Hide Forgot
Unfortunately, anyone using a version of RHELAH before 7.2.7 is going to encounter this problem when upgrading to 7.3. The only advice we can give to customers is to disable SELinux during the upgrade and then re-enable it after it completes. See the BZ in the See Also field for more info - https://bugzilla.redhat.com/show_bug.cgi?id=1340542
Do you see any SELinux denials? # ausearch -m avc -m selinux_err -i -ts today
There are several workarounds: 1) setenforce 0 atomic host upgrade 2) systemctl stop rpm-ostreed cp /usr/libexec/rpm-ostreed /usr/local/bin/rpm-ostreed chcon -t install_exec_t /usr/local/bin/rpm-ostreed /usr/local/bin/rpm-ostreed & atomic host upgrade 3) atomic host deploy 7.2.7 && systemctl reboot atomic host upgrade
(In reply to Milos Malik from comment #5) > Do you see any SELinux denials? > > # ausearch -m avc -m selinux_err -i -ts today Milos, there is no audit package is shipped in RHELAH, I will install it w/ unlock mode if need.
(In reply to Alex Jia from comment #7) > (In reply to Milos Malik from comment #5) > > Do you see any SELinux denials? > > > > # ausearch -m avc -m selinux_err -i -ts today > > Milos, there is no audit package is shipped in RHELAH, I will install it w/ > unlock mode if need. But the SELinux doesn't work well w/ overlay filesystem.
(In reply to Alex Jia from comment #7) > (In reply to Milos Malik from comment #5) > > Do you see any SELinux denials? > > > > # ausearch -m avc -m selinux_err -i -ts today > > Milos, there is no audit package is shipped in RHELAH, I will install it w/ > unlock mode if need. [cloud-user@atomic-host-001 ~]$ sudo ausearch -m avc -m selinux_err -i -ts today ---- type=SYSCALL msg=audit(09/21/2016 16:31:03.170:500) : arch=x86_64 syscall=fsetxattr success=no exit=EINVAL(Invalid argument) a0=0x31 a1=0x7f5ef5012f51 a2=0x7f5ef5012f62 a3=0x32 items=0 ppid=1 pid=13210 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=pool exe=/usr/libexec/rpm-ostreed subj=system_u:system_r:unconfined_service_t:s0 key=(null) type=SELINUX_ERR msg=audit(09/21/2016 16:31:03.170:500) : op=setxattr invalid_context=system_u:object_r:systemd_machined_unit_file_t:s0 type=AVC msg=audit(09/21/2016 16:31:03.170:500) : avc: denied { mac_admin } for pid=13210 comm=pool capability=mac_admin scontext=system_u:system_r:unconfined_service_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=capability2
The backported fix to 'selinux-policy' which was shipped in 7.2.7 will fix this error. See https://bugzilla.redhat.com/show_bug.cgi?id=1372792 Customers not using the 7.2.7 release will have to use one of the workarounds described in the Doc Text field.
*** Bug 1393994 has been marked as a duplicate of this bug. ***