Sorry, there is a mistake on my previous comment on the path of the file created when reproducing this issue:

		~~~
		# cat << EOF > /etc/systemd/system/var-mnt-backup.mount
		[Unit]
		Before=remote-fs.target
		[Mount]
		What=nfsserver:/opt/nfsshare
		Where=/var/mnt/backup
		Type=nfs
		[Install]
		WantedBy=remote-fs.target
		EOF
		~~~

Just a hunch: does it work with selinux turned to permissive mode (setenforce 0)?

mount(8) can do it for you but have to use "-o X-mount.mkdir" (it means Options=X-mount.mkdir in the systemd unit file).

@David, I have just checked and also fails (doesn't create the this) with selinux disabled.

@Karel, it works fine on RHEL8 using 'Options=X-mount.mkdir', but it worked without this option on RHEL7 and according systemd.mount doc, destination directory should be created [1]:


---------------------------------------------------------------
	Where=
	Takes an absolute path of a file or directory for the mount point; in particular, the destination cannot be a symbolic link. If the mount point does not exist at the time of mounting, it is created as directory. This string must be reflected in the unit filename. (See above.) This option is mandatory.

	Mount units must be named after the mount point directories they control. Example: the mount point /home/lennart must be configured in a unit file home-lennart.mount.

	https://www.freedesktop.org/software/systemd/man/systemd.mount.html

---------------------------------------------------------------


Regards

Could we get strace of systemd during start of the mount unit? I.e., run

# strace -p 1 -o mount.log -e trace=%file &
# systemctl start var-mnt-backup.mount

and attach mount.log here.

@David, sorry, disregard my previous comment, I did my test immediately after doing 'setenforce 0' and it didn't work, but today I see it works, so it's a selinux issue.

On the other hand, on RHEL7 selinux is also enabled and it's working there:

I attach audit.log entries:

=======================================================
type=USER_AVC msg=audit(1591100038.941:586): pid=570 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  received setenforce notice (enforcing=1)  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'UID="dbus" AUID="unset" SAUID="dbus"
type=USER_AVC msg=audit(1591100048.560:587): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  received setenforce notice (enforcing=1)  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'UID="root" AUID="unset" SAUID="root"
type=AVC msg=audit(1591100048.577:588): avc:  denied  { create } for  pid=1 comm="systemd" name="mnt" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir permissive=0
type=SERVICE_START msg=audit(1591100762.118:589): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=dnf-makecache comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"
type=SERVICE_STOP msg=audit(1591100762.118:590): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=dnf-makecache comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"
======================================================

Yeah, it's selinux. systemd would have to be allowed to create directories all over the filesystem, instead of just a few selected places like /mnt.

Maria,

What is the selinux-policy package version you use? I cannot reproduce it, systemd creates the directory; moreover it seems to be a duplicate of bz#1778126, already resolved for RHEL 8.2.

# rpm -qa "selinux-policy*"
selinux-policy-targeted-3.14.3-44.el8.noarch
selinux-policy-3.14.3-44.el8.noarch

# sesearch -A -s init_t -t var_t -c dir -p create
allow init_t var_t:dir { add_name create getattr ioctl lock open read relabelfrom relabelto remove_name search setattr write };

Hi Zdenek,

I was checking on RHEL 8.0 with the following 'selinux-policy' packages:

 selinux-policy-3.14.1-61.el8.noarch
 selinux-policy-targeted-3.14.1-61.el8.noarch

After checking this in RHEL 8.2 with: 
 selinux-policy-targeted-3.14.3-41.el8_2.2.noarch
 selinux-policy-3.14.3-41.el8_2.2.noarch

I can see that systemd mounts work fine with selinux in enforced mode.

Any idea if this will be backported?

Maria,

There were no plans for supporting 8.0 z-streams. For more details, refer to:
https://access.redhat.com/support/policy/updates/errata/

For this particular use case, we can provide the following workaround:

  # cat local_init_var_write.cil
(allow init_t var_t (dir (add_name create getattr ioctl lock open read relabelfrom relabelto remove_name search setattr write)))
  # semodule -i local_init_var_write.cil

Closing CURRENTRELEASE as this bug has been fixed.