rawhide: 20220103: selinux denial causing systemd-network-generator service failure #1059

dustymabe · 2022-01-04T17:59:54Z

Our tests that test networking configuration via kernel arguments are failing because of SELinux denials causing the systemd-network-generator service to fail in our rawhide stream.

[2022-01-04T16:33:48.933Z] --- FAIL: ext.config.networking.prefer-ignition-networking (555.33s)
[2022-01-04T16:33:48.933Z]         harness.go:1249: Cluster failed starting machines: machine "5bffd725-9683-47c4-b64c-1fb8eb91c341" failed basic checks: some systemd units failed:
[2022-01-04T16:33:48.933Z] systemd-network-generator.service


[2022-01-04T16:35:34.817Z] --- FAIL: ext.config.networking.force-persist-ip (388.76s)
[2022-01-04T16:35:34.817Z]         harness.go:1249: Cluster failed starting machines: machine "b5b0354e-e771-495c-aaab-36cc98e47c6e" failed basic checks: some systemd units failed:
[2022-01-04T16:35:34.817Z] systemd-network-generator.service

I opened BZ#2037047 against selinux-policy to track a fix for getting the systemd-network-generator.service working again.

The text was updated successfully, but these errors were encountered:

dustymabe · 2022-01-04T18:01:37Z

We have a few options here that I see for a short term workaround:

make the tests use enforcing=0 temporarily (would affect all streams and would need a reminder to revert)
snooze these tests for a while in rawhide
determine/decide that we absolutely don't need anything from systemd-network-generator and disable it.

jlebon · 2022-01-04T18:07:56Z

determine/decide that we absolutely don't need anything from systemd-network-generator and disable it.

+1. I think for our own sanity we shouldn't have anything other than nm-initrd-generator generating things from network kargs.

dustymabe · 2022-01-04T18:28:12Z

determine/decide that we absolutely don't need anything from systemd-network-generator and disable it.

+1. I think for our own sanity we shouldn't have anything other than nm-initrd-generator generating things from network kargs.

I would mostly agree but there's some overlap where the systemd-network-generator does some things that are used even if we use NetworkManager (and not systemd-networkd). For example: systemd/systemd#21766 (comment)

They are failing right now because `systemd-network-generator` is having issues writing files because of SELinux. See: - coreos/fedora-coreos-tracker#1059 - https://bugzilla.redhat.com/show_bug.cgi?id=2037047

dustymabe · 2022-01-04T20:46:00Z

proposal to go with snoozing for now: coreos/fedora-coreos-config#1400

They are failing right now because `systemd-network-generator` is having issues writing files because of SELinux. See: - coreos/fedora-coreos-tracker#1059 - https://bugzilla.redhat.com/show_bug.cgi?id=2037047

Similar to 104ecf1 we need to snooze the new karg networking test added in 0a577a1 on rawhide because of the same issue. See coreos/fedora-coreos-tracker#1059

dustymabe · 2022-01-15T22:50:49Z

bump-lockfile started failing because of this. We we are now hitting it on the systemd 249.7-2.fc35 -> 249.9-1.fc35 in Fedora 35. Let's pin systemd in testing/next for now and get more involved in the BZ to see if we can push a fix.

SELinux denials are causing systemd-network-generator to fail running. coreos/fedora-coreos-tracker#1059

Currently no movement on the report BZ. I marked it as a prioritized bug so we can hopefully get some fix soon. coreos/fedora-coreos-tracker#1059 https://bugzilla.redhat.com/show_bug.cgi?id=2037047

SELinux denials are causing systemd-network-generator to fail running. coreos/fedora-coreos-tracker#1059

Currently no movement on the report BZ. I marked it as a prioritized bug so we can hopefully get some fix soon. coreos/fedora-coreos-tracker#1059 https://bugzilla.redhat.com/show_bug.cgi?id=2037047

dustymabe · 2022-02-28T18:10:01Z

The snooze for the following tests was extended in coreos/fedora-coreos-config#1543:

ext.config.networking.prefer-ignition-networking
ext.config.networking.force-persist-ip
ext.config.networking.mtu-on-bond-kargs

dustymabe · 2022-03-08T15:21:03Z

The snooze for the following tests was extended in coreos/fedora-coreos-config#1576:

ext.config.networking.prefer-ignition-networking
ext.config.networking.force-persist-ip
ext.config.networking.mtu-on-bond-kargs

These tests are still failing and are still being investigated. See: - coreos/fedora-coreos-tracker#1059 - coreos/fedora-coreos-tracker#1092 - coreos/fedora-coreos-tracker#1105

dustymabe · 2022-03-16T15:14:13Z

I'm going to unfreeze systemd and workaround this for now: coreos/fedora-coreos-config#1604

I'll continue to monitor BZ#2037047 for any updates there.

dustymabe · 2022-04-06T18:37:31Z

A fix has been built for Fedora 36 for this. I'm not sure the fix is going to go to F35, but we don't necessarily need that. Let's fast-track the package in our next-devel stream (one PR against next-devel) and split out our masking to make it only apply to F35 (another PR to against the testing-devel branch). See coreos/fedora-coreos-config#1660 for an example of how to do this.

dustymabe · 2022-04-07T15:12:43Z

Closing this out since it's fixed in F36 (next-devel) and Rawhide and will folow into our other streams.

…ator No longer a problem in F36. See coreos/fedora-coreos-tracker#1059 (comment)

They are failing right now because `systemd-network-generator` is having issues writing files because of SELinux. See: - coreos/fedora-coreos-tracker#1059 - https://bugzilla.redhat.com/show_bug.cgi?id=2037047

Similar to 104ecf1 we need to snooze the new karg networking test added in 0a577a1 on rawhide because of the same issue. See coreos/fedora-coreos-tracker#1059

SELinux denials are causing systemd-network-generator to fail running. coreos/fedora-coreos-tracker#1059

Currently no movement on the report BZ. I marked it as a prioritized bug so we can hopefully get some fix soon. coreos/fedora-coreos-tracker#1059 https://bugzilla.redhat.com/show_bug.cgi?id=2037047

These tests are still failing and are still being investigated. See: - coreos/fedora-coreos-tracker#1059 - coreos/fedora-coreos-tracker#1092 - coreos/fedora-coreos-tracker#1105

…ator No longer a problem in F36. See coreos/fedora-coreos-tracker#1059 (comment)

They are failing right now because `systemd-network-generator` is having issues writing files because of SELinux. See: - coreos/fedora-coreos-tracker#1059 - https://bugzilla.redhat.com/show_bug.cgi?id=2037047

Similar to 104ecf1 we need to snooze the new karg networking test added in 0a577a1 on rawhide because of the same issue. See coreos/fedora-coreos-tracker#1059

SELinux denials are causing systemd-network-generator to fail running. coreos/fedora-coreos-tracker#1059

Currently no movement on the report BZ. I marked it as a prioritized bug so we can hopefully get some fix soon. coreos/fedora-coreos-tracker#1059 https://bugzilla.redhat.com/show_bug.cgi?id=2037047

These tests are still failing and are still being investigated. See: - coreos/fedora-coreos-tracker#1059 - coreos/fedora-coreos-tracker#1092 - coreos/fedora-coreos-tracker#1105

…ator No longer a problem in F36. See coreos/fedora-coreos-tracker#1059 (comment)

dustymabe added the kind/bug label Jan 4, 2022

dustymabe mentioned this issue Jan 4, 2022

[rawhide] overrides: pin to authselect-1.3.0-3.fc36 coreos/fedora-coreos-config#1396

Merged

dustymabe mentioned this issue Jan 4, 2022

kola-denylist: snooze karg networking tests on rawhide coreos/fedora-coreos-config#1400

Merged

dustymabe mentioned this issue Jan 12, 2022

kola-denylist: snooze new karg networking test on rawhide coreos/fedora-coreos-config#1417

Merged

dustymabe added a commit to dustymabe/fedora-coreos-config that referenced this issue Jan 16, 2022

overrides: pin to systemd-249.7-2.fc35

398663b

SELinux denials are causing systemd-network-generator to fail running. coreos/fedora-coreos-tracker#1059

dustymabe added a commit to dustymabe/fedora-coreos-config that referenced this issue Jan 16, 2022

overrides: pin to systemd-249.7-2.fc35

360f622

SELinux denials are causing systemd-network-generator to fail running. coreos/fedora-coreos-tracker#1059

dustymabe mentioned this issue Jan 16, 2022

[next-devel] overrides: pin to systemd-249.7-2.fc35 coreos/fedora-coreos-config#1428

Merged

dustymabe added a commit to dustymabe/fedora-coreos-config that referenced this issue Jan 16, 2022

overrides: pin to systemd-249.7-2.fc35

2e21aa7

SELinux denials are causing systemd-network-generator to fail running. coreos/fedora-coreos-tracker#1059

dustymabe added a commit to dustymabe/fedora-coreos-config that referenced this issue Jan 16, 2022

overrides: pin to systemd-249.7-2.fc35

25f3fe2

SELinux denials are causing systemd-network-generator to fail running. coreos/fedora-coreos-tracker#1059

dustymabe added a commit to coreos/fedora-coreos-config that referenced this issue Jan 16, 2022

overrides: pin to systemd-249.7-2.fc35

4801a96

SELinux denials are causing systemd-network-generator to fail running. coreos/fedora-coreos-tracker#1059

dustymabe added a commit to coreos/fedora-coreos-config that referenced this issue Jan 16, 2022

overrides: pin to systemd-249.7-2.fc35

5b44a48

SELinux denials are causing systemd-network-generator to fail running. coreos/fedora-coreos-tracker#1059

dustymabe mentioned this issue Jan 25, 2022

denylist: extend snooze for network karg tests coreos/fedora-coreos-config#1445

Merged

travier self-assigned this Feb 10, 2022

travier added jira for syncing to jira rawhide Issues that uniquely pertain to rawhide labels Feb 10, 2022

cgwalters pushed a commit to cgwalters/fedora-coreos-config that referenced this issue Feb 10, 2022

overrides: pin to systemd-249.7-2.fc35

909a19c

SELinux denials are causing systemd-network-generator to fail running. coreos/fedora-coreos-tracker#1059

This was referenced Apr 6, 2022

manifests: mask systemd-network-generator.service for only fedora 35 coreos/fedora-coreos-config#1663

Merged

manifest-lock.overrides: fast-track selinux-policy coreos/fedora-coreos-config#1664

Merged

dustymabe closed this as completed Apr 7, 2022

dustymabe added a commit to dustymabe/fedora-coreos-config that referenced this issue May 10, 2022

manifests/fedora-coreos-base: remove masking of systemd-network-gener…

36409d3

…ator No longer a problem in F36. See coreos/fedora-coreos-tracker#1059 (comment)

dustymabe added a commit to dustymabe/fedora-coreos-config that referenced this issue May 11, 2022

manifests/fedora-coreos-base: remove masking of systemd-network-gener…

2766c12

…ator No longer a problem in F36. See coreos/fedora-coreos-tracker#1059 (comment)

dustymabe added a commit to coreos/fedora-coreos-config that referenced this issue May 11, 2022

manifests/fedora-coreos-base: remove masking of systemd-network-gener…

09576ec

…ator No longer a problem in F36. See coreos/fedora-coreos-tracker#1059 (comment)

HuijingHei pushed a commit to HuijingHei/fedora-coreos-config that referenced this issue Oct 10, 2023

overrides: pin to systemd-249.7-2.fc35

63686f8

SELinux denials are causing systemd-network-generator to fail running. coreos/fedora-coreos-tracker#1059

HuijingHei pushed a commit to HuijingHei/fedora-coreos-config that referenced this issue Oct 10, 2023

manifests/fedora-coreos-base: remove masking of systemd-network-gener…

6100cc2

…ator No longer a problem in F36. See coreos/fedora-coreos-tracker#1059 (comment)

HuijingHei pushed a commit to HuijingHei/fedora-coreos-config that referenced this issue Oct 10, 2023

overrides: pin to systemd-249.7-2.fc35

08cf893

SELinux denials are causing systemd-network-generator to fail running. coreos/fedora-coreos-tracker#1059

HuijingHei pushed a commit to HuijingHei/fedora-coreos-config that referenced this issue Oct 10, 2023

manifests/fedora-coreos-base: remove masking of systemd-network-gener…

a3da4de

…ator No longer a problem in F36. See coreos/fedora-coreos-tracker#1059 (comment)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

rawhide: 20220103: selinux denial causing systemd-network-generator service failure #1059

rawhide: 20220103: selinux denial causing systemd-network-generator service failure #1059

dustymabe commented Jan 4, 2022

dustymabe commented Jan 4, 2022 •

edited

Loading

jlebon commented Jan 4, 2022

dustymabe commented Jan 4, 2022 •

edited

Loading

dustymabe commented Jan 4, 2022

dustymabe commented Jan 15, 2022 •

edited

Loading

dustymabe commented Feb 28, 2022

dustymabe commented Mar 8, 2022

dustymabe commented Mar 16, 2022

dustymabe commented Apr 6, 2022 •

edited

Loading

dustymabe commented Apr 7, 2022

rawhide: 20220103: selinux denial causing systemd-network-generator service failure #1059

rawhide: 20220103: selinux denial causing systemd-network-generator service failure #1059

Comments

dustymabe commented Jan 4, 2022

dustymabe commented Jan 4, 2022 • edited Loading

jlebon commented Jan 4, 2022

dustymabe commented Jan 4, 2022 • edited Loading

dustymabe commented Jan 4, 2022

dustymabe commented Jan 15, 2022 • edited Loading

dustymabe commented Feb 28, 2022

dustymabe commented Mar 8, 2022

dustymabe commented Mar 16, 2022

dustymabe commented Apr 6, 2022 • edited Loading

dustymabe commented Apr 7, 2022

dustymabe commented Jan 4, 2022 •

edited

Loading

dustymabe commented Jan 4, 2022 •

edited

Loading

dustymabe commented Jan 15, 2022 •

edited

Loading

dustymabe commented Apr 6, 2022 •

edited

Loading