Hi, I’ve recently tried to upgrade my Fedora 42 Silverblue desktop system several times over the past few days and I have failed to complete the upgrade. After successfully running rpm-ostree upgrade then rebooting the machine, it reverts to the previous deployment and rpm-ostree status has the following warning at the top:
State: idle
Warning: failed to finalize previous deployment
error: Finalizing deployment: Finalizing SELinux policy: Child process exited with code 1
check `journalctl -b -1 -u ostree-finalize-staged.service`
When I check the system log with journalctl, I get the following error message:
Finished ostree-finalize-staged.service - OSTree Finalize Staged Deployment.
Stopping ostree-finalize-staged.service - OSTree Finalize Staged Deployment...
Finalizing staged deployment
Copying /etc changes: 60 modified, 2 removed, 158 added
Copying /etc changes: 60 modified, 2 removed, 158 added
Refreshing SELinux policy
Failed to resolve typeattributeset statement at /etc/selinux/targeted/tmp/modules/100/ssh/cil:291
Failed to resolve AST
semodule: Failed!
Refreshed SELinux policy in 2237 ms
error: Finalizing deployment: Finalizing SELinux policy: Child process exited with code 1
ostree-finalize-staged.service: Control process exited, code=exited, status=1/FAILURE
ostree-finalize-staged.service: Failed with result 'exit-code'.
Stopped ostree-finalize-staged.service - OSTree Finalize Staged Deployment.
I am trying to upgrade from silverblue version 42.20251006.0 (2025-10-06T00:30:10Z) to whatever is the latest. I have also tried to upgrade to fedora 43 beta by running rpm-ostree rebase fedora:fedora/43/x86_64/silverblue. Both the upgrade and rebase attempts succeed the first stage, then roll back to my current version of Fedora 42 after rebooting.
Anyway, does anyone know what causes this or how to determine the root cause so I can try to fix it? If not, is there any additional information I can provide to figure it out?
I got a little bit more clarity into the cause of this for me. I was able to run rpm-ostree deploy with versions from 42.20251007.0 through 42.20251009.0 and complete the upgrade by rebooting, so now my system is based on 42.20251009.0. If I run rpm-ostree deploy 42.20251010.0 and reboot, I have the same problem as before.
Between 1009.0 and 1010.0, there are only upgrades to pipewire and selinux-policy/selinux-policy-targeted (42.9-1.fc42 to 42.12-1.fc42) so it’s probably the selinux upgrade preventing the upgrade but I still don’t know what I can do about it.
Interestingly, I also ran rpm-ostree reset to bring my system back to the base image, then restarted, then tried to upgrade to the latest and I got the same result with the finalization failing.
An error on line 291 seems to indicate that the sshd_session_t type is the one that would be missing according to your error.
Unfortunately, I’m not sure how to workaround this, especially as you said you already tried rpm-ostree reset to get back to the base image.
You can try looking at ostree admin config-diff to see if there are files in /etc that are modified (marked with a M) that would affect SELinux policy.
I’m getting out of my depth re: SELinux, so not sure if I can be of more help.
Ok, thanks for the advice. It actually led me to the solution. I did have a few modifications to /etc/selinux but I had no idea why since I have no interest in selinux and would never change it intentionally. Anyway, I just did a kind of factory reset on the /etc/selinux directory by running rsync -av /usr/etc/selinux/ /etc/selinux/ and cleaning up a few leftover files that looked like they didn’t belong.