Bug 1712935 - Cascade of issues since systemd 420 when SELinux enforcing
Summary: Cascade of issues since systemd 420 when SELinux enforcing
Keywords:
Status: CLOSED DEFERRED
Alias: None
Product: Fedora
Classification: Fedora
Component: systemd
Version: 30
Hardware: x86_64
OS: Unspecified
unspecified
urgent
Target Milestone: ---
Assignee: systemd-maint
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On: 1467103 1714026
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-05-22 14:06 UTC by Michal Schorm
Modified: 2019-08-05 20:46 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-08-05 20:46:45 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Michal Schorm 2019-05-22 14:06:50 UTC
First error message in journal:
  "... systemd[509]: dbus-broker.service: Failed to set up mount namespacing: Permission denied"
  "... systemd[509]: dbus-broker.service: Failed at step NAMESPACE spawning /usr/bin/dbus-broker-launch: Permission denied"

Since that, dozens of error messgaes apperas, leading to many parts of the system not functional.
For example networking. Which is kinda bad on a system you are accessing via ssh.

---------

Steps to reporoduce:

1) Get perfectly working fresh Fedora 30 installation.
   set up by e.g. this script: https://raw.githubusercontent.com/FaramosCZ/Fedora_from_scratch/MBR_EXT4/setup.sh
2) Update systemd packages to version >= 240
3) Leave SELinux Enforcing at system startup
4) reboot
5) watch your system in ruins

Fast workaround:
1) Disable SELinux enforcing at system startup
   in /etc/selinux/config
... but that's not what you want to do on a real system you want ot use.

OR

2) Downgrade systemd packaged to version <240

---------

You can google several other issues with the same error message in other environments and distros.
https://github.com/systemd/systemd/issues/10032
Not sure though, if they are connected.

I've tried to updating to latest rawhide to see if the issue is solved in systmed or selinux-policy-targeted, but it beahve the same.

Comment 1 Michal Schorm 2019-05-28 12:16:47 UTC
UPDATE:
  this is caused by bug: https://bugzilla.redhat.com/show_bug.cgi?id=1412696
  comment 35 provides a workaround.

Still, it needs to be solved.

Comment 2 Zbigniew Jędrzejewski-Szmek 2019-08-05 20:46:45 UTC
Let's close this one. #1467103 remains open, so we can track things there.


Note You need to log in before you can comment on or make changes to this bug.