After updating my stable gentoo system (openrc, selinux) udev fails to start when selinux is set to enforcing. (When it's set to permissive on boot it's working.) debug ~ # /etc/init.d/udev status Authenticating root. Password: * status: crashed debug ~ # Since I have udev rules to rename the network interfaces based on the mac this makes the system unusable when the system is booting with selinux set to enforcing. The proper fix seems to switch the sec-policies to ~amd64 (2.20210203-r1) (Downgrading udev to sys-fs/udev-245.5-r1 is also working.) Looks like that after the stabilizing of sys-fs/udev-248 we now also must stabilize the sec-policies 2.20210203-r1. (I tried to amend only the old policy but gave up after some time. That turned out to be a huge project...) Here the output from "emerge --info sys-fs/udev" after booting the system in permissive mode when enforcing is broken: Portage 3.0.20 (python 3.9.5-final-0, default/linux/amd64/17.1/hardened/selinux, gcc-10.3.0, glibc-2.33-r1, 5.13.1-gentoo x86_64) ================================================================= System Settings ================================================================= System uname: Linux-5.13.1-gentoo-x86_64-Intel_Xeon_E3-12xx_v2_-Ivy_Bridge,_IBRS-with-glibc2.33 KiB Mem: 16047772 total, 15815328 free KiB Swap: 389116 total, 389116 free Timestamp of repository gentoo: Sun, 25 Jul 2021 16:30:01 +0000 Head commit of repository gentoo: c97dabece51af0cdb20d449ee65c0bc9997820ba sh bash 5.1_p8 ld GNU ld (Gentoo 2.35.2 p1) 2.35.2 app-shells/bash: 5.1_p8::gentoo dev-lang/perl: 5.34.0::gentoo dev-lang/python: 3.8.10_p2::gentoo, 3.9.5_p2::gentoo dev-util/cmake: 3.18.5::gentoo dev-util/pkgconfig: 0.29.2::gentoo sys-apps/baselayout: 2.7::gentoo sys-apps/openrc: 0.42.1-r1::gentoo sys-apps/sandbox: 2.24::gentoo sys-devel/autoconf: 2.69-r5::gentoo sys-devel/automake: 1.16.3-r1::gentoo sys-devel/binutils: 2.35.2::gentoo sys-devel/gcc: 10.3.0-r2::gentoo sys-devel/gcc-config: 2.4::gentoo sys-devel/libtool: 2.4.6-r6::gentoo sys-devel/make: 4.3::gentoo sys-kernel/linux-headers: 5.10::gentoo (virtual/os-headers) sys-libs/glibc: 2.33-r1::gentoo Repositories: gentoo location: /usr/portage sync-type: rsync sync-uri: rsync://owl.mordor/gentoo-portage priority: -1000 sync-rsync-verify-metamanifest: yes sync-rsync-verify-jobs: 1 sync-rsync-extra-opts: sync-rsync-verify-max-age: 24 alexlocal location: /usr/local/portage masters: gentoo priority: 0 ACCEPT_KEYWORDS="amd64" ACCEPT_LICENSE="@FREE" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-march=native -O2 -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/easy-rsa /usr/share/gnupg/qualified.txt" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo" CXXFLAGS="-march=native -O2 -pipe" DISTDIR="/usr/portage/distfiles" ENV_UNSET="CARGO_HOME DBUS_SESSION_BUS_ADDRESS DISPLAY GOBIN GOPATH PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles ipc-sandbox merge-sync multilib-strict network-sandbox news parallel-fetch preserve-libs protect-owned qa-unresolved-soname-deps sandbox selinux sesandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://ftp.uni-erlangen.de/pub/mirrors/gentoo" LANG="en_US.utf8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" MAKEOPTS="-j9" PKGDIR="/usr/portage/packages" PORTAGE_BINHOST="rsync://owl.mordor/gentoo-portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git" PORTAGE_TMPDIR="/var/tmp" USE="acl amd64 audit bzip2 caps crypt hardened iconv ipv6 libglvnd libtirpc multilib ncurses nls nptl openmp pam pcre pie readline seccomp selinux split-usr ssl ssp unicode xattr xtpax zlib" ABI_X86="64" ADA_TARGET="gnat_2018" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="karbon sheets words" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="mmx mmxext popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock greis isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" GRUB_PLATFORMS="pc" INPUT_DEVICES="libinput" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LUA_SINGLE_TARGET="lua5-1" LUA_TARGETS="lua5-1" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php7-3 php7-4" POSTGRES_TARGETS="postgres10 postgres11" PYTHON_SINGLE_TARGET="python3_8" PYTHON_TARGETS="python3_9 python3_8" RUBY_TARGETS="ruby26" USERLAND="GNU" VIDEO_CARDS="amdgpu fbdev intel nouveau radeon radeonsi vesa dummy v4l" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq proto steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CC, CPPFLAGS, CTARGET, CXX, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, LINGUAS, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, RUSTFLAGS ================================================================= Package Settings ================================================================= sys-fs/udev-248::gentoo was built with the following: USE="acl kmod (selinux) (split-usr) -static-libs" ABI_X86="(64) -32 (-x32)" FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs buildpkg config-protect-if-modified distlocks ebuild-locks fixlafiles ipc-sandbox merge-sync multilib-strict network-sandbox news parallel-fetch preserve-libs protect-owned qa-unresolved-soname-deps sandbox selinux sesandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr"
The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=82a0082762f7687ec3750a398f4e35af55ed8714 commit 82a0082762f7687ec3750a398f4e35af55ed8714 Author: Jakov Smolić <jsmolic@gentoo.org> AuthorDate: 2023-09-23 00:51:19 +0000 Commit: Jakov Smolić <jsmolic@gentoo.org> CommitDate: 2023-09-23 00:51:28 +0000 sys-fs/udev: treeclean Closes: https://bugs.gentoo.org/514016 Closes: https://bugs.gentoo.org/804218 Closes: https://bugs.gentoo.org/701056 Signed-off-by: Jakov Smolić <jsmolic@gentoo.org> profiles/package.mask | 1 - profiles/targets/systemd/package.mask | 3 +-- sys-fs/udev/metadata.xml | 11 ----------- sys-fs/udev/udev-250.ebuild | 15 --------------- 4 files changed, 1 insertion(+), 29 deletions(-)
