Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
I upgraded my RHEL Edge 9.0 box to 9.1 box, and it dropped of the network due wireguard not starting the tunnel.
RHEL 9.1:
------
Mar 03 09:50:14 apu.localnet wg-quick[9067]: [#] ip link add cool-lab type wireguard
Mar 03 09:50:14 apu.localnet wg-quick[9067]: [#] wg setconf cool-lab /dev/fd/63
Mar 03 09:50:14 apu.localnet wg-quick[9067]: [#] ip -4 address add 10.254.251.102 dev cool-lab
Mar 03 09:50:14 apu.localnet wg-quick[9067]: [#] ip link set mtu 1420 up dev cool-lab
Mar 03 09:50:14 apu.localnet wg-quick[9089]: [#] resolvconf -a cool-lab -m 0 -x
Mar 03 09:50:14 apu.localnet wg-quick[9091]: sd_bus_open_system: Permission denied
Mar 03 09:50:14 apu.localnet wg-quick[9067]: [#] ip link delete dev cool-lab
Mar 03 09:50:14 apu.localnet systemd[1]: wg-quick: Main process exited, code=exited, status=1/FAILURE
------
RHEL 9.0:
------
Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] ip link add cool-lab type wireguard
Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] wg setconf cool-lab /dev/fd/63
Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] ip -4 address add 10.254.251.100 dev cool-lab
Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] ip link set mtu 1420 up dev cool-lab
Mar 03 09:45:48 dell-edge wg-quick[1257]: [#] resolvconf -a cool-lab -m 0 -x
Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] ip -4 route add 10.128.4.0/24 dev cool-lab
Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] ip -4 route add 10.128.3.0/24 dev cool-lab
Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] ip -4 route add 10.128.2.0/24 dev cool-lab
Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] ip -4 route add 10.128.1.0/24 dev cool-lab
Mar 03 09:45:48 dell-edge systemd[1]: Finished WireGuard via wg-quick(8) for cool/lab.
------
Version-Release number of selected component (if applicable):
wireguard-tools-1.0.20210424-3.el9.x86_64
How reproducible:
I had it working fine (still do on another box) on 9.0. I did build new image in fleet management at c.rh.c and upgraded the box.
Steps to Reproduce:
1. install rhel9.0 edge
2. configure wireguard tunnel
3. upgrade to rhel 9.1
Might do the same directly on RHEL9.1, I have not tried.
Actual results:
While starting with systectl wireguard does not have permissions to use systemd-resolved. It fails with such error message. Looking at selinux troubles, there are several. I tried fixing them but it still fails to something:
I used this while trying to go around the problem:
--------------
set the boolean: domain_can_write_kmsg 1
[coolboy@apu ~]$ cat resolve.te
module resolve 1.0;
require {
type syslogd_var_run_t;
type wireguard_t;
type system_dbusd_var_run_t;
class dir search;
}
#============= wireguard_t ==============
allow wireguard_t syslogd_var_run_t:dir search;
allow wireguard_t system_dbusd_var_run_t:dir search;
--------------
Now selinux doesn't complain:
--------------
[coolboy@apu ~]$ sudo ausearch -c 'resolvconf' --raw| grep -v kmsg| audit2allow
#============= wireguard_t ==============
#!!!! This avc is allowed in the current policy
allow wireguard_t syslogd_var_run_t:dir search;
allow wireguard_t syslogd_var_run_t:sock_file write;
#!!!! This avc is allowed in the current policy
allow wireguard_t system_dbusd_var_run_t:dir search;
allow wireguard_t system_dbusd_var_run_t:sock_file write;
-----------
Expected results:
Tunnel to come up after upgrade and reboot.
Additional info:
The tunnel works if I just do
-----------
sudo wg-quick up cool-lab
-----------
It's just systemctl or nmcli that fails with it.
Description of problem: I upgraded my RHEL Edge 9.0 box to 9.1 box, and it dropped of the network due wireguard not starting the tunnel. RHEL 9.1: ------ Mar 03 09:50:14 apu.localnet wg-quick[9067]: [#] ip link add cool-lab type wireguard Mar 03 09:50:14 apu.localnet wg-quick[9067]: [#] wg setconf cool-lab /dev/fd/63 Mar 03 09:50:14 apu.localnet wg-quick[9067]: [#] ip -4 address add 10.254.251.102 dev cool-lab Mar 03 09:50:14 apu.localnet wg-quick[9067]: [#] ip link set mtu 1420 up dev cool-lab Mar 03 09:50:14 apu.localnet wg-quick[9089]: [#] resolvconf -a cool-lab -m 0 -x Mar 03 09:50:14 apu.localnet wg-quick[9091]: sd_bus_open_system: Permission denied Mar 03 09:50:14 apu.localnet wg-quick[9067]: [#] ip link delete dev cool-lab Mar 03 09:50:14 apu.localnet systemd[1]: wg-quick: Main process exited, code=exited, status=1/FAILURE ------ RHEL 9.0: ------ Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] ip link add cool-lab type wireguard Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] wg setconf cool-lab /dev/fd/63 Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] ip -4 address add 10.254.251.100 dev cool-lab Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] ip link set mtu 1420 up dev cool-lab Mar 03 09:45:48 dell-edge wg-quick[1257]: [#] resolvconf -a cool-lab -m 0 -x Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] ip -4 route add 10.128.4.0/24 dev cool-lab Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] ip -4 route add 10.128.3.0/24 dev cool-lab Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] ip -4 route add 10.128.2.0/24 dev cool-lab Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] ip -4 route add 10.128.1.0/24 dev cool-lab Mar 03 09:45:48 dell-edge systemd[1]: Finished WireGuard via wg-quick(8) for cool/lab. ------ Version-Release number of selected component (if applicable): wireguard-tools-1.0.20210424-3.el9.x86_64 How reproducible: I had it working fine (still do on another box) on 9.0. I did build new image in fleet management at c.rh.c and upgraded the box. Steps to Reproduce: 1. install rhel9.0 edge 2. configure wireguard tunnel 3. upgrade to rhel 9.1 Might do the same directly on RHEL9.1, I have not tried. Actual results: While starting with systectl wireguard does not have permissions to use systemd-resolved. It fails with such error message. Looking at selinux troubles, there are several. I tried fixing them but it still fails to something: I used this while trying to go around the problem: -------------- set the boolean: domain_can_write_kmsg 1 [coolboy@apu ~]$ cat resolve.te module resolve 1.0; require { type syslogd_var_run_t; type wireguard_t; type system_dbusd_var_run_t; class dir search; } #============= wireguard_t ============== allow wireguard_t syslogd_var_run_t:dir search; allow wireguard_t system_dbusd_var_run_t:dir search; -------------- Now selinux doesn't complain: -------------- [coolboy@apu ~]$ sudo ausearch -c 'resolvconf' --raw| grep -v kmsg| audit2allow #============= wireguard_t ============== #!!!! This avc is allowed in the current policy allow wireguard_t syslogd_var_run_t:dir search; allow wireguard_t syslogd_var_run_t:sock_file write; #!!!! This avc is allowed in the current policy allow wireguard_t system_dbusd_var_run_t:dir search; allow wireguard_t system_dbusd_var_run_t:sock_file write; ----------- Expected results: Tunnel to come up after upgrade and reboot. Additional info: The tunnel works if I just do ----------- sudo wg-quick up cool-lab ----------- It's just systemctl or nmcli that fails with it.