Description of problem: My F17 system had selinux disabled and uninstalled. My upgraded F18 system has also selinux uninstalled. But in the upgrade.log I see dozens of AVC denials. Examples: Dec 01 21:06:23 kraken upgrade[870]: [44/1500] (4%) installing glibc-2.16-24.fc18... Dec 01 21:06:23 kraken upgrade[870]: warning: /etc/nsswitch.conf created as /etc/nsswitch.conf.rpmnew Dec 01 21:06:26 kraken kernel: type=1400 audit(1354395986.061:3): avc: denied { transition } for pid=891 comm="system-upgrade-" path="/usr/sbin/glibc_post_upgrade.x86_64" dev="dm-2" ino=21107393 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:syste m_r:rpm_script_t:s0 tclass=process Dec 01 21:15:35 kraken upgrade[870]: [715/1500] (35%) installing systemd-195-8.fc18... Dec 01 21:15:36 kraken kernel: type=1400 audit(1354396536.950:9): avc: denied { read } for pid=1527 comm="useradd" name="nsswitch.conf" dev="dm-2" ino=24772858 scontext=system_u:system_r:useradd_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file Dec 01 21:15:36 kraken kernel: type=1400 audit(1354396536.950:10): avc: denied { open } for pid=1527 comm="useradd" path="/etc/nsswitch.conf" dev="dm-2" ino=24772858 scontext=system_u:system_r:useradd_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file Dec 01 21:15:36 kraken kernel: type=1400 audit(1354396536.950:11): avc: denied { getattr } for pid=1527 comm="useradd" path="/etc/nsswitch.conf" dev="dm-2" ino=24772858 scontext=system_u:system_r:useradd_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file Dec 01 21:15:36 kraken useradd[1527]: failed adding user 'dbus', data deleted Dec 01 21:15:36 kraken upgrade[870]: [716/1500] (35%) installing dbus-1.6.8-2.fc18... I suppose that the generated initrd for upgrade has selinux enabled. That might cause a lot of issues. I'm currently not sure whether my system was upgraded properly. It seems to run, but there are really lots of nasty-looking errors in the log. Version-Release number of selected component (if applicable): fedup-0.7.1-1.fc18.noarch fedup-dracut for F18-Beta (http://dl.fedoraproject.org/pub/fedora/linux/releases/test/18-Beta/Fedora/x86_64/os)
Created attachment 655735 [details] upgrade.log
The upgrade currently runs with SELinux enabled but permissive, so the messages are harmless. (In theory it should be inheriting the system's SELinux settings - if your system is permissive it'll be permissive, if it's enforcing it'll be enforcing. Except there's unknown SELinux problems with upgrades in enforcing mode, so we have to force it to permissive as a workaround.) I'm guessing your system has "SELINUX=disabled" in /etc/selinux/config - if you had "selinux=0" in your boot args, it would have been disabled, as expected. But this situation is a bit trickier - we load the new policy in initramfs, *before* mounting root, which means it's already enabled by the time we see /etc/selinux/config. And AFAIK you can't disable SELinux once policy is loaded. So: if a system has SELinux disabled in /etc/selinux/config, we'd probably need to add "selinux=0" to the boot arguments if we wanted it to be disabled during the upgrade.
I can't check at the moment, but I believe I don't have /etc/selinux/config at all, because I simply uninstalled everything related to SELinux. If SELinux is running in permissive mode during upgrade, I don't see a problem at all, because all the warnings should be harmless. If it is correct, I think we can close this bug.
fedup-0.7.2-1.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/fedup-0.7.2-1.fc17
Package fedup-0.7.2-1.fc17: * should fix your issue, * was pushed to the Fedora 17 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing fedup-0.7.2-1.fc17' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-20801/fedup-0.7.2-1.fc17 then log in and leave karma (feedback).
fedup-0.7.2-1.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.