ostree-finalize-staged fails with SELinux error

bsherman · 2025-03-20T18:03:11.090Z

remember this blast from the past? I originally had that problem on my Bazzite rig... which I've let go idle (it dual boots) because I couldn't solve and seems I need to reinstall. But now... I've run into it on a uCore(bOS) system! 😦

B

bshermanOP•3/20/25, 6:04 PM

@M2 we should probably thread this as I'm now more motivated to try to understand this... it shouldn't be happening

M

M2•3/20/25, 6:09 PM

Yay....

B

bshermanOP•3/20/25, 6:10 PM

1) i really want a want to recover when this happens

M

M2•3/20/25, 6:10 PM

Again for mine it was due to SELinux labels no longer existing in a new image

B

bshermanOP•3/20/25, 6:10 PM

2) i'd like to prevent it from happening... and so far, it's been on my boS images, so i guess I stopped installing something which had installed SElinux label configs ?

M

M2•3/20/25, 6:11 PM

Likely. For me specifically the cause was the following.

I had swtpm installed. I then mutated the file itself to fix the SELinux label.

Then I tried to remove swtpm from my image, but it couldnt finalize the deployment

M

M2•3/20/25, 6:12 PM

I then readded swtpm back to the image and that seemed to fix it

M

M2•3/20/25, 6:12 PM

I haven't removed swtpm since

M

M2•3/20/25, 6:13 PM

I suppose this is one of the things composefs is likely trying to fix.

I also haven't had this happen since I started rechunking my images, but again my problem package of swtpm has been on every single image of mine since then

B

bshermanOP•3/20/25, 6:30 PM

hmm... I'm rechunking, so I don't think that helps

B

bshermanOP•3/20/25, 6:32 PM

# /usr/bin/ostree admin finalize-staged -v
OT: root_is_ostree_booted: 1
OT: remounted /sysroot writable
OT: remounted /boot writable
OT: using fuse: 0
OT: Target rootdev key backing-root-device-inode found
OT: Deployment 65bd69a25430389e0f8b6a28ca70558a1626be29812657988960d001ad513f9c.0 unlocked=0
OT: Deployment b7f6f79964d08901f33431e676b982851915c685d38e8cf55fc555c27ca3f9d7.0 unlocked=0
Copying /etc changes: 444 modified, 1 removed, 73 added
Problems processing filecon rules
Failed post db handling
Post process failed
semodule:  Failed!
error: Finalizing deployment: Finalizing SELinux policy: Child process exited with code 1

# /usr/bin/ostree admin finalize-staged -v
OT: root_is_ostree_booted: 1
OT: remounted /sysroot writable
OT: remounted /boot writable
OT: using fuse: 0
OT: Target rootdev key backing-root-device-inode found
OT: Deployment 65bd69a25430389e0f8b6a28ca70558a1626be29812657988960d001ad513f9c.0 unlocked=0
OT: Deployment b7f6f79964d08901f33431e676b982851915c685d38e8cf55fc555c27ca3f9d7.0 unlocked=0
Copying /etc changes: 444 modified, 1 removed, 73 added
Problems processing filecon rules
Failed post db handling
Post process failed
semodule:  Failed!
error: Finalizing deployment: Finalizing SELinux policy: Child process exited with code 1

# /usr/bin/ostree admin finalize-staged -v
OT: root_is_ostree_booted: 1
OT: remounted /sysroot writable
OT: remounted /boot writable
OT: using fuse: 0
OT: Target rootdev key backing-root-device-inode found
OT: Deployment 65bd69a25430389e0f8b6a28ca70558a1626be29812657988960d001ad513f9c.0 unlocked=0
OT: Deployment b7f6f79964d08901f33431e676b982851915c685d38e8cf55fc555c27ca3f9d7.0 unlocked=0
Copying /etc changes: 444 modified, 1 removed, 73 added
Problems processing filecon rules
Failed post db handling
Post process failed
semodule:  Failed!
error: Finalizing deployment: Finalizing SELinux policy: Child process exited with code 1

# /usr/bin/ostree admin finalize-staged -v
OT: root_is_ostree_booted: 1
OT: remounted /sysroot writable
OT: remounted /boot writable
OT: using fuse: 0
OT: Target rootdev key backing-root-device-inode found
OT: Deployment 65bd69a25430389e0f8b6a28ca70558a1626be29812657988960d001ad513f9c.0 unlocked=0
OT: Deployment b7f6f79964d08901f33431e676b982851915c685d38e8cf55fc555c27ca3f9d7.0 unlocked=0
Copying /etc changes: 444 modified, 1 removed, 73 added
Problems processing filecon rules
Failed post db handling
Post process failed
semodule:  Failed!
error: Finalizing deployment: Finalizing SELinux policy: Child process exited with code 1

ugh, once again, it doesn't tell me why

B

bshermanOP•3/20/25, 6:40 PM

just bringing this link here for easy reference: https://discussion.fedoraproject.org/t/ostree-finalize-staged-fails-with-an-selinux-error/97734/8

M

M2•3/20/25, 7:06 PM

My reading of this is that it's something to do with /usr/etc merge

M

M2•3/20/25, 7:06 PM

https://ostreedev.github.io/ostree/deployment/#staged-deployments

ostreedev/ostree

Deployments

ostree documentation

B

bshermanOP•3/20/25, 10:16 PM

i got busy with work, but thanks for that link too... i'm going to have to crack this nut eventually

J

jmcgee•3/23/25, 6:03 AM

i too have come across this.

J

jmcgee•3/23/25, 6:04 AM

oddly enough its with my ucore image. one system updated to that image with no problem, the other did not..

J

jmcgee•3/23/25, 3:45 PM

semodule -B -vv

semodule -B -vv

semodule -B -vv

semodule -B -vv

gives some output

J

jmcgee•3/23/25, 3:46 PM

to much to paste in here

B

bshermanOP•3/23/25, 4:46 PM

good, we've both hit it on ucore and i've hit it on bazzite and m2 hit it on bluefin, so it's generic to ostree/container-navtive probably

B

bshermanOP•3/23/25, 4:47 PM

and I realized I have this happening on a VM, so i've cloned the disk and I'm going to use that as a place to test/troubleshoot in a retryable manner

J

jmcgee•3/23/25, 4:48 PM

SELinux is preventing bootc from getattr access on the file /run/ostree-booted. For complete SELinux messages run: sealert -l 6facffd2-f4db-4726-b178-73f283964978

SELinux is preventing bootc from getattr access on the file /run/ostree-booted. For complete SELinux messages run: sealert -l 6facffd2-f4db-4726-b178-73f283964978

SELinux is preventing bootc from getattr access on the file /run/ostree-booted. For complete SELinux messages run: sealert -l 6facffd2-f4db-4726-b178-73f283964978

SELinux is preventing bootc from getattr access on the file /run/ostree-booted. For complete SELinux messages run: sealert -l 6facffd2-f4db-4726-b178-73f283964978

J

jmcgee•3/23/25, 4:48 PM

ya definitely an odd error

Jjmcgee ```SELinux is preventing bootc from getattr access on the file /run/ostree-boote...

B

bshermanOP•3/23/25, 4:51 PM

oh, that's interesting

J

jmcgee•3/23/25, 4:52 PM

SELinux is preventing bootc from getattr access on the file /run/ostree-booted.

                                                                  *****  Plugin catchall (100. confidence) suggests   **************************

                                                                  If you believe that bootc should be allowed getattr access on the ostree-booted file by default.
                                                                  Then you should report this as a bug.
                                                                  You can generate a local policy module to allow this access.
                                                                  Do
                                                                  allow this access for now by executing:
                                                                  # ausearch -c 'bootc' --raw | audit2allow -M my-bootc
                                                                  # semodule -X 300 -i my-bootc.pp

SELinux is preventing bootc from getattr access on the file /run/ostree-booted.

                                                                  *****  Plugin catchall (100. confidence) suggests   **************************

                                                                  If you believe that bootc should be allowed getattr access on the ostree-booted file by default.
                                                                  Then you should report this as a bug.
                                                                  You can generate a local policy module to allow this access.
                                                                  Do
                                                                  allow this access for now by executing:
                                                                  # ausearch -c 'bootc' --raw | audit2allow -M my-bootc
                                                                  # semodule -X 300 -i my-bootc.pp

SELinux is preventing bootc from getattr access on the file /run/ostree-booted.

                                                                  *****  Plugin catchall (100. confidence) suggests   **************************

                                                                  If you believe that bootc should be allowed getattr access on the ostree-booted file by default.
                                                                  Then you should report this as a bug.
                                                                  You can generate a local policy module to allow this access.
                                                                  Do
                                                                  allow this access for now by executing:
                                                                  # ausearch -c 'bootc' --raw | audit2allow -M my-bootc
                                                                  # semodule -X 300 -i my-bootc.pp

SELinux is preventing bootc from getattr access on the file /run/ostree-booted.

                                                                  *****  Plugin catchall (100. confidence) suggests   **************************

                                                                  If you believe that bootc should be allowed getattr access on the ostree-booted file by default.
                                                                  Then you should report this as a bug.
                                                                  You can generate a local policy module to allow this access.
                                                                  Do
                                                                  allow this access for now by executing:
                                                                  # ausearch -c 'bootc' --raw | audit2allow -M my-bootc
                                                                  # semodule -X 300 -i my-bootc.pp

J

jmcgee•3/23/25, 4:52 PM

granted those steps didnt shit, just posting what i am finding

J

jmcgee•3/23/25, 5:05 PM

and of course this is happening on my supermicro board system.. so reboots are slllooooooooooooww

J

jmcgee•3/23/25, 5:15 PM

rpm -V selinux-policy selinux-policy-targeted

J

jmcgee•3/23/25, 5:15 PM

shows a ton of missing policies

J

jmcgee•3/23/25, 5:16 PM

eh nevermind, same as on my system that is ok. hmm

J

jmcgee•3/23/25, 5:20 PM

https://github.com/hhd-dev/rechunk?tab=readme-ov-file#issues-in-the-rechunked-image

GitHub

GitHub - hhd-dev/rechunk

Contribute to hhd-dev/rechunk development by creating an account on GitHub.

J

jmcgee•3/23/25, 5:20 PM

maybe something with the rechunking that is causing this?

J

jmcgee•3/23/25, 5:26 PM

interesting, second system is now doing it as well.

B

bshermanOP•3/23/25, 5:34 PM

M2 had a situation where he thought rechunking actually HELPED the problem

B

bshermanOP•3/23/25, 5:43 PM

On my test VM, I just attempted a

bootc update

bootc update

bootc update

bootc update rebooted and got the error. Reverted to a snapshot I took specifically to be able to restore to the broken state and...

Yes. I can reproduce the issue with a revert.

B

bshermanOP•3/23/25, 5:44 PM

This is all the time I can give at this moment. but it's progress to not just have a place to try to fix, but also being to reproduce.

M

M2•3/23/25, 5:59 PM

@jmac are you rechunking your ucore image?

J

jmcgee•3/23/25, 6:02 PM

i was, i just disabled it in hopes of it offering a solution

J

jmcgee•3/23/25, 6:02 PM

so one one server with issues

J

jmcgee•3/23/25, 6:02 PM

i reverted to an old build

J

jmcgee•3/23/25, 6:02 PM

and just updated

J

jmcgee•3/23/25, 6:02 PM

that server is fixed

J

jmcgee•3/23/25, 6:18 PM

hmm i cannot for the life of me get the other system fixed though

J

jmcgee•3/23/25, 8:28 PM

ok i was able to get the other server up. i rolledback again and that seemed to work

J

jmcgee•3/23/25, 8:28 PM

really odd

J

jmcgee•3/23/25, 8:28 PM

im going to setup a vm to see if i can repeat this

J

jmcgee•3/24/25, 2:53 PM

going to reenable rechunking on my builds and see what happens

J

jmcgee•3/24/25, 2:53 PM

i cannot get it to error out again

B

bshermanOP•3/24/25, 3:01 PM

Yeah. That’s why I got a reproducible place for the big.

I’ve got. Some time to test today.

I’ll try disabling rechunkkng also

J

jmcgee•3/24/25, 3:03 PM

i cant say for sure if that is what fixed my issue

ostree-finalize-staged fails with SELinux error

Similar Threads

Similar Threads

Similar Threads