Dear maintainer,

I upgraded to 257.1-1, and both systemd-timesyncd and systemd-resolved fail to come up at boot:

systemd[1]: Starting systemd-resolved.service - Network Name Resolution...
systemd[1]: Starting systemd-timesyncd.service - Network Time Synchronization...
systemd[1]: Starting systemd-tmpfiles-setup-dev.service - Create Static Device Nodes in /dev...
systemd[1]: Finished systemd-random-seed.service - Load/Save OS Random Seed.
systemd[1]: Finished systemd-tmpfiles-setup-dev.service - Create Static Device Nodes in /dev.
systemd[1]: Starting systemd-udevd.service - Rule-based Manager for Device Events and Files...
systemd-journald[1924]: Journal started
systemd-journald[1924]: Runtime Journal (/run/log/journal/a79e93a319504207b280effb512d2345) is 8M, max 620.9M, 612.9M free.
systemd-modules-load[1925]: Inserted module 'msr'
systemd-modules-load[1925]: Inserted module 'usbip_core'
systemd-modules-load[1925]: Inserted module 'usbip_host'
lvm[1916]:   2 logical volume(s) in volume group REDACTED
systemd[1]: Started systemd-journald.service - Journal Service.
systemd-timesyncd[1944]: Failed to allocate manager: Permission denied
systemd[1]: systemd-timesyncd.service: Main process exited, code=exited, status=1/FAILURE
systemd[1]: systemd-timesyncd.service: Failed with result 'exit-code'.
systemd[1]: Failed to start systemd-timesyncd.service - Network Time Synchronization.
systemd[1]: Finished lvm2-monitor.service - Monitoring of LVM2 mirrors, snapshots etc. using dmeventd or progress polling.
systemd[1]: systemd-timesyncd.service: Scheduled restart job, restart counter is at 1.
systemd[1]: Reached target local-fs-pre.target - Preparation for Local File Systems.
systemd[1]: Starting systemd-journal-flush.service - Flush Journal to Persistent Storage...
systemd[1]: Starting systemd-timesyncd.service - Network Time Synchronization...
systemd-resolved[1943]: Positive Trust Anchors:
systemd-resolved[1943]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
systemd-resolved[1943]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
systemd-journald[1924]: Time spent on flushing to /var/log/journal/a79e93a319504207b280effb512d2345 is 85.680ms for 1256 entries.
systemd-journald[1924]: System Journal (/var/log/journal/a79e93a319504207b280effb512d2345) is 2G, max 4G, 1.9G free.
systemd-journald[1924]: Received client request to flush runtime journal.
kernel: Adding 73400316k swap on REDACTED
kernel: input: Lid Switch as REDACTED
kernel: ACPI: AC: AC Adapter [ACAD] (on-line)
kernel: ACPI: button: Lid Switch [LID0]
kernel: input: Power Button as REDACTED
kernel: ACPI: button: Power Button [PWRB]
mtp-probe[2045]: checking REDACTED
systemd[1]: Finished systemd-udev-trigger.service - Coldplug All udev Devices.
mtp-probe[2044]: checking REDACTED
systemd-udevd[1953]: Using default interface naming scheme 'v257'.
mtp-probe[2045]: bus: REDACTED was not an MTP device
systemd-resolved[1943]: Using system hostname 'REDACTEDHOSTNAME'.
mtp-probe[2044]: bus: REDACTED was not an MTP device
systemd-resolved[1943]: Could not create manager: Permission denied
usbauth[2049]: called by udev with given usb_interface
systemd[1]: Finished nftables.service - nftables.
mtp-probe[2050]: checking REDACTED
kernel: sp5100_tco: SP5100/SB800 TCO WatchDog Timer Driver
kernel: sp5100-tco sp5100-tco: Using 0xfeb00000 for watchdog MMIO address
kernel: sp5100-tco sp5100-tco: initialized. heartbeat=60 sec (nowayout=0)
kernel: ccp 0000:c1:00.2: tee enabled
kernel: ccp 0000:c1:00.2: psp enabled
systemd[1]: systemd-resolved.service: Main process exited, code=exited, status=1/FAILURE
mtp-probe[2051]: checking REDACTED
systemd[1]: systemd-resolved.service: Failed with result 'exit-code'.
usbauth[2052]: called by udev with given usb_interface
systemd[1]: Failed to start systemd-resolved.service - Network Name Resolution.
usbauth[2055]: called by udev with given usb_interface
systemd[1]: systemd-resolved.service: Scheduled restart job, restart counter is at 1.


It retries 5 times, then gives up.  Once I log in, I can restart both of these units, and they come up perfectly fine. (!!)

Also, I'm pretty sure this was working with 257-2.  This particular log is from 257.1-3, but it is not
meaningfully different from any other 257.1-* versions.

I am running with selinux in enforcing mode, but I've run `semodule -DB`, and as you can see, there are
no audit warnings.  So, I'm at a loss for how selinux could be causing the problem here.

I have another machine (which is not running selinux in enforcing mode) that isn't affected by this,
so I'm at a bit of a loss how to debug this.

I tried adding a delay to the restart on systemd-resolved (1 second).  This just slowed down the boot by a few seconds,
delaying bringing up `nss-lookup.target`, which blocks the rest of the boot.

I suspect that timesyncd and resolved have some unstated dependency on something that transitively depends on
nss-lookup.target, possibly only on selinux systems (but again, I don't see how that could be the case,
given the lack of audit errors).  Maybe systemd-tmpfiles is fixing permissions on something?

I'd prefer not to boot this machine up in permissive mode, if possible.

Best,
Antonio

Control: tags -1 moreinfo

Does it work if you boot in permissive mode or with selinux disabled?

~months ago that I've been updating.  Then, I mostly-followed [1].
Specifically, I:

apt-get install systemd-resolved
reboot
apt-get install selinux-basics selinux-policy-default auditd
selinux-activate
reboot
(let relabel finish)
(let automatic reboot get to grub)
set enforcing=1 at the grub menu
journalctl -b -u systemd-resolved.service

I observe one restart of systemd-resolved, before it works.  There are avc warnings here, but they actually precede
the systemd-resolved startup:

Dec 21 20:21:58 host kernel: audit: type=1400 audit(1734812518.076:5): avc:  denied  { watch } for  pid=300 comm="systemd-resolve" path="/run/systemd" dev="tmpfs" ino=382 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:init_runtime_t:s0 tclass=dir permissive=0
Dec 21 20:21:57 host systemd[1]: Finished systemd-udev-trigger.service - Coldplug All udev Devices.
Dec 21 20:21:57 host systemd[1]: Starting ifupdown-pre.service - Helper to synchronize boot up for ifupdown...
Dec 21 20:21:58 host systemd[1]: Finished systemd-sysctl.service - Apply Kernel Variables.
Dec 21 20:21:58 host systemd[1]: Finished systemd-random-seed.service - Load/Save OS Random Seed.
Dec 21 20:21:58 host systemd[1]: Finished systemd-tmpfiles-setup-dev-early.service - Create Static Device Nodes in /dev gracefully.
Dec 21 20:21:58 host systemd[1]: systemd-sysusers.service - Create System Users was skipped because no trigger condition checks were met.
Dec 21 20:21:58 host systemd[1]: Starting systemd-resolved.service - Network Name Resolution...
Dec 21 20:21:58 host systemd[1]: Starting systemd-tmpfiles-setup-dev.service - Create Static Device Nodes in /dev...
Dec 21 20:21:58 host systemd-resolved[300]: Positive Trust Anchors:
Dec 21 20:21:58 host systemd-resolved[300]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
Dec 21 20:21:58 host systemd-resolved[300]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
Dec 21 20:21:58 host systemd[1]: Finished systemd-tmpfiles-setup-dev.service - Create Static Device Nodes in /dev.
Dec 21 20:21:58 host systemd[1]: Reached target local-fs-pre.target - Preparation for Local File Systems.
Dec 21 20:21:58 host systemd[1]: Reached target local-fs.target - Local File Systems.
Dec 21 20:21:58 host systemd[1]: Listening on systemd-sysext.socket - System Extension Image Management.
Dec 21 20:21:58 host systemd[1]: apparmor.service - Load AppArmor profiles was skipped because of an unmet condition check (ConditionSecurity=apparmor).
Dec 21 20:21:58 host systemd[1]: selinux-autorelabel-mark.service - Mark the need to relabel after reboot was skipped because of an unmet condition check (ConditionSecurity=!selinux).
Dec 21 20:21:58 host systemd[1]: Starting systemd-binfmt.service - Set Up Additional Binary Formats...
Dec 21 20:21:58 host systemd-resolved[300]: Using system hostname 'host'.
Dec 21 20:21:58 host systemd-resolved[300]: Could not create manager: Permission denied
Dec 21 20:21:58 host systemd[1]: Starting systemd-udevd.service - Rule-based Manager for Device Events and Files...
Dec 21 20:21:58 host systemd[1]: systemd-resolved.service: Main process exited, code=exited, status=1/FAILURE
Dec 21 20:21:58 host systemd[1]: systemd-resolved.service: Failed with result 'exit-code'.
Dec 21 20:21:58 host systemd[1]: Failed to start systemd-resolved.service - Network Name Resolution.
Dec 21 20:21:58 host systemd[1]: systemd-resolved.service: Scheduled restart job, restart counter is at 1.
Dec 21 20:21:58 host systemd[1]: proc-sys-fs-binfmt_misc.automount: Got automount request for /proc/sys/fs/binfmt_misc, triggered by 306 (systemd-binfmt)
Dec 21 20:21:58 host systemd[1]: Starting systemd-resolved.service - Network Name Resolution...
Dec 21 20:21:58 host systemd-udevd[307]: Using default interface naming scheme 'v257'.
Dec 21 20:21:58 host systemd[1]: Finished systemd-journal-flush.service - Flush Journal to Persistent Storage.
Dec 21 20:21:58 host systemd[1]: Starting systemd-tmpfiles-setup.service - Create System Files and Directories...
Dec 21 20:21:58 host systemd[1]: Started systemd-udevd.service - Rule-based Manager for Device Events and Files.
Dec 21 20:21:58 host systemd-tmpfiles[316]: /usr/lib/tmpfiles.d/legacy.conf:14: Duplicate line for path "/run/lock", ignoring.
Dec 21 20:21:58 host systemd-tmpfiles[316]: Failed to open path '/etc/profile.d': Permission denied
Dec 21 20:21:58 host systemd-tmpfiles[316]: Failed to open path '/var/spool/cron': Permission denied
Dec 21 20:21:58 host systemd-tmpfiles[316]: Failed to fstat(/root/.ssh): Permission denied
Dec 21 20:21:58 host systemd-tmpfiles[316]: Failed to fstat(/var/lib/systemd/network): Permission denied
Dec 21 20:21:58 host kernel: audit: type=1400 audit(1734812518.176:6): avc:  denied  { relabelfrom } for  pid=316 comm="systemd-tmpfile" name="root" dev="sda1" ino=524306 scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=dir permissive=0
Dec 21 20:21:58 host systemd[1]: Finished systemd-tmpfiles-setup.service - Create System Files and Directories.
Dec 21 20:21:58 host systemd[1]: Found device dev-ttyS0.device - /dev/ttyS0.
Dec 21 20:21:58 host systemd[1]: Starting audit-rules.service - Load Audit Rules...
Dec 21 20:21:58 host systemd[1]: ldconfig.service - Rebuild Dynamic Linker Cache was skipped because no trigger condition checks were met.
Dec 21 20:21:58 host systemd[1]: systemd-firstboot.service - First Boot Wizard was skipped because of an unmet condition check (ConditionFirstBoot=yes).
Dec 21 20:21:58 host systemd[1]: first-boot-complete.target - First Boot Complete was skipped because of an unmet condition check (ConditionFirstBoot=yes).
Dec 21 20:21:58 host systemd[1]: systemd-journal-catalog-update.service - Rebuild Journal Catalog was skipped because of an unmet condition check (ConditionNeedsUpdate=/var).
Dec 21 20:21:58 host systemd[1]: systemd-machine-id-commit.service - Save Transient machine-id to Disk was skipped because of an unmet condition check (ConditionPathIsMountPoint=/etc/machine-id).
Dec 21 20:21:58 host systemd[1]: systemd-update-done.service - Update is Completed was skipped because no trigger condition checks were met.
Dec 21 20:21:58 host kernel: sd 0:0:0:0: Attached scsi generic sg0 type 0
Dec 21 20:21:58 host kernel: sr 1:0:0:0: Attached scsi generic sg1 type 5
Dec 21 20:21:58 host kernel: input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input4
Dec 21 20:21:58 host augenrules[337]: /usr/sbin/augenrules: No change
Dec 21 20:21:58 host augenrules[361]: No rules
Dec 21 20:21:58 host augenrules[361]: enabled 0
Dec 21 20:21:58 host augenrules[361]: failure 1
Dec 21 20:21:58 host augenrules[361]: pid 0
Dec 21 20:21:58 host augenrules[361]: rate_limit 0
Dec 21 20:21:58 host augenrules[361]: backlog_limit 8192
Dec 21 20:21:58 host augenrules[361]: lost 0
Dec 21 20:21:58 host augenrules[361]: backlog 0
Dec 21 20:21:58 host augenrules[361]: backlog_wait_time 15000
Dec 21 20:21:58 host augenrules[361]: backlog_wait_time_actual 0
Dec 21 20:21:58 host augenrules[361]: enabled 0
Dec 21 20:21:58 host augenrules[361]: failure 1
Dec 21 20:21:58 host augenrules[361]: pid 0
Dec 21 20:21:58 host augenrules[361]: rate_limit 0
Dec 21 20:21:58 host augenrules[361]: backlog_limit 8192
Dec 21 20:21:58 host augenrules[361]: lost 0
Dec 21 20:21:58 host augenrules[361]: backlog 0
Dec 21 20:21:58 host augenrules[361]: backlog_wait_time 15000
Dec 21 20:21:58 host augenrules[361]: backlog_wait_time_actual 0
Dec 21 20:21:58 host augenrules[361]: enabled 0
Dec 21 20:21:58 host augenrules[361]: failure 1
Dec 21 20:21:58 host augenrules[361]: pid 0
Dec 21 20:21:58 host augenrules[361]: rate_limit 0
Dec 21 20:21:58 host augenrules[361]: backlog_limit 8192
Dec 21 20:21:58 host augenrules[361]: lost 0
Dec 21 20:21:58 host augenrules[361]: backlog 0
Dec 21 20:21:58 host augenrules[361]: backlog_wait_time 60000
Dec 21 20:21:58 host augenrules[361]: backlog_wait_time_actual 0
Dec 21 20:21:58 host systemd[1]: audit-rules.service: Deactivated successfully.
Dec 21 20:21:58 host systemd[1]: Finished audit-rules.service - Load Audit Rules.
Dec 21 20:21:58 host systemd[1]: Starting auditd.service - Security Audit Logging Service...
Dec 21 20:21:58 host kernel: ACPI: button: Power Button [PWRF]
Dec 21 20:21:58 host kernel: input: PC Speaker as /devices/platform/pcspkr/input/input5
Dec 21 20:21:58 host kernel: bochs-drm 0000:00:02.0: vgaarb: deactivate vga console
Dec 21 20:21:58 host kernel: parport_pc 00:03: reported by Plug and Play ACPI
Dec 21 20:21:58 host kernel: parport0: PC-style at 0x378, irq 7 [PCSPP,TRISTATE]
Dec 21 20:21:58 host kernel: Console: switching to colour dummy device 80x25
Dec 21 20:21:58 host kernel: [drm] Found bochs VGA, ID 0xb0c5.
Dec 21 20:21:58 host kernel: [drm] Framebuffer size 16384 kB @ 0xfd000000, mmio @ 0xfebd0000.
Dec 21 20:21:58 host kernel: [drm] Found EDID data blob.
Dec 21 20:21:58 host kernel: [drm] Initialized bochs-drm 1.0.0 for 0000:00:02.0 on minor 0
Dec 21 20:21:58 host kernel: fbcon: bochs-drmdrmfb (fb0) is primary device
Dec 21 20:21:58 host kernel: Console: switching to colour frame buffer device 160x50
Dec 21 20:21:58 host kernel: bochs-drm 0000:00:02.0: [drm] fb0: bochs-drmdrmfb frame buffer device
Dec 21 20:21:58 host kernel: powernow_k8: Power state transitions not supported
Dec 21 20:21:58 host kernel: powernow_k8: Power state transitions not supported
Dec 21 20:21:58 host auditd[372]: No plugins found, not dispatching events
Dec 21 20:21:58 host systemd[1]: Started auditd.service - Security Audit Logging Service.
Dec 21 20:21:58 host auditd[372]: Init complete, auditd 4.0.2 listening for events (startup state enable)
Dec 21 20:21:58 host kernel: ppdev: user-space parallel port driver
Dec 21 20:21:58 host systemd[1]: Finished ifupdown-pre.service - Helper to synchronize boot up for ifupdown.
Dec 21 20:21:58 host systemd[1]: Starting networking.service - Raise network interfaces...
Dec 21 20:21:58 host dhclient[396]: Internet Systems Consortium DHCP Client 4.4.3-P1
Dec 21 20:21:58 host ifup[396]: Internet Systems Consortium DHCP Client 4.4.3-P1
Dec 21 20:21:58 host ifup[396]: Copyright 2004-2022 Internet Systems Consortium.
Dec 21 20:21:58 host ifup[396]: All rights reserved.
Dec 21 20:21:58 host ifup[396]: For info, please visit https://www.isc.org/software/dhcp/
Dec 21 20:21:58 host dhclient[396]: Copyright 2004-2022 Internet Systems Consortium.
Dec 21 20:21:58 host dhclient[396]: All rights reserved.
Dec 21 20:21:58 host dhclient[396]: For info, please visit https://www.isc.org/software/dhcp/
Dec 21 20:21:58 host dhclient[396]:
Dec 21 20:21:58 host ifup[405]: mkdir: cannot create directory '/run/systemd/resolve': Permission denied
Dec 21 20:21:58 host ifup[406]: chown: cannot access '/run/systemd/resolve/netif': Permission denied
Dec 21 20:21:58 host dhclient[396]: Listening on LPF/eth0/52:54:00:12:34:56
Dec 21 20:21:58 host ifup[396]: Listening on LPF/eth0/52:54:00:12:34:56
Dec 21 20:21:58 host ifup[396]: Sending on   LPF/eth0/52:54:00:12:34:56
Dec 21 20:21:58 host ifup[396]: Sending on   Socket/fallback
Dec 21 20:21:58 host ifup[396]: DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 3
Dec 21 20:21:58 host dhclient[396]: Sending on   LPF/eth0/52:54:00:12:34:56
Dec 21 20:21:58 host ifup[396]: DHCPOFFER of 10.0.2.15 from 10.0.2.2
Dec 21 20:21:58 host ifup[396]: DHCPREQUEST for 10.0.2.15 on eth0 to 255.255.255.255 port 67
Dec 21 20:21:58 host ifup[396]: DHCPACK of 10.0.2.15 from 10.0.2.2
Dec 21 20:21:58 host dhclient[396]: Sending on   Socket/fallback
Dec 21 20:21:58 host dhclient[396]: DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 3
Dec 21 20:21:58 host dhclient[396]: DHCPOFFER of 10.0.2.15 from 10.0.2.2
Dec 21 20:21:58 host dhclient[396]: DHCPREQUEST for 10.0.2.15 on eth0 to 255.255.255.255 port 67
Dec 21 20:21:58 host dhclient[396]: DHCPACK of 10.0.2.15 from 10.0.2.2
Dec 21 20:21:58 host ifup[422]: mkdir: cannot create directory '/run/systemd/resolve': Permission denied
Dec 21 20:21:58 host ifup[423]: chown: cannot access '/run/systemd/resolve/netif': Permission denied
Dec 21 20:21:58 host ifup[413]: /usr/sbin/dhclient-script: 95: /etc/dhcp/dhclient-exit-hooks.d/resolved: cannot create /run/systemd/resolve/netif/2: Permission denied
Dec 21 20:21:58 host ifup[432]: chown: cannot access '/run/systemd/resolve/netif/2': Permission denied
Dec 21 20:21:58 host dhclient[396]: bound to 10.0.2.15 -- renewal in 32499 seconds.
Dec 21 20:21:58 host ifup[396]: bound to 10.0.2.15 -- renewal in 32499 seconds.
Dec 21 20:21:58 host systemd[1]: Finished networking.service - Raise network interfaces.
Dec 21 20:21:58 host systemd[1]: Mounting proc-sys-fs-binfmt_misc.mount - Arbitrary Executable File Formats File System...
Dec 21 20:21:58 host systemd[1]: Mounting shared.mount - /shared...
Dec 21 20:21:58 host kernel: 9pnet_virtio: no channels available for device sbuild-qemu
Dec 21 20:21:58 host mount[458]: mount: /shared: special device sbuild-qemu does not exist.
Dec 21 20:21:58 host mount[458]:        dmesg(1) may have more information after failed mount system call.
Dec 21 20:21:58 host systemd[1]: Mounted proc-sys-fs-binfmt_misc.mount - Arbitrary Executable File Formats File System.
Dec 21 20:21:58 host systemd[1]: shared.mount: Mount process exited, code=exited, status=32/n/a
Dec 21 20:21:58 host systemd[1]: shared.mount: Failed with result 'exit-code'.
Dec 21 20:21:58 host systemd[1]: Failed to mount shared.mount - /shared.
Dec 21 20:21:58 host systemd[1]: Finished systemd-binfmt.service - Set Up Additional Binary Formats.
Dec 21 20:21:59 host systemd-resolved[308]: Positive Trust Anchors:
Dec 21 20:21:59 host systemd-resolved[308]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
Dec 21 20:21:59 host systemd-resolved[308]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
Dec 21 20:21:59 host systemd-resolved[308]: Using system hostname 'host'.
Dec 21 20:21:59 host systemd[1]: Started systemd-resolved.service - Network Name Resolution.

Motivated by the above, I added a `After=systemd-tmpfiles-setup.service`
dependency on systemd-resolved and systemd-timesyncd. Booting with this
change has so far resolved my issue.

It's still not clear to me what exactly systemd-tmpfiles is doing, but it is
apparently required.

Best,
Antonio

[1] https://wiki.debian.org/SELinux/Setup

That's still in enforcing mode, from the logs. Does it work in
permissive mode or with selinux disabled?

1. The issue is resolved by ordering systemd-resolved
after systemd-tmpfiles-setup using an After= dependency.

2. It works in permissive mode.

Antonio

Reverting `PrivateTmp=yes` from `PrivateTmp=disconnected` also resolves the
issue.  So, it's a regression fixing [1], which I'm trying to understand.

I see it was you who actually authored the fix for [1].  I presume that using
disconnected is removes the dependency on systemd-tmpfiles.  But it seems the
the selinux labels are not being changed when systemd-tmpfiles is brought up:

In particular, the audit violations I see are supposedly allowed by the selinux
policy I'm currently running.  Does that mean that the objects in question have
different labels now than at policy violation time (presumably before
systemd-tmpfiles is re-labeling them)?  I cannot find any indication that selinux
policies are being loaded during boot.

Best,
Antonio


[1] https://github.com/systemd/systemd/issues/35582

The problem is resolved with a local selinux module with these extra permissions granted to systemd_resolved_t:

allow systemd_resolved_t init_runtime_t:sock_file create;
allow systemd_resolved_t init_runtime_t:dir watch;

The confusion was caused by [1], or something else that caused the kernel to not print the avc: lines
on policy denial.  By luck, one of the boot-ups exposed this.  Earlier boots might have exposed the lines,
but the audit2* commands seem to only process avc: lines after the audit daemon is started, so I might
have missed the kernel log entry, because I was assuming that audit2why would have shown me something.

I'm not sure why delaying the service startup by a couple seconds/until after systemd-tmpfiles finishes
causes the service bring-up to succeed, so the correct fix is probably more than just adding those
two extra permissions, but it works in the meantime.

Best,
Antonio

[1] https://github.com/linux-audit/audit-kernel/issues/17