Bug 845194 - SELinux: unable to find usable policy file: No such file or directory
SELinux: unable to find usable policy file: No such file or directory
Status: CLOSED NEXTRELEASE
Product: Fedora
Classification: Fedora
Component: systemd (Show other bugs)
18
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: systemd-maint
Fedora Extras Quality Assurance
: Reopened
: 859299 (view as bug list)
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-08-02 04:01 EDT by Richard W.M. Jones
Modified: 2012-10-22 14:39 EDT (History)
20 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-10-07 18:45:22 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Richard W.M. Jones 2012-08-02 04:01:50 EDT
Description of problem:

Rawhide doesn't boot when SELinux is enabled.  It prints
the error message in $summary and drops into the emergency shell.

Version-Release number of selected component (if applicable):

selinux-policy-3.11.0-15.fc18.noarch
systemd-187-2.fc18.x86_64
kernel-3.6.0-0.rc0.git6.1.fc18.x86_64

How reproducible:

100%

Steps to Reproduce:
1. Update selinux-policy
2. Enable SELinux
3. Reboot
  
Actual results:

Doesn't boot up.
Comment 1 Richard W.M. Jones 2012-08-02 04:02:46 EDT
$ ls /etc/selinux/*/policy/*
/etc/selinux/targeted/policy/policy.27
Comment 2 Richard W.M. Jones 2012-08-02 04:03:33 EDT
How do we know what policy version it is looking for?
Ideally it should print the min/max values in the error message.
Comment 3 Daniel Walsh 2012-08-02 16:37:19 EDT
The message you are seeing is actually a systemd bug.  systemd in the initrd is looking for selinux-policy and failing to find it since it is not in the initrd.  We have had other SELinux issues with the current systemd.  According to Adam Williamson these seem to be fixed with the current selinux-policy.

selinux-policy-3.11.1-0.fc18.noarch
Comment 4 Hans de Goede 2012-09-02 09:58:26 EDT
Re-opening as I'm still seeing this message on boot, even after upgrading systemd to systemd-189-2.fc18.x86_64 and regenerating my initrd.

Note I don't see any adverse effects from the message, but the message in itself is ugly, and should not be there IMHO.
Comment 5 Richard W.M. Jones 2012-09-02 10:00:20 EDT
I guess the component should be changed to ... systemd?  dracut?
Comment 6 Xavier Hourcade 2012-09-13 19:55:10 EDT
Seen on F18 Live alpha TC5 to RC3
Comment 7 Lennart Poettering 2012-09-14 04:55:55 EDT
Fixed in git. Soon in F18.
Comment 8 Jóhann B. Guðmundsson 2012-09-14 06:44:44 EDT
If you want to get rid of the error after install you have to ( as always to get rid of those grub errors ) reinstall grub ( grub2-install /dev/sdX ) and regenerate the grub config ( grub2-mkconfig -o /boot/grub2/grub.cfg )
Comment 9 Lennart Poettering 2012-09-14 12:15:11 EDT
Nah, "dracut -f" should suffice. after installing the new systemd this will rebuild the initrd and include the new systemd version in it.
Comment 10 Jóhann B. Guðmundsson 2012-09-14 13:25:11 EDT
Install alpha then run dracut -f and see if your theory works ;)
Comment 11 Álvaro Castillo 2012-09-15 21:40:09 EDT
Please report this on upstream to solve. I try Alpha 3.1 and continue it.
Comment 12 Fedora Update System 2012-09-20 15:55:22 EDT
systemd-190-1.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/systemd-190-1.fc18
Comment 13 Miroslav Grepl 2012-09-21 03:09:59 EDT
*** Bug 859299 has been marked as a duplicate of this bug. ***
Comment 14 xset1980 2012-09-21 16:08:25 EDT
boot for me on F18 Alpha KDE, but show a error message.
Comment 15 xset1980 2012-09-21 16:09:12 EDT
(In reply to comment #11)
> Please report this on upstream to solve. I try Alpha 3.1 and continue it.

same here Alvaro

Regards, syn
Comment 16 xset1980 2012-09-21 16:12:33 EDT
kernel-3.6.0-0.rc6.git0.2.fc18.i686
systemd-188-3.fc18.i686
selinux-policy-3.11.1-21.fc18.noarch

Boot but show a error message when selinux is enabled. If a disabled from /etc/selinux/config no show more errors.

F18 Alpha KDE.

The error message is: "SELinux: unable to find usable policy file: No such file or directory"

Reported with screenshot at https://bugzilla.redhat.com/show_bug.cgi?id=859299
Comment 17 Fedora Update System 2012-09-22 02:36:33 EDT
Package systemd-191-2.fc18, rtkit-0.11-3.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing systemd-191-2.fc18 rtkit-0.11-3.fc18'
as soon as you are able to, then reboot.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-14581/rtkit-0.11-3.fc18,systemd-191-2.fc18
then log in and leave karma (feedback).
Comment 18 dominique 2012-09-24 02:11:30 EDT
I use F18 updated from an F17, I have selinux disabled and package systemd-191-2.fc18 rtkit-0.11-3.fc18 installed, and I have the error message "SELinux: unable to find usable policy files: No such file or directory" on boot...
Comment 19 Richard W.M. Jones 2012-09-24 03:46:16 EDT
I also rebuilt my initramfs over the weekend on a completely
up to date Fedora 18 system, and still see this error message.
Comment 20 Hans de Goede 2012-09-24 03:50:42 EDT
(In reply to comment #19)
> I also rebuilt my initramfs over the weekend on a completely
> up to date Fedora 18 system, and still see this error message.

Hmm, it works for me, what do you have in /etc/sysconfig/selinux ?

I have:

SELINUX=enforcing
SELINUXTYPE=targeted
SETLOCALDEFS=0
Comment 21 Richard W.M. Jones 2012-09-24 04:03:56 EDT
On this machine I'm running permissive at the moment,
because of libvirt problems ...

$ cat /etc/sysconfig/selinux 
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#	enforcing - SELinux security policy is enforced.
#	permissive - SELinux prints warnings instead of enforcing.
#	disabled - SELinux is fully disabled.
SELINUX=permissive
# SELINUXTYPE= type of policy in use. Possible values are:
#	targeted - Only targeted network daemons are protected.
#	strict - Full SELinux protection.
SELINUXTYPE=targeted
Comment 22 Lennart Poettering 2012-09-24 08:39:43 EDT
(In reply to comment #18)
> I use F18 updated from an F17, I have selinux disabled and package
> systemd-191-2.fc18 rtkit-0.11-3.fc18 installed, and I have the error message
> "SELinux: unable to find usable policy files: No such file or directory" on
> boot...

You need to rebuild the initrd before the msg goes away. Use "dracut -f" which will rebuild the initrd for the current kernel.
Comment 23 dominique 2012-09-24 15:04:49 EDT
(In reply to comment #22)
> (In reply to comment #18)
> > I use F18 updated from an F17, I have selinux disabled and package
> > systemd-191-2.fc18 rtkit-0.11-3.fc18 installed, and I have the error message
> > "SELinux: unable to find usable policy files: No such file or directory" on
> > boot...
> 
> You need to rebuild the initrd before the msg goes away. Use "dracut -f"
> which will rebuild the initrd for the current kernel.

Ok lennart, I do dradut -f, and after reboot I have no warninr message "SELinux: unable to find usable policy files: No such file or directory".

Thank.
Comment 24 xset1980 2012-09-25 09:20:03 EDT
So, if dracut -f fix the bug, is not a good idea make some script into rpm update for run dracut -f after install the new systemd and not show any message error?
Comment 25 Lennart Poettering 2012-09-25 15:21:34 EDT
(In reply to comment #24)
> So, if dracut -f fix the bug, is not a good idea make some script into rpm
> update for run dracut -f after install the new systemd and not show any
> message error?

Well, we currently rebuild dracut only if the kernel changes, but not otherwise. If you think it should be rebuilt on other occasions too, then please file a bug against dracut, for discussion in the dracut context.
Comment 26 xset1980 2012-09-25 22:56:26 EDT
(In reply to comment #25)
> (In reply to comment #24)
> > So, if dracut -f fix the bug, is not a good idea make some script into rpm
> > update for run dracut -f after install the new systemd and not show any
> > message error?
> 
> Well, we currently rebuild dracut only if the kernel changes, but not
> otherwise. If you think it should be rebuilt on other occasions too, then
> please file a bug against dracut, for discussion in the dracut context.

@Lennart Poettering,

dracut -f no fix the bug on Fedora 18 KDE Alpha up to date.
The same error is showing after initrd is loaded: " SELinux: unable to find usable policy file: No such file or directory"
Comment 27 Fedora Update System 2012-09-27 20:17:00 EDT
Package glibc-2.16-17.fc18, systemd-192-1.fc18, selinux-policy-3.11.1-23.fc18, rtkit-0.11-3.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing glibc-2.16-17.fc18 systemd-192-1.fc18 selinux-policy-3.11.1-23.fc18 rtkit-0.11-3.fc18'
as soon as you are able to, then reboot.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-14581/selinux-policy-3.11.1-23.fc18,rtkit-0.11-3.fc18,systemd-192-1.fc18,glibc-2.16-17.fc18
then log in and leave karma (feedback).
Comment 28 Fedora Update System 2012-10-01 16:09:05 EDT
Package glibc-2.16-17.fc18, rtkit-0.11-3.fc18, systemd-193-1.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing glibc-2.16-17.fc18 rtkit-0.11-3.fc18 systemd-193-1.fc18'
as soon as you are able to, then reboot.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-14581/rtkit-0.11-3.fc18,systemd-193-1.fc18,glibc-2.16-17.fc18
then log in and leave karma (feedback).

Note You need to log in before you can comment on or make changes to this bug.