Fedora Account System
Red Hat Associate
Red Hat Customer
Current installed version: 43.20260313.0 uname -a Linux *** 6.19.6-200.fc43.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Mar 5 00:10:35 UTC 2026 x86_64 GNU/Linux rpm -qa sssd-pass* selinux* selinux-policy-43.1-1.fc43.noarch selinux-policy-targeted-43.1-1.fc43.noarch sssd-passkey-2.12.0-1.fc43.x86_64 Reproducible: Always Steps to Reproduce: rpm-ostree upgrade Actual Results: Importing packages... done Checking out packages... done Running systemd-sysusers... done Running pre scripts... done Running post scripts... done Running posttrans scripts... done Writing rpmdb... done Generating initramfs... done Writing OSTree commit... done error: Committing: Writing content object: fstatat(b4/d5d0043441967922c4eedd55d7fd4ff3c601a3f2579d17f6059dd99d017f10.file): Permission denied Expected Results: rpm-ostree upgrade should be completed successfully. Additional Information: Workaround 1: temporarily disable SELinux enforcement: sudo setenforce 0 && rpm-ostree upgrade && sudo setenforce 1 Workaround 2: rebase to the last known good build: 43-20260223 Similar and related issues: https://github.com/fedora-selinux/selinux-policy/issues/3081 https://github.com/ublue-os/aurora/issues/1809#issuecomment-3959174337
Hello, Can you attach list of AVC denials or related journal entries?
time->Fri Mar 13 10:06:05 2026 type=AVC msg=audit(1773389165.153:974): avc: denied { getattr } for pid=6982 comm="pool-1" path="/sysroot/ostree/repo/objects/b4/d5d0043441967922c4eedd55d7fd4ff3c601a3f2579d17f6059dd99d017f10.file" dev="dm-0" ino=9775088 scontext=system_u:system_r:install_t:s0 tcontext=system_u:object_r:sssd_mfa_exec_t:s0 tclass=file permissive=0 ---- time->Fri Mar 13 10:09:33 2026 type=AVC msg=audit(1773389373.683:1594): avc: denied { getattr } for pid=32113 comm="pool-0" path="/sysroot/ostree/repo/objects/b4/d5d0043441967922c4eedd55d7fd4ff3c601a3f2579d17f6059dd99d017f10.file" dev="dm-0" ino=9775088 scontext=system_u:system_r:install_t:s0 tcontext=system_u:object_r:sssd_mfa_exec_t:s0 tclass=file permissive=1 ---- time->Fri Mar 13 10:09:41 2026 type=AVC msg=audit(1773389381.365:1597): avc: denied { getattr } for pid=32113 comm="pool-0" path="/sysroot/ostree/repo/objects/b4/d5d0043441967922c4eedd55d7fd4ff3c601a3f2579d17f6059dd99d017f10.file" dev="dm-0" ino=9775088 scontext=system_u:system_r:install_t:s0 tcontext=system_u:object_r:sssd_mfa_exec_t:s0 tclass=file permissive=1 ---- time->Fri Mar 13 10:09:41 2026 type=AVC msg=audit(1773389381.365:1598): avc: denied { read } for pid=32113 comm="pool-0" name="d5d0043441967922c4eedd55d7fd4ff3c601a3f2579d17f6059dd99d017f10.file" dev="dm-0" ino=9775088 scontext=system_u:system_r:install_t:s0 tcontext=system_u:object_r:sssd_mfa_exec_t:s0 tclass=file permissive=1 ---- time->Fri Mar 13 10:09:41 2026 type=AVC msg=audit(1773389381.365:1599): avc: denied { open } for pid=32113 comm="pool-0" path="/sysroot/ostree/repo/objects/b4/d5d0043441967922c4eedd55d7fd4ff3c601a3f2579d17f6059dd99d017f10.file" dev="dm-0" ino=9775088 scontext=system_u:system_r:install_t:s0 tcontext=system_u:object_r:sssd_mfa_exec_t:s0 tclass=file permissive=1 ---- time->Fri Mar 13 10:09:41 2026 type=AVC msg=audit(1773389381.365:1600): avc: denied { write } for pid=32113 comm="pool-0" name="d5d0043441967922c4eedd55d7fd4ff3c601a3f2579d17f6059dd99d017f10.file" dev="dm-0" ino=9775088 scontext=system_u:system_r:install_t:s0 tcontext=system_u:object_r:sssd_mfa_exec_t:s0 tclass=file permissive=1 ---- time->Fri Mar 13 10:09:41 2026 type=AVC msg=audit(1773389381.365:1601): avc: denied { link } for pid=32113 comm="pool-0" name="d5d0043441967922c4eedd55d7fd4ff3c601a3f2579d17f6059dd99d017f10.file" dev="dm-0" ino=9775088 scontext=system_u:system_r:install_t:s0 tcontext=system_u:object_r:sssd_mfa_exec_t:s0 tclass=file permissive=1 ---- time->Fri Mar 13 10:09:47 2026 type=AVC msg=audit(1773389387.250:1602): avc: denied { getattr } for pid=32113 comm="pool-0" path="/sysroot/ostree/repo/objects/b4/d5d0043441967922c4eedd55d7fd4ff3c601a3f2579d17f6059dd99d017f10.file" dev="dm-0" ino=9775088 scontext=system_u:system_r:install_t:s0 tcontext=system_u:object_r:sssd_mfa_exec_t:s0 tclass=file permissive=1 ---- time->Fri Mar 13 10:09:47 2026 type=AVC msg=audit(1773389387.250:1603): avc: denied { read } for pid=32113 comm="pool-0" name="oidc_child" dev="dm-0" ino=9775088 scontext=system_u:system_r:install_t:s0 tcontext=system_u:object_r:sssd_mfa_exec_t:s0 tclass=file permissive=1 ---- time->Fri Mar 13 10:09:47 2026 type=AVC msg=audit(1773389387.250:1604): avc: denied { open } for pid=32113 comm="pool-0" path="/sysroot/ostree/repo/objects/b4/d5d0043441967922c4eedd55d7fd4ff3c601a3f2579d17f6059dd99d017f10.file" dev="dm-0" ino=9775088 scontext=system_u:system_r:install_t:s0 tcontext=system_u:object_r:sssd_mfa_exec_t:s0 tclass=file permissive=1 ---- time->Fri Mar 13 10:09:47 2026 type=AVC msg=audit(1773389387.250:1605): avc: denied { ioctl } for pid=32113 comm="pool-0" path="/sysroot/ostree/repo/objects/b4/d5d0043441967922c4eedd55d7fd4ff3c601a3f2579d17f6059dd99d017f10.file" dev="dm-0" ino=9775088 ioctlcmd=0x6686 scontext=system_u:system_r:install_t:s0 tcontext=system_u:object_r:sssd_mfa_exec_t:s0 tclass=file permissive=1
(In reply to Zdenek Pytela from comment #1) > Hello, > > Can you attach list of AVC denials or related journal entries? Zdenek Pytela, Do you need something else? This issue still not resolved and becomes critical.
The sssd_mfa_exec_t type is not defined in selinux-policy. Do you know where it comes from? semodule -lfull | grep -v ^100
It comes more likely from sssd :) semodule -lfull | grep -v ^100 400 extra_binsbin cil 400 extra_varrun cil 400 kl2tpd-custom pp 400 permissive_bootupd_t cil 200 container pp 200 flatpak pp 200 ipa pp 200 mariadb-plugin-cracklib-password-check pp 200 mysql pp 200 nbdkit pp 200 passt pp 200 passt-repair pp 200 pasta pp 200 smartmon pp 200 swtpm pp 200 swtpm_libvirt pp 200 swtpm_svirt pp Here more details: https://github.com/ublue-os/aurora/issues/1809#issuecomment-3959174337
It impacts any bootc-based image with freeipa-client yes
The type is defined in freeipa-selinux which is freeipa-server dependency.
(In reply to Zdenek Pytela from comment #7) > The type is defined in freeipa-selinux which is freeipa-server dependency. To solve this problem, is there anything else that needs to be done from my side?
FYI Fedora 43 - still no changes and issue persists. Fedora 44 - no such issue with upgrade and selinux.