Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: cri-o failed to start due to selinux issue, upgrade coreos to newer version (testing 44.20260523.2.1) can't resolve it. Version-Release number of selected component (if applicable): fedora coreos 44.20260510.3.1 cri-o1.35-1.35.3-1.fc44.x86_64 container-selinux-2.247.0-1.fc44.noarch How reproducible: Steps to Reproduce: 1. systemctl enable --now crio 2. upgrade fedora core from previous version 3. crio failed to start Actual results: crio failed to start due to selinux issue Expected results: crio running Additional info: selinux: time->Tue Jun 2 02:58:34 2026 type=AVC msg=audit(1780369114.463:4115): avc: denied { execmem } for pid=33265 comm="crio" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=0 ---- time->Tue Jun 2 02:58:44 2026 type=AVC msg=audit(1780369124.712:4121): avc: denied { execmem } for pid=33305 comm="crio" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=0 ---- time->Tue Jun 2 02:58:54 2026 type=AVC msg=audit(1780369134.962:4127): avc: denied { execmem } for pid=33354 comm="crio" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=0 ---- time->Tue Jun 2 02:59:05 2026 type=AVC msg=audit(1780369145.212:4131): avc: denied { execmem } for pid=33392 comm="crio" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=0 crio log: Jun 02 02:57:02 k8s-gpu-worker-001 systemd[1]: crio.service: Scheduled restart job, restart counter is at 695. Jun 02 02:57:02 k8s-gpu-worker-001 systemd[1]: Starting crio.service - Container Runtime Interface for OCI (CRI-O)... Jun 02 02:57:02 k8s-gpu-worker-001 (crio)[32879]: crio.service: Referenced but unset environment variable evaluates to an empty string: CRIO_CONFIG_OPTIONS, CRIO_METRICS_OPTIONS, CRIO_NETWORK_OPTIONS, CRIO_RUNTIME_OPTIONS, CRIO_STORAGE_OPTIONS Jun 02 02:57:02 k8s-gpu-worker-001 crio[32879]: /usr/bin/crio: error while loading shared libraries: cannot make segment writable for relocation: Permission denied Jun 02 02:57:02 k8s-gpu-worker-001 systemd[1]: crio.service: Main process exited, code=exited, status=127/n/a Jun 02 02:57:02 k8s-gpu-worker-001 systemd[1]: crio.service: Failed with result 'exit-code'. Jun 02 02:57:02 k8s-gpu-worker-001 systemd[1]: Failed to start crio.service - Container Runtime Interface for OCI (CRI-O).
Even after restoring the SELinux context of the binary, it still fails to start. Running `setenforce 0` can temporarily work around the issue. crio selinux (default, no changed): core@k8s-gpu-worker-001:~$ ls -lZ /usr/bin/crio -rwxr-xr-x. 1 root root system_u:object_r:container_runtime_exec_t:s0 75423640 Jan 1 1970 /usr/bin/crio
Thank you for the report. Please see https://bugzilla.redhat.com/show_bug.cgi?id=2477939 for more information. There is also information at https://github.com/coreos/fedora-coreos-tracker/issues/2148. *** This bug has been marked as a duplicate of bug 2477939 ***