Skip to content

rework dynamicuser allocation logic to gracefully handle if we can't take the /etc/passwd lock if the user already exists #9583

@filbranden

Description

@filbranden

systemd version the issue has been seen with
systemd-239-2.fc29.x86_64

Used distribution
Fedora Rawhide

Expected behaviour you didn't see
systemd-networkd (and other services using DynamicUser=, such as systemd-resolved) starts and works fine.

Unexpected behaviour you saw

Jul 13 11:10:58 rawhide.libvirt systemd[1]: Starting Network Service...
Jul 13 11:10:58 rawhide.libvirt audit[717]: AVC avc:  denied  { write } for  pid=717 comm="(networkd)" name=".pwd.lock" dev="dm-0" ino=656097 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=0
Jul 13 11:10:58 rawhide.libvirt systemd[717]: systemd-networkd.service: Failed to update dynamic user credentials: Permission denied
Jul 13 11:10:58 rawhide.libvirt systemd[717]: systemd-networkd.service: Failed at step USER spawning /usr/lib/systemd/systemd-networkd: Permission denied
Jul 13 11:10:58 rawhide.libvirt systemd[1]: systemd-networkd.service: Main process exited, code=exited, status=217/USER
Jul 13 11:10:58 rawhide.libvirt systemd[1]: systemd-networkd.service: Failed with result 'exit-code'.
Jul 13 11:10:58 rawhide.libvirt systemd[1]: Failed to start Network Service.

Steps to reproduce the problem
Just start systemd-networkd with the default setup of a Fedora Rawhide, with SELinux enabled.

Metadata

Metadata

Assignees

No one assigned

    Labels

    RFE 🎁Request for Enhancement, i.e. a feature requestpid1selinux

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions