Fedora Account System
Red Hat Associate
Red Hat Customer
On Fedora 42 with NetworkManager 1.52.2, attempting to start a Strongswan VPN connection fails, journalctl shows: NetworkManager[1284]: <warn> [1777007461.6338] vpn["VPN Name"]: failed to connect: 'Failure creating the temporary file' It works however, if you set the connection to "All users may connect to this network" in the nm-connection-editor. It looks like the strongswan plugin is attempting to copy its configured certificate to /run/NetworkManager/cert/, which has mod 0600: # sudo ls -ld /run/NetworkManager/cert drw------- 2 root root 40 Apr 24 10:57 /run/NetworkManager/cert This works as root, but without the "All users ..." settings, this seems to run with user permissions and fails. Reproducible: Always Steps to Reproduce: 1. Setup Strongswan VPN connection with certificate and do not set "All users may connect to this Network" 2. Activate the connection
This message is a reminder that Fedora Linux 42 is nearing its end of life. Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a 'version' of '42'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, change the 'version' to a later Fedora Linux version. Note that the version field may be hidden. Click the "Show advanced fields" button if you do not see it. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora Linux 42 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora Linux, you are encouraged to change the 'version' to a later version prior to this bug being closed.
(In reply to Fedora Release Engineering from comment #1) > This message is a reminder that Fedora Linux 42 is nearing its end of life. > Fedora will stop maintaining and issuing updates for Fedora Linux 42 on > 2026-05-13. > It is Fedora's policy to close all bug reports from releases that are no > longer > maintained. At that time this bug will be closed as EOL if it remains open > with a > 'version' of '42'. > The very same bug exists in F44 and I guess it is due CVE-2025-9615 bug fix in strongswan.
I had a look at the problem and created a bug report upstream: https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/work_items/1957 The VPN connection fails, if the connection is configured just for a single user. One workaround is to enable "Make available to other users" in the VPN settings. However, according to https://discussion.fedoraproject.org/t/upgrade-from-f43-to-f44-broke-strongswan-vpn/190397 there might be an additional problem related to SELinux. So far, I didn't had the change to test that yet.
I had the same problem after upgrading to Fedora 44. VPN: IPsec/IKEv2 (StrongSwan) 22 May 09:54:03 ** charon-nm[64857] : 05[CFG] received initiate for NetworkManager connection *** 22 May 09:54:03 ** NetworkManager[41667] : <warn> [17..4] vpn[0x5..50,828..6a7,‘***’] : failed to connect : 'Failure creating the temporary file' Solution: - 1: move the "server > certificate" file to a location accessible to everyone - 2: enable ‘Make available to other users’ And that's it!
I tested the strongswan plugin with SELinux: a) having "Make available to other users" disabled - the file system access in /run/NetworkManager/cert is indeed blocked by SELinux - I created https://bugzilla.redhat.com/show_bug.cgi?id=2481246 b) having "Make available to other users" enabled - as noted in comment #4, it is necessary to put the certificate file into a location accessible for everyone (or at least to the user root (e.g. via file ACLs), since the strongswan plugin runs as root but without the CAP_DAC_OVERRIDE capability) - if SELinux is enabled, then the file needs to have one of the cert-specific SELinux contexts (e.g. cert_t or home_cert_t), typically automatically set when the files is copied in one of the standard certificate directories
FEDORA-2026-564f8cdd1e (NetworkManager-1.57.4~dev-3.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-564f8cdd1e
FEDORA-2026-c78cbf0bf9 (NetworkManager-1.56.1-2.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-c78cbf0bf9
FEDORA-2026-c78cbf0bf9 has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-c78cbf0bf9` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-c78cbf0bf9 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-c78cbf0bf9 (NetworkManager-1.56.1-2.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-1b99e62c51 (NetworkManager-1.58~rc1-1.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-1b99e62c51
FEDORA-2026-1b99e62c51 (NetworkManager-1.58~rc1-1.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report.