On Dec 24, 2013, at 2:42 AM, Bill Murray <bill.murray@xxxxxxx> wrote: > Dear all, > I had trouble persuading 'fedup --network 20' to run on my f19 laptop. It install all the files and gets ready. Then it boots and gets as far as: > > [ OK ] Started trigger flushing of journal to persistent storage > [ OK ] Started Forward Password Requests to Plymouth > [ OK ] Started Forward Password Requests to Plymouth > [ OK] Started Recreate Volatile files and Directories > There are then 3 lines of selinux permission denied. But no problem, selinux is set permissive anyway. > > Earlier on I see 'dracut-initqueue[400] failed to issue method call: Access denied' > > However, when I add selinux=0 to the command line..installation proceeds. > This is very odd - selinux was in permissive mode. > > This is a bug I think? On a test VM with dracut and systemd debugging enabled (so it's slow): [ 5.094179] type=1404 audit(1387844762.554:2): enforcing=1 old_enforcing=0 auid=4294967295 ses=4294967295 The upgrade environment comes up in enforcing mode. [ 37.388496] upgrade[665]: /bin/upgra[ 37.427863] type=1404 audit(1387844794.861:9): enforcing=0 old_enforcing=1 auid=4294967295 ses=4294967295 de@18(setstate): UPGRADE_STATE=running Then goes to permissive mode. For fully 32 seconds it is in enforcing mode. And I see quite a few dracut-initqueue process entries at 15 seconds through 21 seconds. So all the preliminary setup logic before the upgrade runs, happens with enforcing enabled. It's not so good to use selinux=0 because it totally disables selinux and all the labels on files will be unset. You should instead use enforcing=0 which allows selinux to correctly label the system, while not enforcing policy. So I suggest that now that your system is upgraded to Fedora 20, assuming you leave selinux running in enforcing mode on this system, that you relabel it with: restorecon -R -v / As for whose bug this is, it could be mislabeling from the F19 system. But now that the system is upgraded it's difficult to reproduce to file a bug. I first would have tried a relabel from within Fedora 19: restorecon -R -v / and then tried the update without changing the selinux behavior. If it still failed, then I'd do: ausearch -m AVC to see exactly what's being denied and file a bug against it, or maybe against selinux-policy if the request is reasonable and the denial isn't. And then I'd rerun the upgrade with enforcing=0 as a work around. Chris Murphy -- users mailing list users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
