044	Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2568044
Bug Blocks:

Description Petr Lautrbach 2026-11-10 09:11:25 UTC

+++ This bug was initially created as a clone of Bug #2568044 +++

On a Fedora 45 x86_64 VM, fapolicyd fails to start because it cannot load its packaged compiled magic database.

Observed November 4, 2026 with:
fapolicyd-2.0.1-1.fc45.x86_64
file-libs-5.48-3.fc45.x86_64

The failure occurred repeatedly with these installed versions.

Reproducible: Always

Steps to Reproduce:
1. Use Fedora 45 x86_64 with fapolicyd-2.0.1-1.fc45.x86_64 and file-libs-5.48-3.fc45.x86_64 installed.
2. Run: sudo systemctl start fapolicyd.service
3. Inspect: sudo journalctl -b -u fapolicyd.service --no-pager

The file-type detection failure was also reproduced independently of daemon startup using:
fapolicyd-cli --ftype /usr/bin/true
Actual Results:
The daemon checks its trust database successfully, then fails to load /usr/share/fapolicyd/fapolicyd-magic.mgc and exits.

Relevant journal messages (timestamps and hostname omitted):
Entries in trust DB: 31043
Loaded trust info from all backends (without duplicates): 31043
Trust database checks OK
Unable to load fast magic database
fapolicyd.service: Main process exited, code=exited, status=1/FAILURE
fapolicyd.service: Failed with result 'exit-code'.
Failed to start fapolicyd.service - File Access Policy Daemon.

Immediately before the magic database failure, libmagic reports invalid offsets on lines 1, 2 and 4 of /usr/share/fapolicyd/fapolicyd-magic.mgc. The first warning contains binary bytes beginning 1c 04 1e f1 14, represented here in hexadecimal for readability.

Expected Results:
The packaged magic database loads successfully, file-type inspection succeeds, and the daemon starts.

Additional Information:
rpm -V fapolicyd file-libs returned exit status 0 with no output.

A refreshed package upgrade attempt left both packages at the versions listed above, and the failure persisted.

The warning bytes appear to identify a compiled magic header with format version 20, whereas upstream file 5.48 defines format version 21:
https://github.com/file/file/blob/FILE5_48/src/file.h

This suggests a compiled database/library format mismatch; the exact packaging cause has not been confirmed.

fapolicyd 2.0.2 has not been tested.

--- Additional comment from Petr Lautrbach on 2026-11-06 13:43:06 CET ---

Are you able to reproduce it with fpaolicyd-2.0.2-1.fc45 from https://bodhi.fedoraproject.org/updates/FEDORA-2026-67d32ed434 ?

--- Additional comment from  on 2026-11-06 19:57:08 CET ---

Yes, confirmed fixed!
When will it be released to Fedora 45's stable updates repo?

Comment 1 Petr Lautrbach 2026-11-10 09:44:07 UTC

Metrics resets disabled; counters grow for daemon lifetime
Initializing the trust database
Trust database migration will be performed.
autosize: could not inspect LMDB (No such file or directory) - keeping 100 MiB
Loading rpmdb backend
Loaded files 12804
fapolicyd integrity is 0
Creating trust database
Loading trust data from rpmdb backend
Loading trust data from file backend
Trust database at 2% capacity - map will shrink automatically on next rebuild
/usr/share/fapolicyd/fapolicyd-magic.mgc, 1: Warning: offset `�' invalid
/usr/share/fapolicyd/fapolicyd-magic.mgc, 2: Warning: offset `' invalid
/usr/share/fapolicyd/fapolicyd-magic.mgc, 4: Warning: offset `

o' invalid
Unable to load fast magic database
fapolicyd.service: Main process exited, code=exited, status=1/FAILURE
fapolicyd.service: Failed with result 'exit-code'.
Failed to start fapolicyd.service - File Access Policy Daemon.


# rpm -q file fapolicyd
file-5.48-2.fc44.x86_64
fapolicyd-2.0.1-1.fc44.x86_64

Comment 2 Petr Lautrbach 2026-11-10 10:36:00 UTC

This is problem of file-5.48 update. file 5.48 bumped the compiled magic-file format version (VERSIONNO) from 20 to 21. It means that fapolicyd.mgc (file -C -m init/fapolicyd-magic) shipped in fapolicyd generated in file-5.46 is not valid anymore.

Simple rebuild will fix it.

Comment 3 Fedora Update System 2026-11-10 11:39:40 UTC

FEDORA-2026-014abf7aed (fapolicyd-2.0.1-2.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-014abf7aed

Comment 4 Steve Grubb 2026-11-10 14:09:49 UTC

I wonder if we need to set a "Requires: file-libs=5.48" so that any change in file is in sync with the build of fapolicyd?

Comment 5 Fedora Update System 2026-11-11 02:45:14 UTC

FEDORA-2026-014abf7aed has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-014abf7aed`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-014abf7aed

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.