Bug 1573010 - SELinux prevented systemd from setting up /dev/net/tun at boot
Summary: SELinux prevented systemd from setting up /dev/net/tun at boot
Keywords:
Status: CLOSED EOL
Alias: None
Product: Fedora
Classification: Fedora
Component: systemd
Version: 29
Hardware: All
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: systemd-maint
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-04-29 18:44 UTC by Randy Barlow
Modified: 2019-11-27 22:37 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-11-27 22:37:42 UTC
Type: Bug


Attachments (Terms of Use)

Description Randy Barlow 2018-04-29 18:44:04 UTC
Description of problem:
I updated my Rawhide box today and after boot I noticed that none of my libvirt guests had started. When I tried to start them by hand, I got an error message about /dev/net/tun missing.

Tom Huges helped me with some debugging in #fedora-devel and we found some errors logged by systemd-tmpfiles-setup-dev.service:

-- Logs begin at Tue 2016-07-19 14:49:01 EDT, end at Sun 2018-04-29 14:41:34 EDT. --
Apr 29 12:12:06 host.example.com systemd[1]: Stopped Create Static Device Nodes in /dev.
-- Reboot --
Apr 29 12:22:51 host.example.com systemd[1]: Stopped Create Static Device Nodes in /dev.
Apr 29 12:22:52 host.example.com systemd[1]: Starting Create Static Device Nodes in /dev...
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: /etc/selinux/targeted/contexts/files/file_contexts: has invalid context system_u:object_r:fuse_device_t:s0
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: /etc/selinux/targeted/contexts/files/file_contexts: has invalid context system_u:object_r:lvm_control_t:s0
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: /etc/selinux/targeted/contexts/files/file_contexts: has invalid context system_u:object_r:loop_control_device_t:s0
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: /etc/selinux/targeted/contexts/files/file_contexts: has invalid context system_u:object_r:device_t:s0
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: /etc/selinux/targeted/contexts/files/file_contexts: has invalid context system_u:object_r:tun_tap_device_t:s0
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: /etc/selinux/targeted/contexts/files/file_contexts: has invalid context system_u:object_r:ppp_device_t:s0
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: /etc/selinux/targeted/contexts/files/file_contexts: has invalid context system_u:object_r:event_device_t:s0
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: /etc/selinux/targeted/contexts/files/file_contexts: has invalid context system_u:object_r:uhid_device_t:s0
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: /etc/selinux/targeted/contexts/files/file_contexts: has invalid context system_u:object_r:device_t:s0
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: /etc/selinux/targeted/contexts/files/file_contexts: has invalid context system_u:object_r:vfio_device_t:s0
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: /etc/selinux/targeted/contexts/files/file_contexts: has invalid context system_u:object_r:vhost_device_t:s0
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Unable to fix SELinux security context of /dev/fuse: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: /etc/selinux/targeted/contexts/files/file_contexts: has invalid context system_u:object_r:vhost_device_t:s0
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: /etc/selinux/targeted/contexts/files/file_contexts: has invalid context system_u:object_r:device_t:s0
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: /etc/selinux/targeted/contexts/files/file_contexts: has invalid context system_u:object_r:sound_device_t:s0
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: /etc/selinux/targeted/contexts/files/file_contexts: has invalid context system_u:object_r:device_t:s0
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: /etc/selinux/targeted/contexts/files/file_contexts: has invalid context system_u:object_r:sound_device_t:s0
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to determine SELinux security context for /dev/btrfs-control: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Unable to fix SELinux security context of /dev/btrfs-control: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to determine SELinux security context for /dev/loop-control: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Unable to fix SELinux security context of /dev/loop-control: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to determine SELinux security context for /dev/net: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to create directory or subvolume "/dev/net": Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to determine SELinux security context for /dev: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to determine SELinux security context for /dev/net/tun: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to create device node /dev/net/tun: No such file or directory
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to determine SELinux security context for /dev/ppp: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Unable to fix SELinux security context of /dev/ppp: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to determine SELinux security context for /dev/uinput: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Unable to fix SELinux security context of /dev/uinput: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to determine SELinux security context for /dev/uhid: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Unable to fix SELinux security context of /dev/uhid: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to determine SELinux security context for /dev/vfio: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to create directory or subvolume "/dev/vfio": Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to determine SELinux security context for /dev: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to determine SELinux security context for /dev/vfio/vfio: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to create device node /dev/vfio/vfio: No such file or directory
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to determine SELinux security context for /dev/vhci: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Unable to fix SELinux security context of /dev/vhci: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to determine SELinux security context for /dev/vhost-net: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Unable to fix SELinux security context of /dev/vhost-net: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to determine SELinux security context for /dev/vhost-vsock: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Unable to fix SELinux security context of /dev/vhost-vsock: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to determine SELinux security context for /dev/snd: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to create directory or subvolume "/dev/snd": Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to determine SELinux security context for /dev/snd: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to create directory or subvolume "/dev/snd": Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to determine SELinux security context for /dev: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to determine SELinux security context for /dev/snd/timer: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to create device node /dev/snd/timer: No such file or directory
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to determine SELinux security context for /dev: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to determine SELinux security context for /dev/snd/seq: Permission denied
Apr 29 12:22:53 host.example.com systemd-tmpfiles[798]: Failed to create device node /dev/snd/seq: No such file or directory
Apr 29 12:22:53 host.example.com systemd[1]: systemd-tmpfiles-setup-dev.service: Main process exited, code=exited, status=1/FAILURE
Apr 29 12:22:53 host.example.com systemd[1]: systemd-tmpfiles-setup-dev.service: Failed with result 'exit-code'.
Apr 29 12:22:53 host.example.com systemd[1]: Failed to start Create Static Device Nodes in /dev.

I'm not sure whether this should be filed against systemd or selinux, so feel free to refile as appropriate.


Version-Release number of selected component (if applicable):
selinux-policy-3.14.2-14.fc29.noarch
selinux-policy-targeted-3.14.2-14.fc29.noarch
systemd-udev-238-7.fc29.1.x86_64


Additional info:
I was able to work around this issue by running modprobe tun.

Comment 1 Orion Poplawski 2018-05-03 17:20:48 UTC
Same here.  Re-assigning to selinux to at least bring them into the conversation.

May 03 11:09:22 vmrawhide.cora.nwra.com systemd-tmpfiles[403]: /etc/selinux/targeted/contexts/files/file_contexts: has invalid context system_u:object_r:printer_device_t:s0
May 03 11:09:22 vmrawhide.cora.nwra.com systemd-tmpfiles[403]: /etc/selinux/targeted/contexts/files/file_contexts: has invalid context system_u:object_r:fuse_device_t:s0
...

Comment 2 Orion Poplawski 2018-05-03 17:21:47 UTC
May 03 11:09:12 vmrawhide.cora.nwra.com systemd-tmpfiles[403]: Failed to determine SELinux security context for /dev/lp0: Permission denied

Comment 3 Jan Kurik 2018-08-14 10:56:33 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 29 development cycle.
Changing version to '29'.

Comment 4 Orion Poplawski 2019-02-14 21:45:57 UTC
Sorry, pretty sure this is systemd.  I *think* this might be related to the sphinx package incorrectly creating the following directories:

/usr/lib/tmpfiles.d/lib/sphinx
/usr/lib/tmpfiles.d/log/sphinx
/usr/lib/tmpfiles.d/run/sphinx

and that massively confusing systemd-tmpfiles.  But I'm not sure.  Removing those and rebuilding the initramfs has not helped for me.  Currently this situation is preventing dbus from starting and the whole boot failing because /run/dbus isn't created.

Comment 5 Orion Poplawski 2019-02-14 22:24:32 UTC
Cleared up my dbus/boot issue by enabling dbus-broker.  But still have lots of tmpfiles errors:

Feb 14 15:22:11 vmrawhide.cora.nwra.com systemd-tmpfiles[453]: /etc/selinux/targeted/contexts/files/file_contexts: has invalid context system_u:object_r:printer_device_t:s0
Feb 14 15:22:11 vmrawhide.cora.nwra.com systemd-tmpfiles[453]: /etc/selinux/targeted/contexts/files/file_contexts: has invalid context system_u:object_r:fuse_device_t:s0
Feb 14 15:22:11 vmrawhide.cora.nwra.com systemd-tmpfiles[453]: /etc/selinux/targeted/contexts/files/file_contexts: has invalid context system_u:object_r:lvm_control_t:s0
Feb 14 15:22:11 vmrawhide.cora.nwra.com systemd-tmpfiles[453]: /etc/selinux/targeted/contexts/files/file_contexts: has invalid context system_u:object_r:loop_control_device_t:s0
....
Feb 14 15:22:08 vmrawhide.cora.nwra.com systemd-tmpfiles[453]: Failed to determine SELinux security context for /dev/lp0: Permission denied
Feb 14 15:22:08 vmrawhide.cora.nwra.com systemd-tmpfiles[453]: Unable to fix SELinux security context of /dev/lp0: Permission denied
Feb 14 15:22:08 vmrawhide.cora.nwra.com systemd-tmpfiles[453]: Failed to determine SELinux security context for /dev/lp1: Permission denied
Feb 14 15:22:08 vmrawhide.cora.nwra.com systemd-tmpfiles[453]: Unable to fix SELinux security context of /dev/lp1: Permission denied

Comment 6 Ben Cotton 2019-10-31 19:14:42 UTC
This message is a reminder that Fedora 29 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora 29 on 2019-11-26.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
Fedora 'version' of '29'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 29 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 7 Ben Cotton 2019-11-27 22:37:42 UTC
Fedora 29 changed to end-of-life (EOL) status on 2019-11-26. Fedora 29 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.


Note You need to log in before you can comment on or make changes to this bug.