RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 2041262 - system_u:object_r:ipa_var_run_t:s0 for /run/ipa: Invalid argument
Summary: system_u:object_r:ipa_var_run_t:s0 for /run/ipa: Invalid argument
Keywords:
Status: CLOSED DUPLICATE of bug 2042911
Alias: None
Product: Red Hat Enterprise Linux 9
Classification: Red Hat
Component: selinux-policy
Version: CentOS Stream
Hardware: x86_64
OS: Linux
high
urgent
Target Milestone: rc
: ---
Assignee: Zdenek Pytela
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-01-16 21:01 UTC by lejeczek
Modified: 2022-07-07 09:51 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-01-21 14:54:22 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHELPLAN-108246 0 None None None 2022-01-16 21:02:16 UTC

Description lejeczek 2022-01-16 21:01:38 UTC 
Description of problem:

latest update(s):

selinux-policy-34.1.22-1.el9.noarch

brake freeIPA

-> $ systemctl status -l systemd-tmpfiles-setup | cat
● systemd-tmpfiles-setup.service - Create Volatile Files and Directories
     Loaded: loaded (/usr/lib/systemd/system/systemd-tmpfiles-setup.service; static)
     Active: active (exited) since Sun 2022-01-16 20:44:37 GMT; 13min ago
       Docs: man:tmpfiles.d(5)
             man:systemd-tmpfiles(8)
    Process: 2581 ExecStart=systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev (code=exited, status=73)
   Main PID: 2581 (code=exited, status=73)
        CPU: 34ms

Jan 16 20:44:37 swir.mine.private systemd[1]: Starting Create Volatile Files and Directories...
Jan 16 20:44:37 swir.mine.private systemd-tmpfiles[2581]: Failed to set SELinux security context system_u:object_r:ipa_var_run_t:s0 for /run/ipa: Invalid argument
Jan 16 20:44:37 swir.mine.private systemd-tmpfiles[2581]: Failed to create directory or subvolume "/run/ipa": Invalid argument
Jan 16 20:44:37 swir.mine.private systemd-tmpfiles[2581]: Failed to set SELinux security context system_u:object_r:ipa_var_run_t:s0 for /run/ipa: Invalid argument
Jan 16 20:44:37 swir.mine.private systemd-tmpfiles[2581]: Failed to validate path /run/ipa/ccaches: No such file or directory
Jan 16 20:44:37 swir.mine.private systemd[1]: Finished Create Volatile Files and Directories.


-> $ systemctl status -l ipa | cat
× ipa.service - Identity, Policy, Audit
     Loaded: loaded (/usr/lib/systemd/system/ipa.service; enabled; vendor preset: disabled)
     Active: failed (Result: exit-code) since Sun 2022-01-16 20:44:46 GMT; 16min ago
    Process: 2900 ExecStart=/usr/sbin/ipactl start (code=exited, status=1/FAILURE)
   Main PID: 2900 (code=exited, status=1/FAILURE)
        CPU: 1.823s

Jan 16 20:44:38 swir.mine.private systemd[1]: Starting Identity, Policy, Audit...
Jan 16 20:44:46 swir.mine.private ipactl[2900]: Failed to start Directory Service: [Errno 2] No such file or directory: '/run/ipa/services.list'
Jan 16 20:44:46 swir.mine.private ipactl[2900]: Starting Directory Service
Jan 16 20:44:46 swir.mine.private systemd[1]: ipa.service: Main process exited, code=exited, status=1/FAILURE
Jan 16 20:44:46 swir.mine.private systemd[1]: ipa.service: Failed with result 'exit-code'.
Jan 16 20:44:46 swir.mine.private systemd[1]: Failed to start Identity, Policy, Audit.
Jan 16 20:44:46 swir.mine.private systemd[1]: ipa.service: Consumed 1.823s CPU time.


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:
Comment 1 lejeczek 2022-01-18 12:03:42 UTC 
Hmm.
this?:

-> $ rpm -iv --force ipa-selinux-4.9.8-1.el9.noarch.rpm
Verifying packages...
Preparing packages...
ipa-selinux-4.9.8-1.el9.noarch
Failed to resolve allow statement at /var/lib/selinux/targeted/tmp/modules/400/openvswitch-custom/cil:74
Failed to resolve AST
/usr/sbin/semodule:  Failed!
uavc:  op=load_policy lsm=selinux seqno=3 res=1

but, is it good that SELinux allows such "race hazard"... hmm.

"work-around":
-> $ dnf remove openvswitch
Comment 2 Zdenek Pytela 2022-01-21 14:54:22 UTC 
I am afraid this is an unfortunate result of removing the lockdown class in RHEL 9. It should only be a temporary issue until openvswitch-selinux-extra-policy is updated.

Disabling the module could possibly help, too:

  # semodule -d openvswitch-custom

*** This bug has been marked as a duplicate of bug 2042911 ***
Note You need to log in before you can comment on or make changes to this bug.