Bug 2415701 - SELinux denies create for systemd-machine resolve.hook with systemd-259~rc1-2.fc44
Summary: SELinux denies create for systemd-machine resolve.hook with systemd-259~rc1-2...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: openqa
: 2417714 2418797 2421836 2421837 2427548 2427549 2428562 2428563 2436675 2437020 2437021 2438544 2440094 2440404 2440916 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-11-18 18:53 UTC by Adam Williamson
Modified: 2026-03-12 01:57 UTC (History)
13 users (show)

Fixed In Version: selinux-policy-43.1-1.fc43
Clone Of:
Environment:
Last Closed: 2026-03-12 01:57:19 UTC
Type: Bug
Embargoed:
zpytela: mirror+


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github fedora-selinux selinux-policy issues 2947 0 None open selinux-policy breaks machinectl/systemd-nspawn with systemd main 2025-11-18 19:15:56 UTC
Github fedora-selinux selinux-policy pull 3092 0 None open Allow systemd create symlinks in /run/varlink/registry 2026-03-09 16:26:15 UTC
Github systemd systemd pull 39293 0 None Merged resolved: add ability for external programs to hook into name resolution (for machined+networkd to synthesize records) 2025-11-28 16:59:31 UTC
Red Hat Issue Tracker FC-3035 0 None None None 2026-01-28 12:34:14 UTC

Description Adam Williamson 2025-11-18 18:53:43 UTC
The systemd-259~rc1-2.fc44 update for Rawhide - https://bodhi.fedoraproject.org/updates/FEDORA-2025-c83e064a78 - failed openQA testing. The systemd-machined service fails to start, which appears to be caused by an SELinux denial:

Nov 17 16:19:02 fedora audit[921]: AVC avc:  denied  { create } for  pid=921 comm="systemd-machine" name="resolve.hook" scontext=system_u:system_r:systemd_machined_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=dir permissive=0
Nov 17 16:19:02 fedora systemd-machined[921]: Failed to bind to varlink socket: Permission denied
Nov 17 16:19:02 fedora systemd-machined[921]: Failed to fully start up daemon: Permission denied

I don't have the more detailed format because this is from openQA logs. I can try and reproduce in a local VM, and see if there are any further denials with enforcing=0 - will follow up shortly.

Comment 1 Adam Williamson 2025-11-18 20:16:44 UTC
testing in a VM with enforcing=0 shows one additional denial:

----
time->Tue Nov 18 15:13:37 2025
type=AVC msg=audit(1763496817.464:273): avc:  denied  { create } for  pid=2020 comm="systemd-machine" name="resolve.hook" scontext=system_u:system_r:systemd_machined_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=dir permissive=1
----
time->Tue Nov 18 15:13:37 2025
type=AVC msg=audit(1763496817.464:274): avc:  denied  { create } for  pid=2020 comm="systemd-machine" name="io.systemd.Machine" scontext=system_u:system_r:systemd_machined_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=sock_file permissive=1

Comment 2 Germano Massullo (Thetra) 2025-11-26 14:43:30 UTC
Related, but happening on F43: systemd update to systemd-0:258.2-1.fc43.x86_64 version (via dnf update) triggered

============
# sealert -l 6fa0babc-41b0-4c4c-a491-6eb64e1fc642
SELinux impedisce a systemd-machine un accesso search su cartella 388393.
⏎
⏎
***** Plugin catchall(100. confidenza) suggerisce**************************

Se si ritiene che a systemd-machine debba essere consentito l'accesso search su directory 388393 per impostazione predefinita.
Quindi si dovrebbe segnalare il problema come bug.
È possibile generare un modulo di politica locale per consentire questo accesso.
Fai
consentire questo accesso per ora eseguendo:
# ausearch -c 'systemd-machine' --raw | audit2allow -M my-$MODULE_NOME
# semodule -X 300 -i mio-systemdmachine.pp


Informazioni addizionali:
Contesto della sorgente       system_u:system_r:systemd_machined_t:s0
Contesto target               system_u:system_r:svirt_t:s0:c275,c898
Oggetti target                388393 [ dir ]
Sorgente                      systemd-machine
Percorso della sorgente       systemd-machine
Porta                         <Sconosciuto>
Host                          machine
Sorgente Pacchetti RPM        
Pacchetti RPM target          
SELinux Policy RPM            selinux-policy-targeted-42.16-1.fc43.noarch
Local Policy RPM              selinux-policy-targeted-42.16-1.fc43.noarch
Selinux abilitato             True
Tipo di politica              targeted
Modalità Enforcing            Enforcing
Host Name                     machine
Piattaforma                   Linux machine 6.17.8-300.fc43.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Fri Nov 14 01:47:12 UTC 2025
                              x86_64
Conteggio avvisi              14
Primo visto                   2025-11-22 18:30:42 CET
Ultimo visto                  2025-11-26 14:43:55 CET


Messaggi Raw Audit
type=AVC msg=audit(1764164635.894:6601): avc:  denied  { search } for  pid=2286 comm="systemd-machine" name="388393" dev="proc" ino=3422251 scontext=system_u:system_r:systemd_machined_t:s0 tcontext=system_u:system_r:svirt_t:s0:c275,c898 tclass=dir permissive=0


Hash: systemd-machine,systemd_machined_t,svirt_t,dir,search
============

during post update scriplets run

Comment 3 Adam Williamson 2025-11-26 16:23:49 UTC
Germano: I'm not sure that's related, the one I reported is new with systemd 259 in Rawhide, and your denial is for a different action and a different name. It might be best to file it separately.

The initial reported denials here are still a problem with the systemd-259 rc2 update - https://bodhi.fedoraproject.org/updates/FEDORA-2025-b5ff59bddc .

Comment 4 Zdenek Pytela 2025-11-26 18:55:13 UTC
(In reply to Adam Williamson from comment #3)
> Germano: I'm not sure that's related, the one I reported is new with systemd
> 259 in Rawhide, and your denial is for a different action and a different
> name. It might be best to file it separately.
Already reported like 16 times and resolved.
https://bugzilla.redhat.com/show_bug.cgi?id=2407206

Comment 5 Zbigniew Jędrzejewski-Szmek 2025-11-26 21:31:40 UTC
The two errors in comment#1 are because systemd-machined wants to listen on
/run/systemd/resolve.hook/io.systemd.Machine, so it'll try to create
"resolve.hook" first and then "io.systemd.Machine" second.

Comment 6 Zdenek Pytela 2025-11-28 16:59:47 UTC
*** Bug 2417714 has been marked as a duplicate of this bug. ***

Comment 7 Zdenek Pytela 2025-12-04 15:20:55 UTC
*** Bug 2418797 has been marked as a duplicate of this bug. ***

Comment 8 jjanasek 2026-01-22 21:36:52 UTC
*** Bug 2421837 has been marked as a duplicate of this bug. ***

Comment 9 jjanasek 2026-01-22 21:36:59 UTC
*** Bug 2427548 has been marked as a duplicate of this bug. ***

Comment 10 jjanasek 2026-01-22 21:37:20 UTC
*** Bug 2428563 has been marked as a duplicate of this bug. ***

Comment 11 jjanasek 2026-01-22 21:44:54 UTC
*** Bug 2427549 has been marked as a duplicate of this bug. ***

Comment 12 jjanasek 2026-01-22 21:44:59 UTC
*** Bug 2421836 has been marked as a duplicate of this bug. ***

Comment 13 jjanasek 2026-01-22 21:45:17 UTC
*** Bug 2428562 has been marked as a duplicate of this bug. ***

Comment 14 Zdenek Pytela 2026-02-04 09:35:54 UTC
*** Bug 2436675 has been marked as a duplicate of this bug. ***

Comment 15 Zdenek Pytela 2026-02-05 13:27:48 UTC
*** Bug 2437020 has been marked as a duplicate of this bug. ***

Comment 16 Zdenek Pytela 2026-02-05 13:27:59 UTC
*** Bug 2437021 has been marked as a duplicate of this bug. ***

Comment 17 Zdenek Pytela 2026-02-27 15:11:30 UTC
*** Bug 2440916 has been marked as a duplicate of this bug. ***

Comment 18 Zdenek Pytela 2026-02-27 15:11:37 UTC
*** Bug 2440404 has been marked as a duplicate of this bug. ***

Comment 19 Zdenek Pytela 2026-02-27 15:11:43 UTC
*** Bug 2438544 has been marked as a duplicate of this bug. ***

Comment 20 Zdenek Pytela 2026-02-27 15:11:50 UTC
*** Bug 2440094 has been marked as a duplicate of this bug. ***

Comment 21 Fedora Update System 2026-03-10 21:54:20 UTC
FEDORA-2026-d5ad4083a3 (selinux-policy-43.1-1.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-d5ad4083a3

Comment 22 Fedora Update System 2026-03-11 01:50:27 UTC
FEDORA-2026-d5ad4083a3 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-d5ad4083a3`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-d5ad4083a3

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 23 Fedora Update System 2026-03-12 01:57:19 UTC
FEDORA-2026-d5ad4083a3 (selinux-policy-43.1-1.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.