Description of problem: FreeIPA installer is having trouble because setsebool is failing to set SELinux booleans. Version-Release number of selected component (if applicable): policycoreutils-2.7-14.fc28.x86_64 selinux-policy-3.14.1-13.fc28.noarch How reproducible: always Steps to Reproduce: 1. setsebool -P httpd_can_network_connect=on Actual results: # setsebool -P httpd_can_network_connect=on httpd_manage_ipa=on httpd_run_ipa=on httpd_dbus_sssd=on libsepol.context_from_record: type conntrackd_var_run_t is not defined libsepol.context_from_record: could not create context structure libsepol.context_from_string: could not create context structure libsepol.sepol_context_to_sid: could not convert system_u:object_r:conntrackd_var_run_t:s0 to sid invalid context system_u:object_r:conntrackd_var_run_t:s0 Expected results: No error Additional info: Related FreeIPA upstream bug: https://pagure.io/freeipa/issue/7448
Both setsebool and dnf install freeipa-server work for me on update Fedora-Cloud-Base-28-20180310 image. Lukas, any idea?
I forgot to mention that the machine has been upgraded from F27 to F28. The FreeIPA error occurs during ipa-server-install with latest build from git master. Fedora 28 has freeipa-server 4.6.3, which is broken. According to seinfo, the type is available: # seinfo -t | grep conntrackd_var_run_t conntrackd_var_run_t Despite the error, setsebool seems to flip the switches just fine: # getsebool httpd_can_network_connect httpd_can_network_connect --> off # setsebool -P httpd_can_network_connect=on libsepol.context_from_record: type conntrackd_var_run_t is not defined libsepol.context_from_record: could not create context structure libsepol.context_from_string: could not create context structure libsepol.sepol_context_to_sid: could not convert system_u:object_r:conntrackd_var_run_t:s0 to sid invalid context system_u:object_r:conntrackd_var_run_t:s0 # getsebool httpd_can_network_connect httpd_can_network_connect --> on
I would figure it is no longer available in your image store so it can not be recompiled.
Christian, Moving this ticket to POST state, we have more issues with upgrading from F27 to F28, it should be in updates-testing repos for both F27 and F28 soon.
*** This bug has been marked as a duplicate of bug 1559174 ***