Bug 677450 - anaconda does not mount /mnt/sysimage/selinux
Summary: anaconda does not mount /mnt/sysimage/selinux
Alias: None
Product: Fedora
Classification: Fedora
Component: anaconda
Version: 15
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
Assignee: David Lehman
QA Contact: Fedora Extras Quality Assurance
Whiteboard: AcceptedBlocker
: 681663 (view as bug list)
Depends On:
Blocks: 494832 F15Beta, F15BetaBlocker
TreeView+ depends on / blocked
Reported: 2011-02-14 21:06 UTC by Orion Poplawski
Modified: 2011-03-16 04:06 UTC (History)
10 users (show)

Fixed In Version: anaconda-15.22-1.fc15
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2011-03-16 04:06:44 UTC

Attachments (Terms of Use)
setsebool strace (39.13 KB, text/plain)
2011-02-16 22:17 UTC, Orion Poplawski
no flags Details
anaconda.log (47.41 KB, text/plain)
2011-02-26 15:14 UTC, Orion Poplawski
no flags Details
program.log (18.44 KB, text/plain)
2011-02-26 15:18 UTC, Orion Poplawski
no flags Details
storage.log (84.13 KB, text/plain)
2011-02-26 15:20 UTC, Orion Poplawski
no flags Details
syslog (48.42 KB, text/plain)
2011-02-26 15:20 UTC, Orion Poplawski
no flags Details

Description Orion Poplawski 2011-02-14 21:06:38 UTC
Description of problem:

# setsebool -P use_nfs_home_dirs=1 
libsemanage.semanage_link_sandbox: Could not access sandbox base file /etc/selinux/targeted/modules/tmp/base.pp. (No such file or directory).
Could not change policy booleans

# ls /etc/selinux/targeted/modules
active  semanage.read.LOCK  semanage.trans.LOCK

Version-Release number of selected component (if applicable):

Comment 1 Daniel Walsh 2011-02-16 20:40:53 UTC
rpm -q selinux-policy-targeted

Comment 2 Orion Poplawski 2011-02-16 20:51:46 UTC

Doesn't work in permissive mode either.

Comment 3 Daniel Walsh 2011-02-16 21:54:57 UTC
restorecon -R -v /etc/selinux

Comment 4 Orion Poplawski 2011-02-16 22:17:59 UTC
Created attachment 479224 [details]
setsebool strace

restorecon reports nothing.

grep -F /tmp /data/sw/tmp/setsebool.strace
8767  stat("/etc/selinux/targeted/modules/tmp", 0x7fff91e8e440) = -1 ENOENT (No such file or directory)
8767  mkdir("/etc/selinux/targeted/modules/tmp", 0700) = 0
8767  mkdir("/etc/selinux/targeted/modules/tmp/modules", 0700) = 0
8767  open("/etc/selinux/targeted/modules/tmp/commit_num", O_RDONLY) = -1 ENOENT (No such file or directory)
8767  open("/etc/selinux/targeted/modules/tmp//booleans.local", O_RDONLY) = -1 ENOENT (No such file or directory)
8767  open("/etc/selinux/targeted/modules/tmp/commit_num", O_RDONLY) = -1 ENOENT (No such file or directory)
8767  open("/etc/selinux/targeted/modules/tmp/commit_num", O_RDONLY) = -1 ENOENT (No such file or directory)
8767  open("/etc/selinux/targeted/modules/tmp/commit_num", O_RDONLY) = -1 ENOENT (No such file or directory)
8767  access("/etc/selinux/targeted/modules/tmp/disable_dontaudit", F_OK) = -1 ENOENT (No such file or directory)
8767  unlink("/etc/selinux/targeted/modules/tmp/disable_dontaudit") = -1 ENOENT (No such file or directory)
8767  open("/etc/selinux/targeted/modules/tmp/modules", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 4
8767  access("/etc/selinux/targeted/modules/tmp/base.pp", R_OK) = -1 ENOENT (No such file or directory)
8767  open("/etc/selinux/targeted/modules/tmp", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 3
8767  stat("/etc/selinux/targeted/modules/tmp/modules", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
8767  open("/etc/selinux/targeted/modules/tmp/modules", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 3
8767  rmdir("/etc/selinux/targeted/modules/tmp/modules") = 0
8767  rmdir("/etc/selinux/targeted/modules/tmp") = 0

It appears nothing creates base.pp before it is attempted to be accessed.

Comment 5 Jerry James 2011-02-17 18:37:01 UTC
Installation of gcl-selinux is failing in F-15 and Rawhide with the same error message.  The failing step in the postinstall script is this:

/usr/sbin/semodule -i /usr/share/selinux/packages/gcl/gcl.pp

Comment 6 Miroslav Grepl 2011-02-18 12:15:14 UTC

yum reinstall selinux-policy-targeted

blow up?

Comment 7 Orion Poplawski 2011-02-18 16:47:26 UTC
Appears to get stuck:

Running Transaction
  Installing : selinux-policy-targeted-3.9.14-2.fc15.noarch                                 1/1 

root     20795 20792  0 16:43 pts/0    00:00:00 -bash
root     20824 20795  2 16:44 pts/0    00:00:04 /usr/bin/python /usr/bin/yum reinstall selinux-policy-targeted

# strace -fp 20824
Process 20824 attached - interrupt to quit
futex(0x7fc961823dbc, FUTEX_WAIT, 1, NULL^C <unfinished ...>
Process 20824 detached

Comment 8 Orion Poplawski 2011-02-18 17:13:30 UTC
After killing that process (kill -9), setsebool -P works.

This was in the install.log:

Installing selinux-policy-targeted-3.9.14-2.fc15.noarch
libsepol.policydb_write: policy version 15 cannot support MLS
libsepol.policydb_to_image: could not compute policy length
libsepol.policydb_to_image: could not create policy image
SELinux:  Could not downgrade policy file /etc/selinux/targeted/policy/policy.24, searching for an older version.
SELinux:  Could not open policy file <= /etc/selinux/targeted/policy/policy.24:  No such file or directory
/sbin/load_policy:  Can't load policy:  No such file or directory
libsemanage.semanage_reload_policy: load_policy returned error code 2.
libsemanage.semanage_install_active: Could not copy /etc/selinux/targeted/modules/active/policy.kern to /etc/selinux/targeted/policy/policy.24. (No such file or directory).
semodule:  Failed!

Comment 9 Orion Poplawski 2011-02-18 17:16:22 UTC
yum reinstall selinux-policy-targeted still seems to hang in the same place though.

Comment 10 Daniel Walsh 2011-02-18 17:39:13 UTC
Could you reinstall libsemanage.

Not sure why it is trying to use policy.15?

Something wacky is going on.

Comment 11 Orion Poplawski 2011-02-18 18:02:14 UTC
That reinstall hangs too.  I suspect rpm.  Filed bug 678644.

Comment 12 Stephen Smalley 2011-02-23 13:26:57 UTC
cat /selinux/policyvers

Comment 13 Daniel Walsh 2011-02-23 21:06:14 UTC
Yes this is caused by the rpm problems.  Not an SELinux issue.

Comment 14 Orion Poplawski 2011-02-24 03:37:49 UTC
Sorry, but how is this "NOTABUG"?  I can reproduce this every time I've installed F15 so far.  Is there another bug filed for the cause?  The rpm problem was only affecting the attempts to reinstall packages, not the original report.

Comment 15 Orion Poplawski 2011-02-24 03:39:00 UTC
[root@vmrawhide ~]# cat /selinux/policyvers
24[root@vmrawhide ~]# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 24
Policy from config file:        targeted

Comment 16 Daniel Walsh 2011-02-24 18:15:51 UTC
Well not an SELinux bug if rpm is causing the install to blow up.

Comment 17 Stephen Smalley 2011-02-24 18:25:50 UTC
The original report looked like there was no base.pp, which implies that the original install of the policy package failed too and we have an incomplete /etc/selinux/targeted/modules tree.

Comment 18 Orion Poplawski 2011-02-24 19:20:22 UTC
What is the evidence that it is an rpm problem that is causing the install to fail?  Certainly there problems with the install (comment 8), but do we know what is causing it?

Comment 19 Daniel Walsh 2011-02-24 19:28:20 UTC
We have seen other bugs like this and it turned out to be a problem with RPM.

Comment 20 Miroslav Grepl 2011-02-24 22:04:47 UTC
Yes, this was the rpm problem which should be now fixed.


Comment 21 Orion Poplawski 2011-02-24 22:17:06 UTC
No, that was a separate issue.  yum reinstall hungs.  That was discovered in the process of debugging this issue, but I can't imagine it being related to the original problem of selinux getting messed up at install time.

Comment 22 Miroslav Grepl 2011-02-24 22:31:24 UTC
Well, you are right. The original problem was with "yum reinstall". But I believe the rpm issue also caused other issues with the policy.

Comment 23 Orion Poplawski 2011-02-25 15:00:26 UTC
In the VT2 terminal during the install, sestatus is fine (policy 24).  run in %post, I get:

+ cat /selinux/policyvers
cat: /selinux/policyvers: No such file or directory
+ sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   unknown (No such file or directory)
Mode from config file:          enforcing
Policy version:                 15
Policy from config file:        targeted

Does /selinux need to be in the chroot?  Anaconda issue?

Comment 24 Stephen Smalley 2011-02-25 15:20:18 UTC
That's interesting.  load_policy would need /selinux to be mounted in order to work.  If we're installing in a chroot though, I'd think that we wouldn't want to perform the policy load at that time and thus should be using semodule -n.

Comment 25 Orion Poplawski 2011-02-26 00:08:38 UTC
Confirmed that F15 anaconda does not mount /mnt/sysimage/selinux, which is causing the above selinux install issues.

Comment 26 Brian Lane 2011-02-26 01:46:03 UTC
This may be related to commit ae30136b9a1b8657d724e5abf56736ef201ecaf4 where /selinux mounting was moved to storage.

Comment 27 David Lehman 2011-02-26 04:41:23 UTC
Please attach the installer's logs. If your install has completed and you've rebooted into the installed system, they'll be here:


If you're still in the installer, in the shell on vt2, they'll be here:


Please attach them individually -- not as a tarball. Thanks.

Comment 28 Orion Poplawski 2011-02-26 15:14:55 UTC
Created attachment 481153 [details]

Comment 29 Orion Poplawski 2011-02-26 15:18:46 UTC
Created attachment 481154 [details]

Comment 30 Orion Poplawski 2011-02-26 15:20:02 UTC
Created attachment 481155 [details]

Comment 31 Orion Poplawski 2011-02-26 15:20:37 UTC
Created attachment 481156 [details]

Comment 32 David Lehman 2011-02-28 19:08:03 UTC
Thanks. I have a patch that I have verified in local testing. I will post it for review later today and am proposing this an F15Beta blocker NTH.

Comment 33 David Lehman 2011-03-08 20:06:40 UTC
*** Bug 681663 has been marked as a duplicate of this bug. ***

Comment 34 David Lehman 2011-03-09 19:07:35 UTC
Fixed for Fedora 15 in anaconda-15.22-1.

Comment 35 Fedora Update System 2011-03-09 21:55:27 UTC
anaconda-15.22-1.fc15 has been submitted as an update for Fedora 15.

Comment 36 James Laska 2011-03-11 19:40:23 UTC
Discussed at 2011-03-11 blocker review meeting.  This issue is fixed and available for testing in anaconda-15.22-1.  The issue has been accepted as a beta blocker.

Comment 37 Fedora Update System 2011-03-16 04:06:04 UTC
anaconda-15.22-1.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.