Fedora Account System
Red Hat Associate
Red Hat Customer
I'm using systemd(-boot) with boot-counting. It uses a service called systemd-bless-boot.service which renames files in my ESP based on if a boot was succesful. This is denied with the following log line: type=AVC msg=audit(1781599001.555:266): avc: denied { rename } for pid=1167 comm="systemd-bless-b" name="teamsbc-7.1.0-0.rc7.260611g9716c086c8e8.50.fc45.x86_64+2-1.conf" dev="sda1" ino=7 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=file permissive=0 I don't know what an acceptable policy for this would be; perhaps allow init_t to rename files in general, or something more specific but I'd like it work :) Reproducible: Always
systemd-bless-boot-generator is confined: f45# ls -lZ /usr/lib/systemd/system-generators/systemd-bless-boot-generator -rwxr-xr-x. 1 root root system_u:object_r:systemd_bless_boot_generator_exec_t:s0 11512 Jun 27 02:00 /usr/lib/systemd/system-generators/systemd-bless-boot-generator Your system is either mislabeled or contains old policy.
Thanks for your reply Zdenek; I've built a fresh image today from rawhide and still see the same behavior, even though the file is indeed labeled as you say. Perhaps the execution context has something to do with it (the executable is ran by a systemd service, when I run it manually it *does* work). See here for some versions/more log output: ``` # dnf list --installed | grep policy policycoreutils.x86_64 3.11-1.fc45 <unknown> selinux-policy.noarch 45.9-1.fc45 <unknown> selinux-policy-targeted.noarch 45.9-1.fc45 <unknown> # systemctl status systemd-bless-boot.service × systemd-bless-boot.service - Mark the Current Boot Loader Entry as Good Loaded: loaded (/usr/lib/systemd/system/systemd-bless-boot.service; enabled-runtime; preset: disabled) Drop-In: /usr/lib/systemd/system/service.d └─10-timeout-abort.conf Active: failed (Result: exit-code) since Mon 2026-07-20 14:52:49 UTC; 2min 7s ago Invocation: 3c5a516454474ecf8e00370ab0e8d9ca Docs: man:systemd-bless-boot.service(8) Process: 622 ExecStart=/usr/lib/systemd/systemd-bless-boot good (code=exited, status=1/FAILURE) Main PID: 622 (code=exited, status=1/FAILURE) Mem peak: 1.6M CPU: 7ms Jul 20 14:52:49 teamsbc systemd[1]: Starting systemd-bless-boot.service - Mark the Current Boot Loader Entry as Good... Jul 20 14:52:49 teamsbc systemd-bless-boot[622]: Failed to rename '/loader/entries/teamsbc-7.2.0-0.rc3.260715g58717b2a1365.29.fc45.x86_64+2-1.conf' to '/loader/entries/teamsbc-7.2.0-0.rc3.260715g58717b2a1365.29.fc45.x86_64.conf': Permission denied Jul 20 14:52:49 teamsbc systemd[1]: systemd-bless-boot.service: Main process exited, code=exited, status=1/FAILURE Jul 20 14:52:49 teamsbc systemd[1]: systemd-bless-boot.service: Failed with result 'exit-code'. Jul 20 14:52:49 teamsbc systemd[1]: Failed to start systemd-bless-boot.service - Mark the Current Boot Loader Entry as Good. # systemctl restart systemd-bless-boot.service Job for systemd-bless-boot.service failed because the control process exited with error code. See "systemctl status systemd-bless-boot.service" and "journalctl -xeu systemd-bless-boot.service" for details. # grep systemd-bless-boot /var/log/audit/audit.log type=SERVICE_START msg=audit(1784559357.508:182): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-bless-boot comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'UID="root" AUID="unset" # ls -lZ /usr/lib/systemd/system-generators/systemd-bless-boot-generator -rwxr-xr-x. 1 root root system_u:object_r:systemd_bless_boot_generator_exec_t:s0 11512 Jun 27 00:00 /usr/lib/systemd/system-generators/systemd-bless-boot-generator ``` ```
Sorry, the audit.log grep was incomplete since the process name is abbreviated, here are both lines (the same denial as before): ``` # grep systemd-bless /var/log/audit/audit.log type=AVC msg=audit(1784559357.507:181): avc: denied { rename } for pid=1003 comm="systemd-bless-b" name="teamsbc-7.2.0-0.rc3.260715g58717b2a1365.29.fc45.x86_64+2-1.conf" dev="sda1" ino=7 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=file permissive=0 type=SERVICE_START msg=audit(1784559357.508:182): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-bless-boot comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'UID="root" AUID="unset" ```
I am sorry, I misunderstood it was the generator, probably mislead by comm="systemd-bless-b" This is another case: f45# ls -lZ /usr/lib/systemd/systemd-bless-boot -rwxr-xr-x. 1 root root system_u:object_r:init_exec_t:s0 29168 Jun 27 02:00 /usr/lib/systemd/systemd-bless-boot Can you set the system into permissive mode and gather all denials? Even better if it can be reproduced by setenforce 0 systemctl daemon-reload additional denials can be audited: https://fedoraproject.org/wiki/SELinux/Debugging#Enable_full_auditing
Hey Zdenek, when I set the system to permissive mode during the build of the image and boot it I only get one denial which is the same as already shown here :) `` # ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today type=AVC msg=AUDIT(07/27/26 05:16:25.856:76) : avc: denied { rename } for pid=658 comm=systemd-bless-b name=teamsbc-7.2.0-0.rc4.260725g0ce37745d4bf.39.fc45.x86_64+2-1.conf dev="sda1" ino=7 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=file permissive=1 ``` I saw a related bugzilla (for a different systemd service that wants to rename files on the ESP) popped up as well: https://bugzilla.redhat.com/show_bug.cgi?id=2507393 the denial there is the same but through a different service.
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle. Changing version to 45.