Comments
kanru
provided feedback
on oo7-0.7.0~beta-1.fc45, …
2 weeks ago
Works.
tested with flatpak, podman, glycin, and python binding
I had been using this version for two days. Everything seems fine.
Boots fine. Lots of new AVC denied. Should I file bugs?
For example
Jun 04 23:10:44 audit[1652]: AVC avc: denied { connectto } for pid=1652 comm="(systemd)" path="/run/systemd/io.systemd.NamespaceResource" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:systemd_nsresourced_t:s0 tclass=unix_stream_socket permissive=0
Jun 04 23:10:46 audit[2072]: AVC avc: denied { connectto } for pid=2072 comm="pkla-check-auth" path="/run/systemd/io.systemd.NamespaceResource" scontext=system_u:system_r:policykit_auth_t:s0 tcontext=system_u:system_r:systemd_nsresourced_t:s0 tclass=unix_stream_socket permissive=0
Jun 04 23:11:14 audit[4441]: AVC avc: denied { execheap } for pid=4441 comm="ThreadPoolForeg" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=0
Jun 04 23:14:43 audit[5653]: AVC avc: denied { execheap } for pid=5653 comm="element-desktop" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=0
I confirm this breaks Silverblue installs. Always boot into emergency mode after update.
Breaks systemd-fstab-generator
Jun 02 07:41:00 kernel: audit: type=1400 audit(1717281660.775:7): avc: denied { search } for pid=973 comm="systemd-bless-b" name="/" dev="efivarfs" ino=135 scontext=system_u:system_r:systemd_bless_boot_generator_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=dir permissive=0
Jun 02 07:41:00 kernel: audit: type=1400 audit(1717281660.777:8): avc: denied { setfscreate } for pid=974 comm="systemd-cryptse" scontext=system_u:system_r:systemd_cryptsetup_generator_t:s0 tcontext=system_u:system_r:systemd_cryptsetup_generator_t:s0 tclass=process permissive=0
Jun 02 07:41:00 kernel: audit: type=1400 audit(1717281660.777:9): avc: denied { setfscreate } for pid=974 comm="systemd-cryptse" scontext=system_u:system_r:systemd_cryptsetup_generator_t:s0 tcontext=system_u:system_r:systemd_cryptsetup_generator_t:s0 tclass=process permissive=0
Jun 02 07:41:00 kernel: audit: type=1400 audit(1717281660.778:10): avc: denied { setfscreate } for pid=974 comm="systemd-cryptse" scontext=system_u:system_r:systemd_cryptsetup_generator_t:s0 tcontext=system_u:system_r:systemd_cryptsetup_generator_t:s0 tclass=process permissive=0
Jun 02 07:41:00 kernel: audit: type=1400 audit(1717281660.778:11): avc: denied { setfscreate } for pid=974 comm="systemd-cryptse" scontext=system_u:system_r:systemd_cryptsetup_generator_t:s0 tcontext=system_u:system_r:systemd_cryptsetup_generator_t:s0 tclass=process permissive=0
Jun 02 07:41:00 kernel: audit: type=1400 audit(1717281660.778:12): avc: denied { setfscreate } for pid=974 comm="systemd-cryptse" scontext=system_u:system_r:systemd_cryptsetup_generator_t:s0 tcontext=system_u:system_r:systemd_cryptsetup_generator_t:s0 tclass=process permissive=0
Jun 02 07:41:00 kernel: audit: type=1400 audit(1717281660.778:13): avc: denied { setfscreate } for pid=974 comm="systemd-cryptse" scontext=system_u:system_r:systemd_cryptsetup_generator_t:s0 tcontext=system_u:system_r:systemd_cryptsetup_generator_t:s0 tclass=process permissive=0
Jun 02 07:41:00 kernel: audit: type=1400 audit(1717281660.778:14): avc: denied { setfscreate } for pid=974 comm="systemd-cryptse" scontext=system_u:system_r:systemd_cryptsetup_generator_t:s0 tcontext=system_u:system_r:systemd_cryptsetup_generator_t:s0 tclass=process permissive=0
Jun 02 07:41:00 (sd-exec-[967]: /usr/lib/systemd/system-generators/systemd-bless-boot-generator failed with exit status 1.
Jun 02 07:41:00 (sd-exec-[967]: /usr/lib/systemd/system-generators/systemd-gpt-auto-generator failed with exit status 1.
Jun 02 07:41:00 (sd-exec-[967]: /usr/lib/systemd/system-generators/systemd-fstab-generator failed with exit status 1.
Tested in a F39 Workstation VM.
Update is functional. Chewing tested with no issues.