Bug 966288

Summary: Systemd blocks service loading: Permission denied
Product: [Fedora] Fedora Reporter: Mikhail Strizhov <strizhov>
Component: systemdAssignee: systemd-maint
Status: CLOSED WONTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 18CC: johannbg, lnykryn, mschmidt, msekleta, notting, plautrba, systemd-maint, vpavlin, zbyszek
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-02-05 21:29:47 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Description Mikhail Strizhov 2013-05-22 23:39:58 UTC
Hello,

Description of problem:

Recently we found that systemd is blocking services. 

# /sbin/reboot 
Failed to issue method call: Unit reboot.target failed to load: Permission denied. See system logs and 'systemctl status reboot.target' for details.

Broadcast message from root@volga on pts/0 (Wed 2013-05-22 17:35:05 MDT):

The system is going down for reboot NOW!


 # systemctl status reboot.target
reboot.target
   Loaded: error (Reason: Permission denied)
   Active: inactive (dead)

# /sbin/shutdown -r now
Failed to issue method call: Unit reboot.target failed to load: Permission denied. See system logs and 'systemctl status reboot.target' for details.

Broadcast message from root@volga on pts/0 (Wed 2013-05-22 17:35:09 MDT):

The system is going down for reboot NOW!


 # /sbin/shutdown -h now
Failed to issue method call: Unit poweroff.target failed to load: Permission denied. See system logs and 'systemctl status poweroff.target' for details.

Broadcast message from root@volga on pts/0 (Wed 2013-05-22 17:38:37 MDT):

The system is going down for power-off NOW!

# systemctl status poweroff.target
poweroff.target
   Loaded: error (Reason: Permission denied)
   Active: inactive (dead)




Version-Release number of selected component (if applicable):

Fedora 18 Linux 3.9.2-200.fc18.x86_64


How reproducible:


Steps to Reproduce:
1. Run reboot or shutdown command
2.
3.

Actual results:

Nothing happens.

Expected results:

Reboot and shutdown

Additional info:

Here are some last messages in /var/log/messages

http://pastebin.com/FZVX3CLM

Comment 1 Zbigniew Jędrzejewski-Szmek 2013-05-23 01:05:28 UTC
What does 'ls -l /usr/lib/systemd/system/reboot.target' say?

Comment 2 Mikhail Strizhov 2013-05-23 02:37:12 UTC
 # ls -l /usr/lib/systemd/system/reboot.target
-rw-r--r--. 1 root root 493 May  7 02:57 /usr/lib/systemd/system/reboot.target

Comment 3 Michal Schmidt 2013-05-23 07:55:05 UTC
I'm guessing SELinux. The symptoms match a significantly mislabeled filesystem.

What does this say?:
ls -Z /usr/lib/systemd/system/reboot.target

Try "setenforce 0" to switch SELinux to permissive mode. If it helps, perform a full relabel of the filesystem in the next reboot.

Comment 4 Mikhail Strizhov 2013-05-23 15:00:48 UTC
Here is output:

# ls -Z /usr/lib/systemd/system/reboot.target
-rw-r--r--. root root system_u:object_r:file_t:s0      /usr/lib/systemd/system/reboot.target


 # setenforce 0
setenforce: SELinux is disabled


# cat config  | grep SELINUX

# SELINUX= can take one of these three values:
SELINUX=disabled
# SELINUXTYPE= can take one of these two values:
SELINUXTYPE=targeted 


I think this behaviour started after monday's yum update. We had following selinux update packages: 

-rw-r--r-- 1 root root   251808 May 18 11:15 selinux-policy-3.11.1-95.fc18.noarch.rpm
-rw-r--r-- 1 root root  1861052 May 18 11:17 selinux-policy-devel-3.11.1-95.fc18.noarch.rpm
-rw-r--r-- 1 root root   919848 May 18 11:19 selinux-policy-doc-3.11.1-95.fc18.noarch.rpm
-rw-r--r-- 1 root root  4102908 May 18 11:19 selinux-policy-targeted-3.11.1-95.fc18.noarch.rpm

Also, here is filesystem information:

# fdisk -l

Disk /dev/sda: 160.0 GB, 160041885696 bytes, 312581808 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xd71054eb

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1            2048    67110911    33554432   82  Linux swap / Solaris
/dev/sda2        67110912   201328639    67108864   83  Linux
/dev/sda3       201328640   312581807    55626584   83  Linux


# cat /etc/fstab 

#
# /etc/fstab
# Created by anaconda on Mon Apr 15 12:48:01 2013
#
# Accessible filesystems, by reference, are maintained under '/dev/disk'
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info
#
LABEL=/			/                       ext4    defaults        1 1
LABEL=/s/local/a	/s/volga/a           ext4    defaults        1 2
LABEL=SWAP 		swap                    swap    defaults        0 0
chopin:/fedora64-local  /usr/local  		nfs     nfsvers=3,hard,intr,bg  0 0
tmpfs			/tmp			tmpfs	defaults	0 0

The same thing happens on other 5 Fedora 18 machines.

Also, I found an odd work around for this issue:

# systemctl enable reboot.target
ln -s '/usr/lib/systemd/system/reboot.target' '/etc/systemd/system/ctrl-alt-del.target'

volga # reboot

Then machine reboots.

Comment 5 Mikhail Strizhov 2013-05-23 18:05:16 UTC
So apparently there is something related to accounts-daemon.service.

If accounts-daemon.service is enabled, all other commands are working:

# systemctl  enable accounts-daemon.service
ln -s '/usr/lib/systemd/system/accounts-daemon.service' '/etc/systemd/system/graphical.target.wants/accounts-daemon.service'

# reboot
# shutdown -h now  or  shutdown -r now

Comment 6 Fedora End Of Life 2013-12-21 13:41:00 UTC
This message is a reminder that Fedora 18 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 18. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '18'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 18's end of life.

Thank you for reporting this issue and we are sorry that we may not be 
able to fix it before Fedora 18 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior to Fedora 18's end of life.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 7 Fedora End Of Life 2014-02-05 21:29:47 UTC
Fedora 18 changed to end-of-life (EOL) status on 2014-01-14. Fedora 18 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.