February 2023 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1208173] New: Can't boot devel:RISCV:Factory:Contrib:StarFive:VisionFive2/JeOS-starfivevisionfive2, "sbi_trap_error: hart0: trap handler failed (error -2)"
by bugzilla_noreply＠suse.com 18 Mar '23

18 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1208173 Bug ID: 1208173 Summary: Can't boot devel:RISCV:Factory:Contrib:StarFive:VisionFive2/JeOS- starfivevisionfive2, "sbi_trap_error: hart0: trap handler failed (error -2)" Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: RISC-V OS: openSUSE Tumbleweed Status: NEW Severity: Minor Priority: P5 - None Component: Bootloader Assignee: screening-team-bugs(a)suse.de Reporter: aaronpuchert(a)alice-dsl.net QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- This is not technically Tumbleweed, so I open with lower severity. This is on a VisionFive 2 V1.3B, with u-boot-spl.bin.normal.out and visionfive2_fw_payload.img from [1], and JeOS-starfivevisionfive2 on an SD card. The initial boot produces the error mentioned in the Wiki [2]: Loading Linux 6.2.0-rc7-12-default ... Loading initial ramdisk ... EFI stub: Booting Linux Kernel... Unhandled exception: Store/AMO access fault EPC: 00000000fff47a98 RA: 00000000fff8684a TVAL: 0000000040000000 EPC: 0000000040201a98 RA: 000000004024084a reloc adjusted [...] UEFI image [0x00000000fe460000:0x00000000fe716fff] '/efi\boot\bootriscv64.efi' UEFI image [0x00000000cb23a000:0x00000000ccf42fff] Ok, let's mark that region as reserved as the Wiki says: StarFive # fdt addr ${fdtcontroladdr}; fdt rsvmem add 0x40000000 0x00001000 StarFive # boot ## Warning: defaulting to text format ## Error: "boot2" not defined switch to partitions #0, OK mmc1 is current device Scanning mmc 1:1... libfdt fdt_check_header(): FDT_ERR_BADMAGIC Card did not respond to voltage select! : -110 ** Unable to read file ubootefi.var ** Failed to load EFI variables Found EFI removable media binary efi/boot/bootriscv64.efi 2846720 bytes read in 122 ms (22.3 MiB/s) libfdt fdt_check_header(): FDT_ERR_BADMAGIC Welcome to GRUB! [...] Loading Linux 6.2.0-rc7-12-default ... Loading initial ramdisk ... EFI stub: Booting Linux Kernel... EFI stub: Loaded initrd from LINUX_EFI_INITRD_MEDIA_GUID device path EFI stub: Using DTB from configuration table EFI stub: Exiting boot services... clk u5_dw_i2c_clk_core already disabled clk u5_dw_i2c_clk_apb already disabled sbi_trap_error: hart0: trap handler failed (error -2) sbi_trap_error: hart0: mcause=0x0000000000000005 mtval=0x0000000040047060 sbi_trap_error: hart0: mepc=0x0000000040004cac mstatus=0x0000000200001800 sbi_trap_error: hart0: ra=0x0000000040009ee2 sp=0x0000000040046f10 sbi_trap_error: hart0: gp=0x0000000000000000 tp=0x0000000040047000 sbi_trap_error: hart0: s0=0x0000000040046f20 s1=0x0000000040047000 sbi_trap_error: hart0: a0=0x0000000040047060 a1=0x0000000000000002 sbi_trap_error: hart0: a2=0x0000000000000000 a3=0x0000000000000019 sbi_trap_error: hart0: a4=0x0000000000000001 a5=0x0000000040047060 sbi_trap_error: hart0: a6=0x00000000400470a8 a7=0x0000000000000004 sbi_trap_error: hart0: s2=0x00000000400241a8 s3=0x0000000000000000 sbi_trap_error: hart0: s4=0x0000000000000000 s5=0x0000000040028000 sbi_trap_error: hart0: s6=0x0000000040028020 s7=0x0000000000000000 sbi_trap_error: hart0: s8=0x000000000000001c s9=0x0000000040034ab0 sbi_trap_error: hart0: s10=0x0000000000000000 s11=0x0000000000000000 sbi_trap_error: hart0: t0=0x0000000000000000 t1=0x0000000000000000 sbi_trap_error: hart0: t2=0x0000000000000000 t3=0x0000000000002000 sbi_trap_error: hart0: t4=0x0000000000000000 t5=0x0000000000000000 sbi_trap_error: hart0: t6=0x0000000000000000 and then it hangs. Now OpenSBI tells me this: Domain0 Region00 : 0x0000000002000000-0x000000000200ffff (I) Domain0 Region01 : 0x0000000040000000-0x000000004007ffff () Domain0 Region02 : 0x0000000000000000-0xffffffffffffffff (R,W,X) so maybe the region wasn't big enough? But a size of 0x80000 doesn't do it either, and the error is a different one. Booting the SDK kernel (e.g. image.fit from [1]) with the instructions given in the repository README (i.e. via tftpboot) works fine. Out of curiosity, I tried to switch roles: put the SDK kernel on the SD card, and tried tftpboot with the openSUSE kernel. The SDK kernel on the SD card produces pretty much the same sbi_trap_error, whereas the openSUSE kernel via tftp can at least start itself and some services. It's then missing things, because it expects a disk around, but that's expected: StarFive # setenv bootfile vmlinuz; setenv fileaddr a0000000; setenv fdtcontroladdr 0xffffffffffffffff StarFive # setenv kernel_comp_addr_r 0xb0000000; setenv kernel_comp_size 0x10000000; StarFive # tftpboot ${fdt_addr_r} jh7110-starfive-visionfive-2-vb.dtb [...] StarFive # tftpboot ${kernel_addr_r} Image-6.2.0-rc7-12-default [...] StarFive # tftpboot ${ramdisk_addr_r} initrd-6.2.0-rc7-12-default [...] StarFive # run chipa_set_linux StarFive # booti ${kernel_addr_r} ${ramdisk_addr_r}:${filesize} ${fdt_addr_r} ## Flattened Device Tree blob at 46000000 Booting using the fdt blob at 0x46000000 Using Device Tree in place at 0000000046000000, end 0000000046008140 Starting kernel ... [ 0.000000][ T0] Linux version 6.2.0-rc7-12-default (geeko@buildhost) (gcc (SUSE Linux) 12.2.1 20230124 [revision 193f7e62815b4089dfaed4c2bd34fd4f10209e27], GNU ld (GNU Binutils; openS) [ 0.000000][ T0] OF: fdt: Ignoring memory range 0x40000000 - 0x40200000 [ 0.000000][ T0] Machine model: StarFive VisionFive 2 VB [...] [ 0.000000][ T0] CPU with hartid=0 is not available [ 0.000000][ T0] CPU with hartid=0 is not available [ 0.000000][ T0] CPU with hartid=0 is not available [...] [ 19.230279][ T711] dracut: FATAL: No root device found [ 19.235549][ T711] dracut: Refusing to continue But that's expected. So I don't think there is anything wrong with the kernel. It seems to be an issue either with the firmware or with the bootloader. For what it's worth, I see that devel:RISCV:Factory:Contrib:StarFive:VisionFive2 has some kind of u-boot, but I can't find a pendant for visionfive2_fw_payload.img. Likely I'm just doing something wrong though and maybe the documentation could be improved a bit. [1] https://github.com/starfive-tech/VisionFive2/releases/tag/VF2_v2.8.0 [2] https://en.opensuse.org/HCL:VisionFive2 -- You are receiving this mail because: You are on the CC list for the bug.

1 12

[Bug 1206977] New: On boot hangs on fbo:switching to i915 from EFI VGA
by bugzilla_noreply＠suse.com 18 Mar '23

18 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1206977 Bug ID: 1206977 Summary: On boot hangs on fbo:switching to i915 from EFI VGA Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: x86-64 OS: openSUSE Leap 15.4 Status: NEW Severity: Major Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: nsnospam3(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- HW: ASUS Prime Z790-P with iCore5 CPU with integrated GPU, M2 NVMe SSD Installation was not possible without grub linux parameter nomodeset. Of course with this parameter only the basic resolution of 1024x768 is available. Every successive boot hangs on log entry fbo:switching to i915 from EFI VGA. As I could not find any solution I tried first to install Windows 10. Worked without any Problem Intel drivers were installed properly and I got full resolution of 2560x1440. I tried openSUSE-Tumbleweed-GNOME-Live-x86_64-Current.iso starting form USB. Worked as expected with full resolution. I tried to install openSUSE-Tumbleweed-DVD-x86_64-Current.iso. Didn't hang and I could start the installation. I interromped the installation to try Leap 15.4 again first getting the updated version i.e. openSUSE-Leap-15.4-CR-DVD-x86_64-Build31.38-Media.iso. No chance, without nomodeset parameter no installation possible. I'll install tumbleweed now, but this is not exactly what I wanted. -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1207438] New: VUL-0: CVE-2023-22484: ghc-cmark-gfm: cmark-gfm: quadratic complexity bug in handle_pointy_brace may lead to a denial of service
by bugzilla_noreply＠suse.com 18 Mar '23

18 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1207438 Bug ID: 1207438 Summary: VUL-0: CVE-2023-22484: ghc-cmark-gfm: cmark-gfm: quadratic complexity bug in handle_pointy_brace may lead to a denial of service Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/354903/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: peter.simons(a)suse.com Reporter: thomas.leroy(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2023-22484 cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-22484 https://www.cve.org/CVERecord?id=CVE-2023-22484 https://github.com/github/cmark-gfm/security/advisories/GHSA-24f7-9frr-5h2r -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1100677] New: trackerbug: packages do not build reproducibly from compile-time CPU-detection
by bugzilla_noreply＠novell.com 18 Mar '23

18 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1100677 Bug ID: 1100677 Summary: trackerbug: packages do not build reproducibly from compile-time CPU-detection Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE Factory Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: bwiedemann(a)suse.com Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de Depends on: 1100520 Blocks: 1081754 Found By: Development Blocker: --- e.g. bug 1100520 compiler options -march=native and -mtune=native make the resulting machine code depend on the build system's CPU which breaks reproducible builds. affects at least: glucat form python-annoy legion trigger-rally This is already fixed in: clpeak higan kyotocabinet one common approach seems to do sed -i "s|-march=native||g" $FILE -- You are receiving this mail because: You are on the CC list for the bug.

2 19

[Bug 1159231] New: tesseract-ocr builds with march=native
by bugzilla_noreply＠novell.com 18 Mar '23

18 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1159231 Bug ID: 1159231 Summary: tesseract-ocr builds with march=native Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: All OS: openSUSE Factory Status: NEW Severity: Major Priority: P5 - None Component: Development Assignee: idonmez(a)suse.com Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de CC: hiwatari.seiji(a)gmail.com Found By: Development Blocker: --- While working on reproducible builds for openSUSE, I found that the tesseract-ocr package binary varies depending on build machine CPU. This is a bug that can cause crashes on machines older that the random build machine. -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 1207231] New: Btrfs errors on kernel 6.1.3 (write time tree block corruption detected)
by bugzilla_noreply＠suse.com 17 Mar '23

17 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1207231 Bug ID: 1207231 Summary: Btrfs errors on kernel 6.1.3 (write time tree block corruption detected) Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: wardlawhunter(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Please see the following log: [ 59.345109] BTRFS error (device nvme0n1p2): block=1754410582016 write time tree block corruption detected [ 59.353413] BTRFS error (device nvme0n1p2): parent transid verify failed on logical 1754410582016 mirror 1 wanted 1036990 found 845765 [ 59.353476] BTRFS: error (device nvme0n1p2: state AL) in free_log_tree:3284: errno=-5 IO failure [ 59.353478] BTRFS info (device nvme0n1p2: state EAL): forced readonly [ 59.355231] BTRFS warning (device nvme0n1p2: state EAL): Skipping commit of aborted transaction. [ 59.355232] BTRFS: error (device nvme0n1p2: state EAL) in cleanup_transaction:1958: errno=-5 IO failure Started getting this error on kernel 6.1.3 after updating my system recently (20221211-0 -> 20230116-0). Did a memtest to make sure my RAM was okay (passed with no errors). Using snapper to rollback to before the update (kernel 6.0.12) has fixed the issue. Shortly after booting my system (less than 10 minutes post-boot) the root filesystem would become read-only (see log). This would happen following every boot. Didn't btrfs get updated in 6.1? Specifically, async buffered writes? -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1205963] New: autoconf: Add "distconfdir" parameter
by bugzilla_noreply＠suse.com 17 Mar '23

17 Mar '23

https://bugzilla.suse.com/show_bug.cgi?id=1205963 Bug ID: 1205963 Summary: autoconf: Add "distconfdir" parameter Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: All OS: All Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: jsikes(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Per Bug #1152770, default configuration files provided by packages are supposed to be moved to /usr/etc and only admin managed files are to be placed in /etc. Many packages derive the '/etc' directory from the 'sysconfdir' parameter used in packaging and autotools. Now that our packaging system has added 'distconfdir' we should also add that option to autotools to facilitate building packages that build using autotools. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1192844] New: vlc dvd:// crashes in Mesa init_source
by bugzilla_noreply＠suse.com 17 Mar '23

17 Mar '23

https://bugzilla.suse.com/show_bug.cgi?id=1192844 Bug ID: 1192844 Summary: vlc dvd:// crashes in Mesa init_source Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Linux Status: NEW Severity: Normal Priority: P5 - None Component: X.Org Assignee: gfx-bugs(a)suse.de Reporter: ohering(a)suse.com QA Contact: gfx-bugs(a)suse.de Found By: --- Blocker: --- vlc dvd:// crashes: Core was generated by `vlc dvd://'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00007f5b2d18b011 in init_source (buffer=0x7f5ae8842088, idct=0x7f5ae87eb4e0) at ../src/gallium/auxiliary/vl/vl_idct.c:597 597 tex = buffer->sampler_views.individual.source->texture; [Current thread is 1 (Thread 0x7f5aeed36640 (LWP 2185))] (gdb) p buffer->sampler_views $1 = {all = {0x0, 0x7f5ae8829390, 0x0, 0x7f5ae8829390}, stage = {{0x0, 0x7f5ae8829390}, {0x0, 0x7f5ae8829390}}, individual = { source = 0x0, matrix = 0x7f5ae8829390, intermediate = 0x0, transpose = 0x7f5ae8829390}} (gdb) bt #0 0x00007f5b2d18b011 in init_source (buffer=0x7f5ae8842088, idct=0x7f5ae87eb4e0) at ../src/gallium/auxiliary/vl/vl_idct.c:597 #1 vl_idct_init_buffer (intermediate=0x0, source=<optimized out>, buffer=0x7f5ae8842088, idct=0x7f5ae87eb4e0) at ../src/gallium/auxiliary/vl/vl_idct.c:806 #2 init_idct_buffer (buffer=<optimized out>, dec=0x7f5ae8841de8) at ../src/gallium/auxiliary/vl/vl_mpeg12_decoder.c:256 #3 vl_mpeg12_get_decode_buffer (dec=dec@entry=0x7f5ae87eb2e0, target=<optimized out>) at ../src/gallium/auxiliary/vl/vl_mpeg12_decoder.c:557 #4 0x00007f5b2d18ba87 in vl_mpeg12_begin_frame (decoder=0x7f5ae87eb2e0, target=<optimized out>, picture=0x7f5ae807dca8) at ../src/gallium/auxiliary/vl/vl_mpeg12_decoder.c:606 #5 0x00007f5aeddac314 in handleVASliceDataBufferType (context=context@entry=0x7f5ae807dc30, buf=<optimized out>) at ../src/gallium/frontends/va/picture.c:351 #6 0x00007f5aeddadf09 in vlVaRenderPicture (ctx=<optimized out>, context_id=<optimized out>, buffers=0x7f5ae801cb70, num_buffers=72) at ../src/gallium/frontends/va/picture.c:581 #7 0x00007f5af4bc15bf in vaRenderPicture (dpy=0x7f5ae810eb50, context=8, buffers=0x7f5ae801cb70, num_buffers=72) at /usr/src/debug/libva-2.13.0-3.1.x86_64/va/va.c:1605 #8 0x00007f5b0c92e990 in ff_vaapi_decode_issue (avctx=0x7f5ae8001580, pic=0x7f5ae807ab40) at libavcodec/vaapi_decode.c:179 #9 0x00007f5b0c93a61e in vaapi_mpeg2_end_frame (avctx=<optimized out>) at libavcodec/vaapi_mpeg2.c:121 #10 0x00007f5b0c7d3fa0 in slice_end (avctx=avctx@entry=0x7f5ae8001580, pict=pict@entry=0x7f5ae8005f80) at libavcodec/mpeg12dec.c:2042 #11 0x00007f5b0c7deb4d in decode_chunks (avctx=0x7f5ae8001580, picture=0x7f5ae8005f80, got_output=0x7f5aeed359a0, buf=0x7f5ae8045c60 "", buf_size=137080) at libavcodec/mpeg12dec.c:2495 #12 0x00007f5b0c7dfb4e in mpeg_decode_frame (avctx=0x7f5ae8001580, data=0x7f5ae8005f80, got_output=0x7f5aeed359a0, avpkt=<optimized out>) at libavcodec/mpeg12dec.c:2847 #13 0x00007f5b0c5d440a in decode_simple_internal (discarded_samples=<synthetic pointer>, frame=0x7f5ae8005f80, avctx=0x7f5ae8001580) at libavcodec/decode.c:329 #14 decode_simple_receive_frame (frame=<optimized out>, avctx=<optimized out>) at libavcodec/decode.c:530 #15 decode_receive_frame_internal (avctx=avctx@entry=0x7f5ae8001580, frame=0x7f5ae8005f80) at libavcodec/decode.c:550 #16 0x00007f5b0c5d5888 in avcodec_send_packet (avctx=avctx@entry=0x7f5ae8001580, avpkt=0x7f5ae8006d40) at libavcodec/decode.c:617 ... (gdb) info source Current source file is ../src/gallium/auxiliary/vl/vl_idct.c Compilation directory is /usr/src/debug/Mesa-drivers-21.2.5-293.2.x86_64/x86_64-suse-linux Located in /usr/src/debug/Mesa-drivers-21.2.5-293.2.x86_64/src/gallium/auxiliary/vl/vl_idct.c ... [ 26.750403][ T570] [drm] initializing kernel modesetting (RV620 0x1002:0x95C5 0x1028:0x0342 0x00). [ 26.759604][ T570] ATOM BIOS: 113 ... No idea when it started, just tried it this week on this Dell OptiPlex 980. -- You are receiving this mail because: You are on the CC list for the bug.

1 13

[Bug 1205314] New: [Build 20221110] 2nd disk decrypt dialog
by bugzilla_noreply＠suse.com 17 Mar '23

17 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1205314 Bug ID: 1205314 Summary: [Build 20221110] 2nd disk decrypt dialog Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/2867881/modules/firs t_boot/steps/3 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Bootloader Assignee: screening-team-bugs(a)suse.de Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Found By: openQA Blocker: Yes ## Observation This setup configures the harddisk/partition as seen in https://openqa.opensuse.org/tests/2867881#step/select_guided_setup/1 (i.e /boot is not split out from /) After installation, we observe grub being decrypted: https://openqa.opensuse.org/tests/2867881#step/grub_test/1 but upon selecting TW to boot from, the password dialog appears again. openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-crypt_no_lvm@64bit fails in [first_boot](https://openqa.opensuse.org/tests/2867881/modules/first_boot/st… ## Test suite description Maintainer: riafarov. Test installation with encrypted partitions but without lvm enabled. This is supported only by storage-ng, hence, do NOT enable test suite on distris without storage-ng. ## Reproducible Fails since (at least) Build [20221110](https://openqa.opensuse.org/tests/2867380) ## Expected result Last good: [20221109](https://openqa.opensuse.org/tests/2865109) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensus… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1207962] New: [SELinux] systemd-timesyncd cannot start due to missing permissions for /run/systemd (/var/run/systemd)
by bugzilla_noreply＠suse.com 17 Mar '23

17 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1207962 Bug ID: 1207962 Summary: [SELinux] systemd-timesyncd cannot start due to missing permissions for /run/systemd (/var/run/systemd) Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: opensuse.k1akb(a)slmail.me QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- With SELinux enabled and enforcing, systemd-timesyncd cannot start successfully due to missing authorization to `/run/systemd` (aka `/var/run/systemd`). This occurs on a fresh installation of Tumbleweed with SELinux enabled/enforced. I looked for recent changes in systemd-timesyncd functioning on a feature-level, and it might be that it started listening on broader scope in /var/run/systemd, instead of just the dedicated directories for systemd-timesyncd. I have tried to debug this, but seem to run short on necessary information. I can find the process execution (context) tag and the file system tag, but am not quite sure how to fix it. The piece of auditd log below shows the complaint. ``` (command: `sudo /usr/sbin/ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -ts today`) ---- time->Fri Jan 27 19:04:15 2023 type=USER_AVC msg=audit(1674842655.829:1298): pid=944 uid=472 auid=4294967295 ses=4294967295 subj=system_u:system_r:nscd_t:s0 msg='avc: op=load_policy lsm=selinux seqno=2 res=1 exe="/usr/sbin/nscd" sauid=472 hostname=? addr=? terminal=?' ---- time->Fri Jan 27 19:04:16 2023 type=AVC msg=audit(1674842656.017:1305): avc: denied { watch } for pid=7999 comm="systemd-timesyn" path="/run/systemd" dev="tmpfs" ino=2 scontext=system_u:system_r:systemd_timedated_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=dir permissive=0 ---- time->Fri Jan 27 19:04:16 2023 type=AVC msg=audit(1674842656.133:1313): avc: denied { watch } for pid=8002 comm="systemd-timesyn" path="/run/systemd" dev="tmpfs" ino=2 scontext=system_u:system_r:systemd_timedated_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=dir permissive=0 ---- time->Fri Jan 27 19:04:16 2023 type=AVC msg=audit(1674842656.245:1319): avc: denied { watch } for pid=8006 comm="systemd-timesyn" path="/run/systemd" dev="tmpfs" ino=2 scontext=system_u:system_r:systemd_timedated_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=dir permissive=0 ---- time->Fri Jan 27 19:04:16 2023 type=AVC msg=audit(1674842656.357:1325): avc: denied { watch } for pid=8009 comm="systemd-timesyn" path="/run/systemd" dev="tmpfs" ino=2 scontext=system_u:system_r:systemd_timedated_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=dir permissive=0 ---- time->Fri Jan 27 19:04:16 2023 type=AVC msg=audit(1674842656.469:1331): avc: denied { watch } for pid=8012 comm="systemd-timesyn" path="/run/systemd" dev="tmpfs" ino=2 scontext=system_u:system_r:systemd_timedated_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=dir permissive=0 ``` ``` (command: `sudo /usr/sbin/semanage fcontext -l | grep '/var/run/systemd'`) /var/run/systemd all files system_u:object_r:init_var_run_t:s0 /var/run/systemd(/.*)? all files system_u:object_r:init_var_run_t:s0 /var/run/systemd/ask-password(/.*)? all files system_u:object_r:systemd_passwd_var_run_t:s0 /var/run/systemd/ask-password-block(/.*)? all files system_u:object_r:systemd_passwd_var_run_t:s0 /var/run/systemd/default-hostname regular file system_u:object_r:hostname_etc_t:s0 /var/run/systemd/import(/.*)? all files system_u:object_r:systemd_importd_var_run_t:s0 /var/run/systemd/inhibit(/.*)? all files system_u:object_r:systemd_logind_inhibit_var_run_t:s0 /var/run/systemd/initctl/fifo named pipe system_u:object_r:initctl_t:s0 /var/run/systemd/journal(/.*)? all files system_u:object_r:syslogd_var_run_t:s0 /var/run/systemd/journal/dev-log socket system_u:object_r:devlog_t:s0 /var/run/systemd/journal/syslog socket system_u:object_r:devlog_t:s0 /var/run/systemd/machine-id regular file system_u:object_r:machineid_t:s0 /var/run/systemd/machines(/.*)? all files system_u:object_r:systemd_machined_var_run_t:s0 /var/run/systemd/machines.lock regular file system_u:object_r:systemd_machined_var_run_t:s0 /var/run/systemd/multi-session-x(/.*)? all files system_u:object_r:xdm_var_run_t:s0 /var/run/systemd/netif(/.*)? all files system_u:object_r:systemd_networkd_var_run_t:s0 /var/run/systemd/network(/.*)? all files system_u:object_r:net_conf_t:s0 /var/run/systemd/readahead(/.*)? all files system_u:object_r:readahead_var_run_t:s0 /var/run/systemd/resolve(/.*)? all files system_u:object_r:systemd_resolved_var_run_t:s0 /var/run/systemd/resolve/resolv\.conf regular file system_u:object_r:net_conf_t:s0 /var/run/systemd/resolve/stub-resolv\.conf all files system_u:object_r:net_conf_t:s0 /var/run/systemd/seats(/.*)? all files system_u:object_r:systemd_logind_var_run_t:s0 /var/run/systemd/sessions(/.*)? all files system_u:object_r:systemd_logind_sessions_t:s0 /var/run/systemd/shutdown(/.*)? all files system_u:object_r:systemd_logind_var_run_t:s0 /var/run/systemd/timesync(/.*)? all files system_u:object_r:systemd_timedated_var_run_t:s0 /var/run/systemd/transient(/.*)? all files system_u:object_r:systemd_unit_file_t:s0 /var/run/systemd/units(/.*)? all files system_u:object_r:systemd_unit_file_t:s0 /var/run/systemd/userdb(/.*)? all files system_u:object_r:systemd_userdbd_runtime_t:s0 /var/run/systemd/users(/.*)? all files system_u:object_r:systemd_logind_var_run_t:s0 ``` I chose component `Basesystem`, assuming that `Security` may have implications of urgency not relevant for this case. -- You are receiving this mail because: You are on the CC list for the bug.

1 5