Building a new home with systemd-homed on fedora

computersavvy · May 5, 2023, 5:12pm

That selinux message tells you exactly what is wrong. Selinux is in enforcing mode and prevents the activation.
To confirm this is an selinux block you could switch selinux to permissive with sudo setenforce 0 and try again. If it works then the fix recommended in the selinux message should work for a permanent fix with selinux back in enforcing mode.

arturasb · May 5, 2023, 7:52pm

I’d prefer to solve the root cause or at least to help @richiedaze in creating his custom SELinux policy (see first post in this thread) which might become a part of OOTB Fedora’s SELinux policies.
I find difficult to understand, how previously working SELinux policy (or other indirectly related technologies) in F37 was broken by the upgrade to F38. Now it seems that things directly unrelated to systemd-homed (and maybe SELinux) were changed/broken, e.g., LUKS stuff. And I do not understand yet why and how.

computersavvy · May 5, 2023, 8:10pm

Remember that systemd-homed is a relatively new product and is still in development so changes happen frequently. Only with use and trial-by-fire are all the bugs identified and fixed. Welcome to the testing environment.

arturasb · May 5, 2023, 8:40pm

I’m not complaining . I’m trying to help by testing and hoping that others will benefit from my tests in making homed and related technologies better for “average Joe” -that’s me

richiedaze · May 7, 2023, 5:16am

The policy sets permissive mode to systemd_homed_t and systemd_homework_t domains. No need to setenforce.

richiedaze · May 7, 2023, 5:22am

SInce I made the policy, it’s my job to follow upstream and adjust my policy accordingly.

As I wrote above, policy domain is already set to permissive. You will see the error, but be granted permission to move forward. Did you authenticate your user before trying to login?

homectl authenticate arturasbar

arturasb · May 8, 2023, 6:18am

The command above gives this:

Operation on home arturasbar failed: Failed to execute operation: Package not installed

Log:

09:14:31 systemd-homed: Authentication failed: Package not installed
09:14:31 systemd-homewor: Failed to validate disk label: Package not installed
09:14:22 systemd-homed: Authentication failed: No anode
09:13:59 systemd-homewor: Failed to validate disk label: Package not installed
09:13:47 systemd-homed: Authentication failed: No anode

What package isn’t installed ?

richiedaze · May 8, 2023, 12:05pm

github.com/richiedaze/homed-selinux

Add rules for avc denial of homework requesting self create user_namespace and read udev pid files

committed 04:34PM - 07 May 23 UTC

richiedaze

+2 -0

Apr 21 14:14:16 fedora audit[195296]: AVC avc: denied { read } for pid=195296… comm="systemd-homewor" name="b8:17" dev="tmpfs" ino=1169 scontext=system_u:system_r:systemd_homework_t:s0 tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file permissive=1 Apr 21 14:14:16 fedora audit[195296]: AVC avc: denied { open } for pid=195296 comm="systemd-homewor" path="/run/udev/data/b8:17" dev="tmpfs" ino=1169 scontext=system_u:system_r:systemd_homework_t:s0 tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file permissive=1 Apr 21 14:14:16 fedora audit[195296]: AVC avc: denied { getattr } for pid=195296 comm="systemd-homewor" path="/run/udev/data/b8:17" dev="tmpfs" ino=1169 scontext=system_u:system_r:systemd_homework_t:s0 tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file permissive=1 Apr 21 14:14:17 fedora audit[195296]: AVC avc: denied { create } for pid=195296 comm="systemd-homewor" scontext=system_u:system_r:systemd_homework_t:s0 tcontext=system_u:system_r:systemd_homework_t:s0 tclass=user_namespace permissive=1 allow systemd_homework_t self:user_namespace create; udev_read_pid_files(systemd_homework_t)

arturasb · June 20, 2023, 8:06am

Hi all.

Just an update - tried homed on Debian 12, same story there. I can create and activate homed-managed user in the CLI, but unable to log in to GNOME with that user. Log files gives user activation errors - “no anode” and “wrong medium type”. Cannot track them down to the root cause.

Systemd-homed issue ? Or maybe PAM ?

Regards
Artūras B.

richiedaze · June 23, 2023, 9:54pm

I found this searching the web

Error Codes (The GNU C Library)#index-ENOANO

The error code macros are defined in the header file errno.h. All of them expand into integer constant values. Some of these error codes can’t occur on GNU systems, but they can occur using the GNU C Library on other systems.

It is also referenced in the kernel on linux/fs/hpfs/hpfs.h

Maybe the kernel thinks your fs is the high performance filesystem?

Either a kernel or libc file changed from 37 to 38/39? Try Debian 11 to see if it works like 37 does. Then we can narrow in closer.

arturasb · June 23, 2023, 10:17pm

Thank you!
I found that EMEDIUMTYPE is used 4 or 6 times in the codebase of whole systemd. From log files it is not clear which code path triggers the EMEDIUMTYPE output to the log when trying to login GNOME.
I tried homed user on recently released Debian 12. Essentially same story - user is created successfully , I can activate it in CLI using homectl. But I cannot login to GNOME session - GDM shows “user not found” and in the log I get same “no anode” and “wrong medium type” errors.
I raised a bug in github - Unable to login to GNOME using homed-managed user · Issue #28096 · systemd/systemd · GitHub. Lennart suggests there is issue with nsswitch and/or accountservice. I made sure my nsswitch.conf has configuration as per nss-systemd recommendations, but GDM reports “user was not found”…
I get impression that F38 and Debian 12 are suffering from same reason impacting systemd-homed when logging to GNOME. I cannot figure out yet what is missing.

treeshateorcs · July 19, 2023, 1:11am

i’ve hit the same bug - “package not found”, and i’m not using gnome or gdm. i’m trying to log in in a tty

miah7 · July 19, 2023, 2:52am

Could systemd-homed be the default on Fedora Workstation in the future?

computersavvy · July 19, 2023, 3:21am

I would hope not until the bugs are more worked out.

Would not like to see the same type of fiasco that occurred with fedora enabling the auto-suspend as was done with the release of Fedora 38.

arturasb · July 19, 2023, 7:08am

Once it is ready, it probably will. Currently systemd-homed shows good results on its own, e.g., you can create homed-managed users, activate/deactivate, update user’s/user home’s details, etc. But there are significant gaps in integrations with other stacks/frameworks, e.g., GUI login is not working OOTB, I doubt that you can migrate your homed-managed user between system/installations OOTB - this was supposed to be one of value pillars of homed. Lots of work ahead. But I’d wish it worked as advertised, I see potential in homed.

richiedaze · July 20, 2023, 10:48pm

I am still using homed on f38 (Silverblue). I am able to login on gdm and tty using the default homed settings posted by me in the instructions on top . I have a custom authselect profile for my homed (could this be why?). I will spin two boxes with both workstation and silverblue and report the status on my findings here when I get a chance.

richiedaze · July 20, 2023, 11:58pm

Are you using a different filesystem other then default ( btrfs-luks )?

arturasb · July 21, 2023, 6:12am

Potentially, yes. Lennart also mentioned there might be issues with nsswitch and/or accountservice after I raised a issue ticket to systemd on GitHub when I encountered similar issues in Debian 12. I also tried to find some sort of architecture of homed with all its dependencies in order to understand what else to look for errors, but couldn’t find one.
But the PAM part for GUI login seems as my main suspect…

richiedaze · July 30, 2023, 2:19am

Both (ws/silverblue) f38’s are working on clean installations using the default “LUKS/btrfs” settings.

Are you still using custom homectl settings?

arturasb · July 30, 2023, 12:30pm

I normally use EXT4 instead of BTRFS, so I had EXT4 as file system for my homed-managed user’s home as well.
I’ll do the experiment once more - will install FW anew and then will configure my homed user again. I will try both EXT4 and BRTFS filesystems. Let’s see if that will make a difference.