Description of problem: I installed a copy of Fedora "server" 30 with Xen 4.11.1 installed. When I reboot to start the system with the Xen kernel the machine will begin to start up as normal. When I try to login to the console I have a huge lag between entering the username and password. Once I get into the machine I check the log since I saw services fail at startup. The one in question was xenstored, but I also saw issues with sssd, fprintd, Network Manager, and systemd-hostnamed. The issue related to xenstored seems to be causing a cascading failure of services at startup but I am unsure why the others depend on Xen for anything. When I try to use XL to do a query "XL list" the system hangs and waits forever. I timed it at 10 minutes before I gave up and hit CTRL-C. After a little poking around I tried switching SELinux to permissive mode and rebooting since the services would still not start when using setenforce 0. After rebooting I already noticed a huge difference. Before there was a noticeable lag in the login prompt on the console. That issue is gone, the network interfaces are starting up right away compared to before. Basically its as if the machine was back to normal. When I login I am able to check for failed services with systemctl, it reports none. I then try XL and run "XL list". When I do so system returns the list of running VMs to me which in my case is just Dom-0, not other VMs are installed yet. Version-Release number of selected component (if applicable): Fedora 30 Server Edition Xen-4.11.1-5 How reproducible: Until I disabled / permissive SELinux at startup the issue can reproduces 100% Steps to Reproduce: 1. Install Xen 2. Try XL list, console should hang indefinitely. 3. Disable SELinux or set to permissive, reboot and repeat step 2. Actual results: Expected results: Additional info: I am running with Systemd-Boot instead of GRUB2 and I am also using the Xen EFI Binary if that matters.
Logged denials when running in permissive mode (Fedora 31 rather than Fedora 31): Dec 19 19:47:37 dom0 audit[583]: AVC avc: denied { getattr } for pid=583 comm="launch-xenstore" path="/usr/bin/systemd-notify" dev="sda4" ino=116135727 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:systemd_notify_exec_t:s0 tclass=file permissive=1 Dec 19 19:47:37 dom0 audit[583]: AVC avc: denied { execute } for pid=583 comm="launch-xenstore" name="systemd-notify" dev="sda4" ino=116135727 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:systemd_notify_exec_t:s0 tclass=file permissive=1 Dec 19 19:47:37 dom0 audit[583]: AVC avc: denied { read } for pid=583 comm="launch-xenstore" name="systemd-notify" dev="sda4" ino=116135727 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:systemd_notify_exec_t:s0 tclass=file permissive=1 Dec 19 19:47:37 dom0 audit[593]: AVC avc: denied { open } for pid=593 comm="launch-xenstore" path="/usr/bin/systemd-notify" dev="sda4" ino=116135727 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:systemd_notify_exec_t:s0 tclass=file permissive=1 Dec 19 19:47:37 dom0 audit[593]: AVC avc: denied { execute_no_trans } for pid=593 comm="launch-xenstore" path="/usr/bin/systemd-notify" dev="sda4" ino=116135727 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:systemd_notify_exec_t:s0 tclass=file permissive=1 Dec 19 19:47:38 dom0 audit[593]: AVC avc: denied { map } for pid=593 comm="systemd-notify" path="/usr/bin/systemd-notify" dev="sda4" ino=116135727 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:systemd_notify_exec_t:s0 tclass=file permissive=1 Dec 19 19:47:38 dom0 audit[592]: AVC avc: denied { map } for pid=592 comm="xenstored" path="/proc/xen/xsd_kva" dev="xenfs" ino=5 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:xenfs_t:s0 tclass=file permissive=1 Dec 19 19:47:38 dom0 audit[593]: AVC avc: denied { read } for pid=593 comm="systemd-notify" name="environ" dev="proc" ino=3634 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file permissive=1 Dec 19 19:47:38 dom0 audit[593]: AVC avc: denied { open } for pid=593 comm="systemd-notify" path="/proc/1/environ" dev="proc" ino=3634 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file permissive=1 Dec 19 19:47:38 dom0 audit[593]: AVC avc: denied { getattr } for pid=593 comm="systemd-notify" path="/proc/1/environ" dev="proc" ino=3634 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file permissive=1 Dec 19 19:47:38 dom0 audit[593]: AVC avc: denied { ioctl } for pid=593 comm="systemd-notify" path="/proc/1/environ" dev="proc" ino=3634 ioctlcmd=0x5401 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file permissive=1 Dec 19 19:47:38 dom0 audit[593]: AVC avc: denied { read } for pid=593 comm="systemd-notify" name="cmdline" dev="proc" ino=4026532221 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file permissive=1 Dec 19 19:47:38 dom0 audit[593]: AVC avc: denied { open } for pid=593 comm="systemd-notify" path="/proc/cmdline" dev="proc" ino=4026532221 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file permissive=1 Dec 19 19:47:38 dom0 audit[593]: AVC avc: denied { getattr } for pid=593 comm="systemd-notify" path="/proc/cmdline" dev="proc" ino=4026532221 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file permissive=1 Dec 19 19:47:38 dom0 audit[593]: AVC avc: denied { ioctl } for pid=593 comm="systemd-notify" path="/proc/cmdline" dev="proc" ino=4026532221 ioctlcmd=0x5401 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file permissive=1 Dec 19 19:47:41 dom0 audit[603]: AVC avc: denied { remount } for pid=603 comm="(modprobe)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:xenstored_var_lib_t:s0 tclass=filesystem permissive=1 Dec 19 19:47:42 dom0 audit[656]: AVC avc: denied { remount } for pid=656 comm="(ostnamed)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:xenstored_var_lib_t:s0 tclass=filesystem permissive=1
This message is a reminder that Fedora 30 is nearing its end of life. Fedora will stop maintaining and issuing updates for Fedora 30 on 2020-05-26. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '30'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 30 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete.
Fedora 30 changed to end-of-life (EOL) status on 2020-05-26. Fedora 30 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed.
This bug appears to have been reported against 'rawhide' during the Fedora 33 development cycle. Changing version to 33.
Here are the latest denials, captured while running Fedora 33: Dec 24 10:30:35 mimic.flyn.org audit[606]: AVC avc: denied { getattr } for pid=606 comm="launch-xenstore" path="/usr/bin/systemd-notify" dev="sda3" ino=18592 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:systemd_notify_exec_t:s0 tclass=file permissive=1 Dec 24 10:30:35 mimic.flyn.org audit[606]: AVC avc: denied { execute } for pid=606 comm="launch-xenstore" name="systemd-notify" dev="sda3" ino=18592 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:systemd_notify_exec_t:s0 tclass=file permissive=1 Dec 24 10:30:35 mimic.flyn.org audit[606]: AVC avc: denied { read } for pid=606 comm="launch-xenstore" name="systemd-notify" dev="sda3" ino=18592 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:systemd_notify_exec_t:s0 tclass=file permissive=1 Dec 24 10:30:35 mimic.flyn.org audit[615]: AVC avc: denied { open } for pid=615 comm="launch-xenstore" path="/usr/bin/systemd-notify" dev="sda3" ino=18592 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:systemd_notify_exec_t:s0 tclass=file permissive=1 Dec 24 10:30:35 mimic.flyn.org audit[615]: AVC avc: denied { execute_no_trans } for pid=615 comm="launch-xenstore" path="/usr/bin/systemd-notify" dev="sda3" ino=18592 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:systemd_notify_exec_t:s0 tclass=file permissive=1 Dec 24 10:30:35 mimic.flyn.org audit[615]: AVC avc: denied { map } for pid=615 comm="systemd-notify" path="/usr/bin/systemd-notify" dev="sda3" ino=18592 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:systemd_notify_exec_t:s0 tclass=file permissive=1 Dec 24 10:30:35 mimic.flyn.org audit[615]: AVC avc: denied { read } for pid=615 comm="systemd-notify" name="environ" dev="proc" ino=304 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file permissive=1 Dec 24 10:30:35 mimic.flyn.org audit[615]: AVC avc: denied { open } for pid=615 comm="systemd-notify" path="/proc/1/environ" dev="proc" ino=304 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file permissive=1 Dec 24 10:30:35 mimic.flyn.org audit[615]: AVC avc: denied { getattr } for pid=615 comm="systemd-notify" path="/proc/1/environ" dev="proc" ino=304 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file permissive=1 Dec 24 10:30:35 mimic.flyn.org audit[615]: AVC avc: denied { ioctl } for pid=615 comm="systemd-notify" path="/proc/1/environ" dev="proc" ino=304 ioctlcmd=0x5401 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file permissive=1 Dec 24 10:30:35 mimic.flyn.org audit[615]: AVC avc: denied { read } for pid=615 comm="systemd-notify" name="cmdline" dev="proc" ino=4026532477 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file permissive=1 Dec 24 10:30:35 mimic.flyn.org audit[615]: AVC avc: denied { open } for pid=615 comm="systemd-notify" path="/proc/cmdline" dev="proc" ino=4026532477 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file permissive=1 Dec 24 10:30:35 mimic.flyn.org audit[615]: AVC avc: denied { getattr } for pid=615 comm="systemd-notify" path="/proc/cmdline" dev="proc" ino=4026532477 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file permissive=1 Dec 24 10:30:35 mimic.flyn.org audit[615]: AVC avc: denied { ioctl } for pid=615 comm="systemd-notify" path="/proc/cmdline" dev="proc" ino=4026532477 ioctlcmd=0x5401 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file permissive=1 Dec 24 10:30:35 mimic.flyn.org audit[614]: AVC avc: denied { map } for pid=614 comm="xenstored" path="/proc/xen/xsd_kva" dev="xenfs" ino=5 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:xenfs_t:s0 tclass=file permissive=1 Dec 24 10:30:35 mimic.flyn.org audit[624]: AVC avc: denied { remount } for pid=624 comm="(d-logind)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:xenstored_var_lib_t:s0 tclass=filesystem permissive=1 Dec 24 10:32:00 mimic.flyn.org audit[2734]: AVC avc: denied { remount } for pid=2734 comm="(-userdbd)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:xenstored_var_lib_t:s0 tclass=filesystem permissive=1 Dec 24 10:32:00 mimic.flyn.org audit[2752]: AVC avc: denied { remount } for pid=2752 comm="(ostnamed)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:xenstored_var_lib_t:s0 tclass=filesystem permissive=1 Dec 24 10:35:27 mimic.flyn.org audit[3384]: AVC avc: denied { remount } for pid=3384 comm="(ostnamed)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:xenstored_var_lib_t:s0 tclass=filesystem permissive=1 Dec 24 10:37:55 mimic.flyn.org audit[3451]: AVC avc: denied { remount } for pid=3451 comm="(ostnamed)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:xenstored_var_lib_t:s0 tclass=filesystem permissive=1 Dec 24 10:45:29 mimic.flyn.org audit[3492]: AVC avc: denied { remount } for pid=3492 comm="(ostnamed)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:xenstored_var_lib_t:s0 tclass=filesystem permissive=1 Dec 25 07:25:27 mimic.flyn.org audit[4728]: AVC avc: denied { remount } for pid=4728 comm="(ostnamed)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:xenstored_var_lib_t:s0 tclass=filesystem permissive=1 Dec 26 10:55:38 mimic.flyn.org audit[6344]: AVC avc: denied { remount } for pid=6344 comm="(ostnamed)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:xenstored_var_lib_t:s0 tclass=filesystem permissive=1 Dec 28 01:11:50 mimic.flyn.org audit[8630]: AVC avc: denied { remount } for pid=8630 comm="(ostnamed)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:xenstored_var_lib_t:s0 tclass=filesystem permissive=1 Dec 29 19:13:46 mimic.flyn.org audit[11096]: AVC avc: denied { remount } for pid=11096 comm="(ostnamed)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:xenstored_var_lib_t:s0 tclass=filesystem permissive=1 Dec 30 15:31:56 mimic.flyn.org audit[13197]: AVC avc: denied { remount } for pid=13197 comm="(ostnamed)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:xenstored_var_lib_t:s0 tclass=filesystem permissive=1 Dec 30 17:20:49 mimic.flyn.org audit[13312]: AVC avc: denied { remount } for pid=13312 comm="(ostnamed)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:xenstored_var_lib_t:s0 tclass=filesystem permissive=1
On Fedora 34, running "setsebool -P domain_can_mmap_files=true" seems to fix the problem with xenstored malfunctioning when SELinux is enforcing its policy. Ian, can you try this on your install?
This message is a reminder that Fedora 33 is nearing its end of life. Fedora will stop maintaining and issuing updates for Fedora 33 on 2021-11-30. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '33'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 33 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete.
Fedora 33 changed to end-of-life (EOL) status on 2021-11-30. Fedora 33 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed.