On Fedora IoT 38 and 39, when attempting to run the bitcoin-core server, it's unable to start due to being denied access to `/etc/bitcoin/bitcoin.conf`. Reproducible: Always Steps to Reproduce: 1. `sudo rpm-ostree install bitcoin-core-server bitcoin-core-selinux bitcoin-core-utils` 2. `sudo systemctl reboot` 3. `sudo cp /usr/share/doc/bitcoin-core-server/bitcoin.conf.example /etc/bitcoin/bitcoin.conf` 4. `sudo systemctl start bitcoin.service` Actual Results: The bitcoin service fails to start. The log shows the following error message. ``` Error reading configuration file: specified config file "/etc/bitcoin/bitcoin.conf" could not be opened. ``` Additionally, `sudo ausearch -c 'bitcoin'` returns the following messages: ``` time->Wed Oct 25 22:06:07 2023 type=AVC msg=audit(1698289567.600:697): avc: denied { nnp_transition } for pid=8237 comm="(bitcoind)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:bitcoin_t:s0 tclass=process2 permissive=0 ---- time->Wed Oct 25 22:06:07 2023 type=AVC msg=audit(1698289567.733:699): avc: denied { read } for pid=8237 comm="bitcoind" name="bitcoin.conf" dev="mmcblk0p3" ino=253222 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:bitcoin_conf_t:s0 tclass=file permissive=0 ---- time->Wed Oct 25 22:06:08 2023 type=AVC msg=audit(1698289568.118:706): avc: denied { nnp_transition } for pid=8244 comm="(bitcoind)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:bitcoin_t:s0 tclass=process2 permissive=0 ---- time->Wed Oct 25 22:06:08 2023 type=AVC msg=audit(1698289568.249:708): avc: denied { read } for pid=8244 comm="bitcoind" name="bitcoin.conf" dev="mmcblk0p3" ino=253222 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:bitcoin_conf_t:s0 tclass=file permissive=0 ---- time->Wed Oct 25 22:06:08 2023 type=AVC msg=audit(1698289568.612:715): avc: denied { nnp_transition } for pid=8255 comm="(bitcoind)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:bitcoin_t:s0 tclass=process2 permissive=0 ---- time->Wed Oct 25 22:06:08 2023 type=AVC msg=audit(1698289568.740:717): avc: denied { read } for pid=8255 comm="bitcoind" name="bitcoin.conf" dev="mmcblk0p3" ino=253222 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:bitcoin_conf_t:s0 tclass=file permissive=0 ---- time->Wed Oct 25 22:06:09 2023 type=AVC msg=audit(1698289569.097:724): avc: denied { nnp_transition } for pid=8289 comm="(bitcoind)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:bitcoin_t:s0 tclass=process2 permissive=0 ---- time->Wed Oct 25 22:06:09 2023 type=AVC msg=audit(1698289569.224:726): avc: denied { read } for pid=8289 comm="bitcoind" name="bitcoin.conf" dev="mmcblk0p3" ino=253222 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:bitcoin_conf_t:s0 tclass=file permissive=0 ---- time->Wed Oct 25 22:06:09 2023 type=AVC msg=audit(1698289569.607:733): avc: denied { nnp_transition } for pid=8292 comm="(bitcoind)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:bitcoin_t:s0 tclass=process2 permissive=0 ---- time->Wed Oct 25 22:06:09 2023 type=AVC msg=audit(1698289569.738:735): avc: denied { read } for pid=8292 comm="bitcoind" name="bitcoin.conf" dev="mmcblk0p3" ino=253222 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:bitcoin_conf_t:s0 tclass=file permissive=0 ``` Expected Results: The bitcoin service should be able to read `/etc/bitcoin/bitcoin.conf` and start. I've followed the instructions at https://docs.fedoraproject.org/en-US/fedora-silverblue/troubleshooting/#_selinux_problems to ensure the SELinux policy is correct, but this did not fix the problem.
FEDORA-2023-889e5b5801 has been submitted as an update to Fedora 39. https://bodhi.fedoraproject.org/updates/FEDORA-2023-889e5b5801
FEDORA-2023-4c176d2b0a has been submitted as an update to Fedora 37. https://bodhi.fedoraproject.org/updates/FEDORA-2023-4c176d2b0a
FEDORA-2023-de859441ea has been submitted as an update to Fedora 38. https://bodhi.fedoraproject.org/updates/FEDORA-2023-de859441ea
FEDORA-EPEL-2023-9285d6ee02 has been submitted as an update to Fedora EPEL 9. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-9285d6ee02
An update to fix the issue has been pushed, thanks for reporting. I'm running my node with SELinux enabled, but due to some "development" mislabeling on the system I've never stumbled upon the issue.
FEDORA-EPEL-2023-9285d6ee02 has been pushed to the Fedora EPEL 9 testing repository. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-9285d6ee02 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2023-de859441ea has been pushed to the Fedora 38 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-de859441ea` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-de859441ea See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2023-889e5b5801 has been pushed to the Fedora 39 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-889e5b5801` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-889e5b5801 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-EPEL-2023-c3a0dc1d80 has been pushed to the Fedora EPEL 8 testing repository. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-c3a0dc1d80 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2023-4c176d2b0a has been pushed to the Fedora 37 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-4c176d2b0a` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-4c176d2b0a See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2023-4c176d2b0a has been pushed to the Fedora 37 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-EPEL-2023-9285d6ee02 has been pushed to the Fedora EPEL 9 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2023-889e5b5801 has been pushed to the Fedora 39 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2023-de859441ea has been pushed to the Fedora 38 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-EPEL-2023-c3a0dc1d80 has been pushed to the Fedora EPEL 8 stable repository. If problem still persists, please make note of it in this bug report.